Unblocking startup programs

[Justin Barrass]

I've accidentlally blocked the wrong Hewlett Packard
startup program and want to unblock it, but Microsoft
AntiSpyware won't let me. It shows it clearly as blocked,
but there's no way to unblock it. It says "navigate to
Security Agents -> Application Agents -> View blocked
events". This does not exist. There is one other "View
blocked events" thing in some menu, but that shows
nothing as being blocked. Any ideas?

 

[Andre Da Costa]

Make sure you are unblocking under a Administrator account. Microsoft
AntiSpyware beta 1 does not support limited user accounts.
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Bill Sanderson]

I'm trying to get a clear picture of what you are seeing, because I've seen
posts that parallel your experience a number of times, and don't understand
the issue.

When you say "It shows it clearly as blocked," What is "It" and how does it
show the blocking clearly?

If you need to--feel free to post a screen shot, or, ideally, a URL where we
can see a screen shot.

 

[AndyManchesta]

"navigate to Security Agents -> Application Agents ->
View blocked events". This does not exist. There is one
other "View blocked events" thing in some menu, but that
shows nothing as being blocked. Any ideas?"


This does exist so its worth making sure you are viewing
the correct blocked screen.

Open MSAS > Click Real-Time Protection (Top-Right) >
Click Application Agents > In the status box on the left
you will see at the bottom " View Blocked Application
Agents" click this and remove the Hewlett Packard startup
entry

The alternative is from the Application Agents screen the
third checkpoint is "Startup Files" left click this and
in the bottom right corner press " Manage allowed/blocked"

If you still have problems try post a screenshot as Bill
suggest's or Andre's advise about running from the Admin
account.


Andy

 

[Jana]

I'm having the same problem! I forgot to disable MS
Spyware and then stupidly clicked Block on the Alerts.
Now I cannot install a software program because I keep
getting this message: Error 1606 Could not access
network location %userprofile%\Favorites.

When I go go Agent Events, on the left I see the date and
time that it says I chose not to allow a change. On the
left in the Events Details, it says this:

User Shell Folders alert

Occurred on: 9/29/2005 at 11:31:22 PM

The user Owner, has decided to prevent a change to the
user's defined shell folders from Favorites to %
USERPROFILE%\Favorites.

About User Shell Folders: Shell folders are special
folders that Windows uses to indicate the default
location for many types of settings and data. These
special folders are usually the more commonly used system
folders such as My Documents, My Pictures, your Program
Files folders and a number of other standard Windows
folders.

As the first poster stated, when I go to Blocked Events,
it says that I have no blocked events!

HELP!! I hope this is enough information on what's
occurred.

Surely there is some way to reverse something you have
blocked. Until then, I am unable to install a program
and it looks as if I'm going to have to do a repair
install of my operating system! This stinks!

If anyone knows what to do, your advice would be greatly
appreciated! Thx!

 

[Bill Sanderson]

Is this XP Professional, or XP Home?

If you go to \Documents and Settings\YourUser in Explorer, and right-click
on the Favorites folder, and choose Properties, then the Security tab, what
do you see?

--

 

[Guest]

It's XP Home. When I click the Properties on my User, it doesn't give me a
Security tab. I have General, Sharing, and Customize tabs. I also have lost
all of my Favorites in IE, but I see all my folders under Favorites in
Explorer.

Under Sharing, it gives me a View Your Firewall Settings option - which is ON.

I have really messed up. I'm not usually this computer stupid. I must have
had a brain cloud!

 

[Bill Sanderson]

You're doing just fine. In XP home, the details of security settings are
kept buried.

You'll need to restart in safe mode by pressing the F8 function key before
the first Windows screen appears. Then log in as "administrator" The
password is probably blank unless you've explicitly set one for the
administrator user.

Once you are logged in as administrator in safe mode, you should be able to
see the Security tab.

On my XP Pro system, Administrators, Bill Sanderson, and SYSTEM each have
everything in the left column Allow(ed) except the final "special
permissions".

I'm wondering whether you'll see something different, given the error
message?

--

 

[Guest]

I think that what might have caused the problem with your Favorites is you
logged into another account other than the administrator account that
installed MSAS and chose "Block" to changing the Favorites folder. When you
did this, MSAS then linked the Favorite account on your account to the one
for the adminstrator account that installed the app. You might have to log
into the administrator account tha installed MSAS, launch MSAS, and go to
Tools > Real-time Protection > View All Blocked Events and delete the block
for the Favorites folder. If this doesn't work, try doing the same when
logged into the account that is having this problem.

Alan

 

[Guest]

I did get the Security Tab in Safe Mode. It is just like yours - everything
checked except special permissions in all 3 categories, Admin. Owner, System.

Thx.

 

[Bill Sanderson]

Hmm - OK--so it appears that if permissions ARE the issue, we are looking in
the wrong place, perhaps. I was hoping this would be simple......

