Finding the origin of a blocked TeaTimer denied value

Hello

Can you please explain to a newby what type of object would attempt to to write the following value:

3/15/2007 12:11:50 PM Denied value "{EFA24E64-B078-11D0-89E4-00C04FC9E26E}" (new data: "") added in User-specific browser toolbar!

I am having freezing problems with my pc and was wondering if this had anything to do with it

Thanks

patch227:

CLSID={EFA24E64-B078-11d0-89E4-00C04FC9E26E} deals with the display of one of the standard Explorer Bars ("Folders") in Internet Explorer.

What were you doing at the time you receive the TeaTimer message?

I have received it a few times in the past. I am a stock trader so several programs related to trading were open , it popped up once when IE was not open so I have not been able to identify a specific cause

So is it then correct to say that there is no way of tracing the origin of these attempts?

There is no way to tracing the origin of previous attempts to change the registry. The Windows operating system does not record what makes changes to the registry and TeaTimer does not capture that information because it detects changes after the fact and provides you with the opportunity to reverse the registry change.

Since it is not apparent what is changing the registry, about the only thing that you can do is run some registry monitoring program to try to determine what is changing the registry. One such program is Regmon:

• RegMon for Windows v7.04
  http://www.microsoft.com/technet/sys...es/regmon.mspx

Quote:

---

Originally Posted by patch227

Hello

Can you please explain to a newby what type of object would attempt to to write the following value:

3/15/2007 12:11:50 PM Denied value "{EFA24E64-B078-11D0-89E4-00C04FC9E26E}" (new data: "") added in User-specific browser toolbar!

I am having freezing problems with my pc and was wondering if this had anything to do with it
Thanks

---

I just blocked the same alert. I've had other alerts recently which I've mentioned in several posts. (http://forums.spybot.info/showthread.php?t=12361 and http://forums.spybot.info/showthread...wpost&t=12452).


According to these newsgroup posts:

http://groups.google.com/group/micro...8358e09e0e1944

http://groups.google.com/group/micro...9bf952b0af1b1e

It is just a standard explorer bar.

These sites explains the bar in more detail. It seems that the clsid has to do with the folder bar and whether it's greyed out. I don't have that problem even when blocking the string:

http://forums.techguy.org/archive-wi...rayed-out.html

http://www.toejumper.net/surf7/msie7.htm

Quote:

---

Some users are finding themselves with a greyed-out left pane in Windows Explorer after installing IE 5.5. Here's the fix: save the following as a Registry file (.REG) and import it into your Registry:
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E}] @="Explorer Band"
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E} \ InProcServer32] @="C:\\WINDOWS\\SYSTEM\\SHDOCVW.DLL"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E} \ Implemented Categories]
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E} \ Implemented Categories \ thre{00021493-0000-0000-C000-000000000046}]

---

and this site describes it as follows:

http://www.myplugins.info/guids/guid.php?guid=ef

Quote:

---

{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band
%SystemRoot%\System32\shdocvw.dll

---

If that's the case, why am I getting a registry change alert and should I be blocking it?