I recently upgraded from the free Ad-Aware and now every morning when I boot my computer I get some Ad-watch "Alarms."

Take this one for example: I run a background program called Dimiension 4 that supposedly keeps my computer clock set to observatory time. One of the Ad-Watch alarms warns me of "an attempt" by Dimension 4 "to alter a protected object." I haven't a clue what that means.

So each morning, not knowing what else to do, I click the "Accept" button.

I'm sure there must be instructions somewhere that would explain to me how I can avoid this annoying morning ritual.

I'd be grateful to someone who could point me toward these instructions, and especially grateful if the instructions would turn out to be written in some language other than impenetrable "computerese."

;-)

Will in Seattle
a.k.a. "Clueless"

@Clueless in Seattle

Hi Will,

Your Ad-Watch is set (correctly) to Active (Automatic silently blocks all changes, even desired ones) - your "Dimension 4" program must be re-setting a system value (ie: your system's clock) and Ad-Watch is alerting you to the attempted change, just as it would if some malware was trying to hijack your system.

Ad-Watch is not able to tell the difference between a "good" change and a "bad" one - it simply alerts you to all changes, leaving you with the choice of Accept/Block.

That said, open Ad-Aware, click on the Help button (left hand side) - there is information on all manner of Ad-Watch configuration options. One of them is to create a "Custom Rule" that would allow Ad-Watch to accept certain changes automatically. Sorry, you will have to find someone with more "computerese" skills than me, to get advice on how to write the rule (I am clueless in that area )

Anyhow, there is a way to get Ad-Watch to Accept the regular alerts - hopefully someone well-skilled in Rules will happen along and advise you. In the meantime, check out all the settings available and choose the ones that suit you best.

Regards,

Spike

Thanks Spike!

I looked in the Ad-Aware Help as you suggested and found the Rule Editor instructions in the Contents tree:

What is Ad-Watch
Tools & Preferences
Rule Editor

But I can't figure out how to actually find that Rule Editor itself via the Ad-Aware menu system.

It's supposed to be on a menu called "Tools & Preferences."

But when I look at the main Ad-Aware Screen all I see are five labled buttons along the left eged:

Status
Scan Now
Ad-Watch
Add-ons
Help

[How do you indent a line in this message system?]

And five buttons with pictures on them along the top edge toward the right side.

I've tried clicking each of those ten buttons, but none of them yields a menu called "Tools & Preferences"

Do you know how to find that menu?

@Clueless in Seattle

Hi Will,

Click on the Ad-Watch icon in your system tray - should pop-up like this:

Click to view attachment

Click on the "Tools" button and there they are:

Click to view attachment

Check through the various Options first, before moving on to the Rule Editor, Filter etc

Regards,

Spike

Thanks again, Spike!

You should be writing the Ad-Aware documentation!

It's easy to find once you know where it is, isn't it?

Now all I have to do is figure out the syntax for writing a rule. But I think that's a topic for a new thread, don't you? So I'll just sign off by saying thanks again (again).

Hi, Clueless in Seattle. This is the way I've found it easiest to create a Rule with Ad-Watch:

1. Check that Event-History is turned on
   • Launch Ad-Watch
   • Select Options
   • Under "Event-History", select (green check) "Create Event-History"
2. You cannot proceed further until after Ad-Watch has blocked the Spy-Sweeper scheduled scan then open the Event History.
   • Select "Options"
   • Select "View Event History". Ad-Watch will launch the Event-History in Notepad.
3. Look at the entry for the Key; i.e., something like "Key:Software\Microsoft\Windows\CurrentVersion\Run".
4. Create a new Rule (Rules cannot be edited)
5. Copy/paste the Key from Notepad.
6. Look at the entry in Notepad for the Value and also add what is shown.
7. Select Exact Match.

Hi Corrine,

I hope you're still following this thread. I got sidetracked by the Holidays, but now have finally gotten back to trying to write a rule for Ad-Watch.