--

 

[Bill Sanderson]

This is what I don't understand--what is the mechanism being used to block
things in this case. I've seen several instances of this, I think--folks
accidentally block something and then find it irreversable. There's no
magic involved here--this stuff should be reversable--but I'm not sure I
have a clear enough grasp of this shell folder redirection stuff to be sure
where to look.

--

 

[Guest]

I have never set up more than one user account on this computer. I am both
the owner and administrator. There has never been a switching of accounts.

I am assuming that it has to be MSAS that I clicked to block the event.
However, it may have been the Windows Firewall, but I have no idea how to get
to that. I do see it appear sometimes. That just showed up after I
installed SP2. Do you know how to get to it - and if it has an unblock
option?

However, since I see the %userprofile%/favorites listed in MSAS as an event
that has been blocked, with the date, then I am assuming that program blocked
the process. The problem is that when I do go to the Unblock Events, it
always says that I have no blocked events. Therefore, it's not listed to
unlock! Go figure. ?? This in the Real Time - System events.

I don't know. Maybe the Windows firewall/protection actually blocked it and
that is why MSAS shows I have no blocked events. But, I don't understand why
it would show up as a blocked event in the list Real Time System events. ??

You have been so kind to take so much of your time trying to help me with
this situation. I don't want to continue to use up your time. I think I
will just reinstall the XP Home and see if that will correct it. I've also
found info. at Microsoft about Error 1606 that I keep getting when I try to
install my program (of course, I don't know if that has anything to do with
my Favorites list being gone). But, it is telling me to go into regedit and
do a bunch of stuff and make sure it says this and that - none of which mine
even said in the list under regedit. I think I'm not computer wise in that
area enough to be messing around in regedit!

Oh well.... Again, thanks so much. I just don't know what else I can tell
you that would make it Simple! I think nothing!! But, I certainly agree
with you in that if you block and event, you ought to be able to unblock it!
People have got to have blocked events by mistake before!

I hope Justin has been reading these posts. Maybe something you've said
will have worked for him.

 

[Guest]

I got it!!!!! I took a deep breath and went it to regedit. Changed my
Favorites string, rebooted and Voila! My favorites were back and I got my
program installed. (Still don't understand why Favorites had anything to do
with installing my program).

So, Hallejuah! Again, thanks so much for your time!

 

[Bill Sanderson]

I don't believe the firewall is involved here at all. It does nothing to
regulate outbound traffic in XP SP2.

If you are looking at this article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;886549

this does look like useful information that may help in resolving this
error.

Have you ever removed anything from your system with Microsoft Antispyware?
If you can answer yes to that question, you might get away with calling
1-866-pcsafety, if you are in the U.S. or Canada, and getting direct help
from Microsoft Product Support Services with this issue. They cannot help
with Microsoft Antispyware itself--it is an unsupported beta program--but if
your missing favorites were caused by spyware or a virus, or removal
thereof, they might help you work through that KB article. The main thing
to know is that the Registry editor is live, with no undo, and that the
items are case sensitive--you need to follow the capitalization details
precisely.

It certainly won't hurt to look through the registry and try to verify the
items in step 3. and or step 8.
--

 

[Bill Sanderson]

Nice work!

So the KB article had what was needed to get this fixed? Excellent.

Next question is why this happened in the first place, and whether, in fact,
it had anything to do with Microsoft Antispyware or not--I'm still not
completely sure--maybe, maybe not.

--

 

[Guest]

Yes, I followed the Error 1606 fix for trying to install a Microsoft program.
I just went to Favorites instead of what they said, but did exactly what the
article said to do - deleted Favorites because it did not say what it was
supposed to say in the string. Must say that I was relieved when I saw that
it did not say what it was supposed to!

I don't know about MSAS caused this or not either. When I called the
support for the software I was trying to install, the tech assured me that
the message I was getting, I did not do. But, I know I blocked something
with the spyware that had something to do with Favorites. I did that because
I had just installed DSL and thought it was trying to change my setting to
Earthlink - which I didn't want. It did show up in the MSAS as being an
event that I had blocked - just wouldn't list it under Blocked Events so I
could unblock it!

I don't know either. But the danged thing's back to where it's supposed to
be. I know one thing I"ve learned from this - I will look more carefully
before I click Don't Allow! I will also make sure MSAS is disabled before I
put in the CD to install a program.

I wonder if the guy who started this string has had any luck? Haven't seen
a post again from him. Maybe what we've done will help??

Thanks again and have a great day!

 

[Bill Sanderson]

Well--next time I see a message about Favorites gone missing, I hope I'll be
able to grab your KB citation and suggest that they try that.

This thread started before the forum software changed over--many users never
returned to threads under the old software--they never figured out how to
see replies.
--