Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

SpyBot Resident and how to use it

Nov 24, 2004 9:36AM PST

I get these popups which I don't know how to handle. Just now, "Search and Destroy has detected an important registry entry that has been changed".
Catagory: User-specic browser toolbar
Change: Value added
Entry: a string of numbers and letters.

I click the ? for more info. There, it has a standard question: "Did you just try to install some Internet Explorer plugin? If it's not shown as a bad one, you should proceed. If this happens out of the blue sky while surfing the web, you should get cautious".

When it popped up, I had a CNET page on my monitor, one thanking me for a post I had just made.

I have no idea how to deal with this, and this kind of thing happens quite regularly, though not frequently.

I'm not so much interested in how to deal with particular problem as I am trying to decide what, if any, use I should try to make of Search & Destroy Resident. I have the notion that I may cause more problems by using it than by getting rid of it, by denying changes I should allow, or allowing changes I should deny. Does anyone have any suggestions or guidelines?

grandpaw

Discussion is locked

- Collapse -
Re: SpyBot Resident and how to use it
Nov 24, 2004 10:19AM PST

I have a question Grandpaw. Did this notice happen right after you put a checkmark in the box on "Misc. IE settings" on SpywareBlaster to lock in your home page? That is fine BUT it adds a registry value that Spybot might have picked up. IF that is the case, just put it into ignore. I had that same thing happen with Ad-Aware, the next time that I scanned after checkmarking that box.

- Collapse -
I think so, Rod
Nov 24, 2004 11:33PM PST

I believe that was the scenario but my memory is so poor that I'm not sure. It's too bad that those popups don't identify what they are talking about in more understandable language, such as making reference to SpyBlaster. Thanks again, Rod. grandpaw

- Collapse -
(NT) (NT) See my answer below in the other post Jerry.
Nov 25, 2004 12:27AM PST
- Collapse -
Another question
Nov 24, 2004 10:44AM PST

besides the one in my previous post. If you open Spybot and click on the "immunize"page, If you have the box on the bottom checked that says "enable permanent blocking of all and addresses in Internet Explorer" (which you SHOULD have checked). There is dropdown box that has 3 options, if you choose the one that says "block all bad pages silently", the popup may go away. Another possiblity is a TeaTimer warning but I think you said in a previous thread that you are not using that.

- Collapse -
Thanks Roddy32...
Nov 24, 2004 2:47PM PST

Those Spybot Resident pop-ups have been driven me nuts and I couldn't figure out how to make'em stop. I was all set to post the question, but Grandpaw7 beat me to it. Thanks again.

- Collapse -
(NT) (NT) You're welcome jdorisco.
Nov 24, 2004 8:37PM PST
- Collapse -
Re: Another question
Nov 25, 2004 12:03AM PST

Rod, I do have Enable etc checked for silent blocking. And I do have TeaTimer active (I probably didn't at one time). But I have a question: isn't it TeaTimer that produces the popups I am wanting to know more about?

As I am understanding it now, if there is something that TeaTimer would issue a warning about, but I don't have TeaTimer active, it will still be taken care of by Search & Destroy when it is run; is that correct? So that, since the warnings by TeaTimer are so inscrutable, if I want to be sure I don't deny a change that I should allow, but I still want to use TeaTimer, my best bet is to ignore its warnings unless I have somehow become sure the change is something I should deny. Of course, that probably makes TeaTimer somewhat useless to use, I guess, but maybe there will be times that I will be able to judge whether to allow or deny the change in the warning.

By the way, for anyone wanted a little more detail on SpyBot, I ran across a tutorial at http://www.bleepingcomputer.com/forums/index.php?showtutorial=43 that might be helpful.

Rod, I look forward to any comments you might want to make. grandpaw

- Collapse -
Re: Another question
Nov 25, 2004 12:25AM PST

Hi Jerry.
Spybot has 2 residents. One is the "SD helper" which is the normal one that most people use. THAT is the one that you can enable silently. It blocks 2320 products (currently). I do NOT have TeaTimer enabled myself so you will learn more from the Bleeping computer article than you will from me. More than likely it is TeaTimer that is creating your popups then.
PS: I THOUGHT you were going to leave Spybot in the "default" mode so you wouldn't get yourself in trouble with it LOL.

- Collapse -
Re: Another question
Nov 25, 2004 7:14AM PST

If I may add my bit? Happy

Hi Grandpaw.