I'm stuck at the point where you said: "Copy/paste the Key from Notepad"

Here's what I see in Notepad:

1/3/2007 10:11:26 AM> Registry modification detected
1/3/2007 10:11:26 AM>
1/3/2007 10:11:26 AM> Root:HKEY_LOCAL_MACHINE
1/3/2007 10:11:26 AM> Key:Software\Microsoft\Windows\CurrentVersion\Run
1/3/2007 10:11:26 AM> Value:Dimension4
1/3/2007 10:11:26 AM> Data:C:\Program Files\Dimension 4\D4.exe
1/3/2007 10:11:26 AM> New Data:"C:\Program Files\Dimension 4\D4.exe"
1/3/2007 10:11:26 AM>

And I'm not sure exactly how much of that I need to copy. Could you copy and paste the text I need into your reply?

I need help creating a rule for Ad-Watch.

Back before the holidays, in another thread, I received instructions from Corrine in which she instructed me to open the Event-History in Notepad and then ""Copy/paste the Key from Notepad."

I got as far as looking at the Event-History file, but got stuck because I'm not certain how much of it to copy. Here's what it looks like:

1/3/2007 10:11:26 AM> Registry modification detected
1/3/2007 10:11:26 AM>
1/3/2007 10:11:26 AM> Root:HKEY_LOCAL_MACHINE
1/3/2007 10:11:26 AM> Key:Software\Microsoft\Windows\CurrentVersion\Run
1/3/2007 10:11:26 AM> Value:Dimension4
1/3/2007 10:11:26 AM> Data:C:\Program Files\Dimension 4\D4.exe
1/3/2007 10:11:26 AM> New Data:"C:\Program Files\Dimension 4\D4.exe"
1/3/2007 10:11:26 AM>

I'm not sure exactly how much of that I need to copy. I'd be grateful if someone readng this could copy and paste the text I need for my rule into a reply to this post.


{ADVISOR EDIT: Will, have merged your two Topics, Spike}

@Clueless in Seattle

Hi Will,

Using Corrine's instructions and your Event History, this is my understanding of how you would create the Custom Rule that you wish for (remember, I haven't done this before )

Open Ad-Watch, click on Tools and select "Rule Editor":

Click to view attachment

Make sure "Use custom ruleset" is selected (green tick). Click on "New Rule" and this appears:

Click to view attachment

As Corrine says (to paraphrase):

Looking at your Event History, the Key is: "Key:Software\Microsoft\Windows\CurrentVersion\Run"
and the Value is: "Value:Dimension4"
so I have added these into "Add New Rule", with a suggested Title of "Dimension4":

Click to view attachment

Ensure that both Conditions are selected (green ticks) as well as "Exact Match". Click on "Add Rule" and this appears (have stretched the Ad-Watch GUI to show entire Rule):

Click to view attachment

Then click on "Events" to take you back to the usual Ad-Watch view.

Post back and let me know if I got it right

Regards,

Spike

Hi Spike!

I tried to follow your instructions, but this mornig when I booted up, that annoying "Ad-Watch Alarm" popped up on my Windows 2000 desktop again.

Click to view attachment

So I looked at the rule editor, and here's what my Dimension 4 rule looks like:

Click to view attachment

So what did I miss?

@Clueless in Seattle

Hi Will,

Just a thought - delete the existing Custom Rule (they can't be edited).

Create a new one, this time without the "key:" and "value:" in front.

ie: just Software\Microsoft\Windows\CurrentVersion\Run and Dimension4

See if that works

Regards,

Spike

Thanks Spike!

That did the trick!

Will in Seattle
a.k.a. "Clueless"

Glad to hear that (should have thought not to add in the words "key" and "value" )

Actually it is Corrine who deserves the credit, for giving the correct syntax instructions.

Regards,

Spike

Right you are. Corrine, if you're reading this: Many thanks for the help!

Now, I've got one minor problem remaining, and that's that I still get an Ad-Watch report window that pops up every time I boot my machine, so I have to manually close it.

There must be a setting somewhere that disables that window from popping up, right?

But where?

Hi Will,

I would presume that in Ad-Watch, you have Tools > Options > Activity, your settings are like this (so that Ad-Watch pops-up an alert when a change is identified):

Click to view attachment

To suppress the Start-Up Event Window, click on the Configuration Cog, select Tweak > Ad-Watch and make sure that "Load Ad-Watch minimised is selected (green):

Click to view attachment

Regards,

Spike