Help

[njdriver]

Hi all.

I received one of those standard pop up boxes from SpyBot notifying me of a registry change and asking permission whether to allow it. Since I knew what the change was I clicked the "Allow" button. Immediately after that I received numerous pop up boxes stating that I had denied the change.

Each box would popup starting in the bottom right hand corner of my screen. Another box would then appear above it and so on until there were 5 or 6 boxes showing. The topmost box would disappear and then reappear and this would continue. I then used the CTRL ALT DEL function to end the program.

It didn't seem to have any other adverse effect on my system.

Has this happened to anyone else, and is there a fix for it, or is this indicative of SpyBot not getting along with another installed program on my drive?

Thanks in advance.

[spybotsandra]

Hello,

That are notifications from the resident TeaTimer that inform you about an allowed or denied registry change.

TeaTimer takes snapshots of Registry entries and compares these with the Registry at startup. Until these snapshots are updated you are likely to get pop-ups (at startup) of changes you made in the past. In other words, TeaTimer attempts to return the Registry to the state it was in when the snapshot was taken. This happens primarily when you reboot the system. To refresh TeaTimer's snapshot files:

* Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
o TeaTimer closes.
o TeaTimer's snapshot files are refreshed at this time.
* Restart TeaTimer:
o Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
o Double click TeaTimer.exe to start it.

If you periodically recycle TeaTimer the problem will be diminished but not necessarily totally eliminated. As an alternative you can periodically just shut down TeaTimer as outlined above without restarting it just prior to shutting down the system to refresh the snapshot files.

By the way....you have posted in the Tavern:
"A place to chat or ask general questions, no politics or religion please. Questions related to Spybot-S&D support/tools, or requests for Malware removal, should be posted in the appropriate forum. Not in the tavern. "

Best regards
Sandra
Team Spybot

[njdriver]

Thanks Sandra.

There is nothing called TeaTimer for me to click on when I follow the path you gave in your initial reply.

[spybotsandra]

Hello,

Did you click in the right place?
The system tray is on the lower right, beneath your clock.

Best regards
Sandra
Team Spybot

[md usa spybot fan]

njdriver:

TeaTimer's icon is actually titled "Spybot-SD Resident" and should be present in the taskbar notification area (system tray). It looks like a document or window with a padlock in the lower left hand corner.

[njdriver]

There is nothing like that in my system tray. I did a search on drive C: for Tea Timer, and there were no results.

[md usa spybot fan]

njdriver:

What version of Spybot are you running (Spybot » Help » About)?

The procedure that spybotsandra outlined to refresh TeaTimer's snapshot files was only required with Spybot 1.3 and Spybot 1.4 because in those versions of TeaTimer the snapshot files got out of sync. with the registry.

If you can not find TeaTimer.exe it may be because in Spybot 1.5.2 some of Spybot's executables are hidden as protected operating system files. To see them:

• Using Windows Explorer navigate to:
  
  • C:\Program Files\Spybot - Search & Destroy
• In the Tools menu select Folder Options…
• In the Folder Options dialog select the View tab.
  
  1. Under the "Hidden files and folders" options:
     
     • Make sure "Show hidden files and folders" is selected.
     • Not "Do not show hidden files and folders".
  2. Uncheck the following option:
     
     • Hide protected operating system file (Recommended)
• Click the Apply button.
• Click the OK button.
• The files should now be displayed

Note: If you uncheck the "Hide protected operating system file (Recommended)" option to view Spybot's executables, I suggest that you return the option to its original setting when you are done.

[md usa spybot fan]

njdriver:

Back to your original problem.

Please post the portion of the Resident.log that shows the changes around the time frame when you encountered the problem so that we can see what occurred.

1. There are several ways (4 listed below) to access the TeaTimer's Resident.log file:
   
   1. Right click on the TeaTimer (Spybot-SD Resident) system tray icon and select Show Log.
   2. Go into Spybot > Mode > Advanced Mode > Tools > Resident.
   3. Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Select the Resident.log file and open it.
   4. Using Windows Explorer, navigate to the Resident.log file located in one of the following directories:
      
      • Windows 95 or 98:
        C:\Windows\Application Data\Spybot - Search & Destroy\Logs
      • Windows ME:
        C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
      • Windows NT, 2000 or XP:
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
      • Windows Vista:
        C:\ProgramData\Spybot - Search & Destroy\Logs
      
      Double click on Resident.log file and it should open with Notepad.
2. To copy information from the log into a post in the forum:
   
   1. Copy the information into the Clipboard:
      
      • Highlight the portion of the log that you want to copy.
      • Right click and select Copy.
   2. Paste (Ctrl+V) the information from the Clipboard to a new post in this thread.

[njdriver]

Well, good news, bad news.

I followed the instructions to unhide the files and I did see TeaTimer.exe.

I double-clicked it so that I could further follow the directions you gave, and the problem started again. As you can see from the attached copy of the SpyBot resident logfile, the problem was initially associated wwhen I was running MicroSoft Money. The only other anomaly was that I clicked on the "allow" button, not the "deny" button, although the popup boxes show "Registry change denied" "Identified as: user decision"

Here's the log:
Seems like it is caught in an endless loop.

5/1/2008 4:25:19 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:20 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:21 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:22 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:23 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:24 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:25 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:26 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:27 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:28 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:29 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:30 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:31 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:32 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:33 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:34 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:35 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:36 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:37 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:38 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:39 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:40 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:41 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!
5/1/2008 4:25:42 PM Denied (based on user blacklist) value "MoneyAgent" (new data: ""C:\Program Files\Microsoft Money\System\mnyexpr.exe"") added in System Startup user entry!

[elderlysitter]

Hi all. Hi, yes I get them all the time, and I do exactly what you do. And they go away, but I never think anything about them. But mine would always go away. I didn't have to use CTRL ALT DEL. But I haven't thought anything about it, but maybe i should. I do hope to find out something about this.

I received one of those standard pop up boxes from SpyBot notifying me of a registry change and asking permission whether to allow it. Since I knew what the change was I clicked the "Allow" button. Immediately after that I received numerous pop up boxes stating that I had denied the change.

Each box would popup starting in the bottom right hand corner of my screen. Another box would then appear above it and so on until there were 5 or 6 boxes showing. The topmost box would disappear and then reappear and this would continue. I then used the CTRL ALT DEL function to end the program.

It didn't seem to have any other adverse effect on my system.

Has this happened to anyone else, and is there a fix for it, or is this indicative of SpyBot not getting along with another installed program on my drive?

Thanks in advance.

Hi, yes I get them all the time, and I do exactly what you do. And they go away, but I never think anything about them. But mine would always go away. I didn't have to use CTRL ALT DEL. But I haven't thought anything about it, but maybe i should. I do hope to find out something about this.