I also have Spybot Tea Timer running but I am thinking about disabling it and going back to the standard Spybot.

The Tea Timer pops up for me whenever I am installing a program or an update, (SP2 was one. I forgot to disengage TT and got a load of Spybot TT pop-ups), that intend to make a change in the registry.

So far with me, I have allowed them all because I have known that I was installing this or that. I haven't yet had to say no to a pop up.

I agree with you that if you do disable it, then running Spybot as normal should be plenty of cover.

However there is a caveat. In your case, if the Tea Timer pop-up appeared and you "were not" installing anything known to you, then if I were you I would be cautious about allowing it. To my mind the Spybot Tea Timer is there to help protect you against anything that tries to amend your registry without your knowledge and behind your back. Normal web surfing should not involve making any changes in the registry and so if that is all you were doing, the TT was informing you that "something was happening" that perhaps should not have been.

So there we are. On the one hand I tell you that disabling the Tea Timer is ok, and then immediately on the other hand I suggest that the TT is protecting you against an unknown attack.

Sorry, Happy

Mark

- Collapse -
Oh, I am, Rod,
Nov 25, 2004 7:15AM PST

Now. I have no recollection of why or when I invoked TeaTimer. But it's out the Windows now. grandpaw

- Collapse -
I hope you dont mind....
Nov 25, 2004 6:38PM PST

...me Jumping in on this thread?
I`m quite new here to Cnet, and I`m certainly no expert or techie, but I thought I`d throw in a few thoughts on this subject.

All in all, I think the general consensus is that Spybot S&D is an excellent example of "helpware" ... Tea Timer is completely baffling though.

I have Tea Timer running all the time and have done for a few months now.
At first, I had no idea what I was doing, or what half of the alphanumeric strings were that showed up as potential threats to my registry. I`m still not much to the wiser now... but... by trial and error, I have learned something that may be of interest.

Its rather simple really...
I block absolutely everything I dont recognise as relevent to what I was just doing before the box popped up. I always tick the box "remember this choice".... and then simply "deny change".

I admit, its rather a cavalier attitude, and COULD have proved problematic (something about allowing a chimpanzee to practice brain surgery? lol)
But this is the whole point of my contribution...
I have blocked absolutely every attempt at altering my registry apart from the ones I really really understand and know about...and guess what???
The pop ups from tea Timer slow to almsot zero, and I have a perfectly clean and smooth running WinXP OS and IE6 Browser.
No programs crashed, no toolbars stopped working, no anomolies have cropped up showing weird error messages when running games, utilities, anything at all!.
it just...works!
In essence, I trusted the Coders and programmers who gave us the wonderful SPybot S&D to "Know" what they were doing when they built this tea timer added extra... and so far, it looks like my faith in them is justified.
I now work on a very simple premise :
If Its trying to write a change to my registry without my knowledge or approval, then it deserves a little suspicion. If I deny it that privelige, and something doesnt work, then...I can always uninstall and then reinstall.
I`m not saying my way is right, I`m just offering an alternate view... and one that so far, is right for me, and works absolutely fine Happy

- Collapse -
Denille, a good and provocative contribution
Nov 25, 2004 11:01PM PST

A question I have, though, is: how can you tell if the pop up concerns something you are currently working on? My recollection is that it's hard to tell from some popups what change they are concerned with. But you seem to me to have a good point, if the popup doesn't concern what you are currently doing, it is likely [or it must be?] a problem.

Thanks for the post, and welcome to CNET. Hope to see your name in the future.

grandpaw

- Collapse -
Re: Denille, a good and provocative contribution
Nov 26, 2004 1:55AM PST

Hi Grandpaw,

I noticed that on a number of occasions, if I was installing ...lets say... an art program, or an image editor, or even something like the latest version of AdAware, Tea Timer would pop up asking for me to make a choice regarding a registry entry.
If the program is one of repute, widely used by many, and comes from an established company with no known record for tracking cookies or data gathering, then it gets the thumbs upo from me and the entry to th eregistry is allowed.
If its not known to me, if its something new Ive never seen before, it gets blocked.
On most of the "allow" cases that I choose to pass through, the Tea Timer pop up will often contain a name or an abbreviation related to the actual product being installed or executed.
These are the only ones that I agree to.
Happy