Registry Change Issues, continual pop up Spybot

[caramommy]

Hi All, if you can help, I'd sure appreciate it.

I have had spybot for quite a long time. Today when I logged in it asked me if I wanted to allow a Registry Change "BootExecute" and "Exclude from known Dll's" so I denied them. Now it is continually popping up and I don't know how to stop it, or if those registry changes were a good or bad thing.

I am computer illiterate - I run XP with AVG and SpyBot.

Can anyone help me get these to stop popping up?? What should I do, step by step?

Thanks, in advance!!

[spybotsandra]

Hello,

TeaTimer takes snapshots of Registry entries and compares these with the Registry at startup. Until these snapshots are updated you are likely to get pop-ups (at startup) of changes you made in the past. In other words, TeaTimer attempts to return the Registry to the state it was in when the snapshot was taken. This happens primarily when you reboot the system. To refresh TeaTimer's snapshot files:

* Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
o TeaTimer closes.
o TeaTimer's snapshot files are refreshed at this time.
* Restart TeaTimer:
o Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
o Double click TeaTimer.exe to start it.

If you periodically recycle TeaTimer the problem will be diminished but not necessarily totally eliminated. As an alternative you can periodically just shut down TeaTimer as outlined above without restarting it just prior to shutting down the system to refresh the snapshot files.

Best regards
Sandra
Team Spybot

[caramommy]

Where can I find the system tray icon? I pressed "Control, ALT, Delete" and found teatimer in the list of programs running. I clicked "end program" and the popups stopped, but I don't think that is what you meant?

What is the Windows Explorer and where do I find it (to navigate to the Teatimer there?)

[spybotsandra]

Hello,

The system tray is on the lower right beneath your clock.
There should be a "resident" icon from Spybot.

The Windows Explorer *g* is an application that is part of modern versions of the Microsoft Windows operating system that provides a graphical user interface for accessing the file systems.

It could be accessed by double-clicking the new My Computer desktop icon, or launched from the new Start Menu (which succeeded the earlier Program Manager). There is also a shortcut key combination - Windows key + E. Successive versions of Windows (and in some cases, Internet Explorer) introduced new features and capabilities, removed other features, and generally progressed from being a simple file system navigation tool into a task-based file management system.

Best regards
Sandra
Team Spybot

[Veervittal]

Tea timer has started detecting something that I can't figure out. It has started alerting me to some changes that are occurring every time that I restart my PC, and I am unsure just what to do about them.

I can't just deny what ever it is because Tea Timer just keeps repeating its self until I accept the changes.

Here is a copy of the log so that you can see what it is that keeps wanting to change.

9/2/2006 4:01:14 AM Allowed value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:01:19 AM Allowed value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:01:21 AM Allowed value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:01:22 AM Allowed value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:01:24 AM Allowed value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:24:59 AM Denied value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:25:00 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:01 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:02 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:02 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:10 AM Denied value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:25:11 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:11 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:12 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:12 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:21 AM Denied value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:25:22 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:22 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:23 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:23 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:30 AM Denied value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:25:30 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:31 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:32 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:32 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:34 AM Denied value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:25:35 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:35 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:35 AM Denied value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:35 AM Denied value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:43 AM Allowed value "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" (new data: "") deleted in Global browser toolbar!
9/2/2006 4:25:44 AM Allowed value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:44 AM Allowed value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!
9/2/2006 4:25:45 AM Allowed value "BootExecute" (new data: "") deleted in Session manager!
9/2/2006 4:25:46 AM Allowed value "ExcludeFromKnownDlls" (new data: "") deleted in Session manager!


Is there anything evil looking in here?

When the windows loads it automatically changes the value and the TeaTimer pops up. How to solve this

[Terminator]

I have the exact same problem as Veervittal and it started after I put RC1 in.

[md usa spybot fan]

Terminator:

If the registry change dialog messages have gibberish in then like the one in the attachment (Bad TeaTimer Message.GIF), then go back to Beta2 or apply the fix for TeaTimer from this tracking issue:

• TeaTimer shows non-existing changes on each start
  http://forums.spybot.info/project.php?issueid=176

Note: there is addition information in this thread:

• [b19: Fixed] Registry Changes after closing Teatimer???
  http://forums.spybot.info/showthread.php?t=22328

[Terminator]

I've now downloaded and installed the Tea Timer fix and it has sorted all my Tea Timer woes. Nice one guys!!!