Spybot - black listed processes - white listed processes

Discussion in 'other anti-malware software' started by dog, Jun 18, 2004.

Thread Status:
Not open for further replies.
  1. dog

    dog Guest

    Hi All, ;)

    A little Spybot question in relation to this Thread - Spybot -Ewido Security Suite ... after experiencing this F/P for "Fun Web Products" in regards to Ewido updates ... I allowed the process thru the Spybot popup ... So now when I update Ewido ... the Spybot popup now shows that this is a whitelisted process ... so now I suspect that I have lost process protection for the legit " F.W.P " process ... anyway to sum it all up. Once this is corrected ... How does one change this whitelisted process back to a blacklisted process? - I've search thru Spybot but can't seem to find a way to accomplish this task.

    TIA ;)

    Steve - *puppy*
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Hey dog,

    So i do not mis-understand....where are you seeing blacklisted process and\or whitelisted process ?
     
  3. dog

    dog Guest

    Hey Bubba, ;)

    The Spybot Popup/notification from the system tray - re:whitelisted process. My thread in the Spybot Forum at NI as a pic of the original popup/notification ... (PIC, post by Pig in a Blanket, post #2)

    TIA ;)

    Steve - *puppy*
     
    Last edited by a moderator: Jun 19, 2004
  4. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Ok....what thru me was the reference to white\black listed. When I get the pop-ups I don't see anything but a pop-up....nothing relating to white\black listed.

    In any case....when a user Allows or Deny's a change AND also has the box checked....remember this decision....it adds an entry to the respective file....Allow=RegKeyWhite.sbe and Deny=RegKeyBlack.sbe located in the Application Data\Spybot - Search & Destroy\Excludes folder and these files can be viewed via notepad. What I have done in the past to clear out entries completely is to shutdown TeaTimer(which flushes it's memory)....delete the two files and then re-enable TeaTimer. If you'd rather just remove the offending entry....you should be able to open the RegKeyWhite.sbe file in notepad and edit out your Ewido entry ?

    Edit
    Ok....I see the pic your referring to @ the Net-Integration Forum. I have not experienced a process pop-up as of yet so my knowledge is limited. However....you might still find the file in the above mentioned folder....with a file name dealing with process ?
     
  5. dog

    dog Guest

    Thanks Bubba! ;)

    Much appreciated ... I'll repost if I have any problems ... I will also post a link at the NI Spybot Thread to the solution. ;)

    Thanks

    Steve - *puppy*
     
  6. dog

    dog Guest

    Hi Bubba, ;)

    The location & file name where I found it where a little different for me (XP Home).

    C/doc & settings/all users/spybot/exclude - file name Prcowhite.sbe

    I followed your second suggestion of editting out the "ewido" entry and resaved - seems to have done the trick.

    Next time ... all make sure to tick off the option "Inform me again" re: to pic a NI thread. ;)

    Thanks much Bubba! ;)

    Steve - *puppy*

    Link to the NI Thread
     
    Last edited by a moderator: Jun 19, 2004
  7. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Kewl beans and if you accidently hit the wrong button again at least you know where to look ;)
     
  8. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    Bob & Bubba thank you very much for posing & solving this problem, which of course i had also :D ;)
     
Loading...
Thread Status:
Not open for further replies.