Spybot - black listed processes - white listed processes

Discussion in 'other anti-malware software' started by dog, Jun 18, 2004.

Thread Status:
Not open for further replies.
  1. dog

    dog Guest

    Hi All, ;)

    A little Spybot question in relation to this Thread - Spybot -Ewido Security Suite ... after experiencing this F/P for "Fun Web Products" in regards to Ewido updates ... I allowed the process thru the Spybot popup ... So now when I update Ewido ... the Spybot popup now shows that this is a whitelisted process ... so now I suspect that I have lost process protection for the legit " F.W.P " process ... anyway to sum it all up. Once this is corrected ... How does one change this whitelisted process back to a blacklisted process? - I've search thru Spybot but can't seem to find a way to accomplish this task.

    TIA ;)

    Steve - *puppy*
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Hey dog,

    So i do not mis-understand....where are you seeing blacklisted process and\or whitelisted process ?
     
  3. dog

    dog Guest

    Hey Bubba, ;)

    The Spybot Popup/notification from the system tray - re:whitelisted process. My thread in the Spybot Forum at NI as a pic of the original popup/notification ... (PIC, post by Pig in a Blanket, post #2)

    TIA ;)

    Steve - *puppy*
     
    Last edited by a moderator: Jun 19, 2004
  4. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Ok....what thru me was the reference to white\black listed. When I get the pop-ups I don't see anything but a pop-up....nothing relating to white\black listed.

    In any case....when a user Allows or Deny's a change AND also has the box checked....remember this decision....it adds an entry to the respective file....Allow=RegKeyWhite.sbe and Deny=RegKeyBlack.sbe located in the Application Data\Spybot - Search & Destroy\Excludes folder and these files can be viewed via notepad. What I have done in the past to clear out entries completely is to shutdown TeaTimer(which flushes it's memory)....delete the two files and then re-enable TeaTimer. If you'd rather just remove the offending entry....you should be able to open the RegKeyWhite.sbe file in notepad and edit out your Ewido entry ?

    Edit
    Ok....I see the pic your referring to @ the Net-Integration Forum. I have not experienced a process pop-up as of yet so my knowledge is limited. However....you might still find the file in the above mentioned folder....with a file name dealing with process ?
     
  5. dog

    dog Guest

    Thanks Bubba! ;)

    Much appreciated ... I'll repost if I have any problems ... I will also post a link at the NI Spybot Thread to the solution. ;)

    Thanks

    Steve - *puppy*
     
  6. dog

    dog Guest

    Hi Bubba, ;)

    The location & file name where I found it where a little different for me (XP Home).

    C/doc & settings/all users/spybot/exclude - file name Prcowhite.sbe

    I followed your second suggestion of editting out the "ewido" entry and resaved - seems to have done the trick.

    Next time ... all make sure to tick off the option "Inform me again" re: to pic a NI thread. ;)

    Thanks much Bubba! ;)

    Steve - *puppy*

    Link to the NI Thread
     
    Last edited by a moderator: Jun 19, 2004
  7. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Kewl beans and if you accidently hit the wrong button again at least you know where to look ;)
     
  8. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    Bob & Bubba thank you very much for posing & solving this problem, which of course i had also :D ;)
     
Loading...
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.