Registry Change Denied--again and again

[katiesdad]

Hello...

Something tried to infect my computer with malware/spyware that tries to insert something into my registry (an IE toolbar thing apparently).

Fortunately Spybot caught it and I denied the registry change.
My problem is that "something" keeps trying and trying (and trying)
indefinitely to add the change, so I get the Spybot "Registry change
denied" popups continually.

Anybody know where pending registry changes go and how to permanently
delete them so I don't get this endless loop?

Thanks!

[md usa spybot fan]

Please go into Spybot > Mode > Advanced Mode > Tools > Resident and copy a portion of the log that shows the denied registry changes and paste it to a post.

[katiesdad]

Here's a couple lines that show the affected entry. There are zillions of these
just like these ones. Does this help? This value is also the one that keeps
popping up on the dialog boxes.

Any ideas how to stop this frustrating endless loop woudl be appreciated.


11/15/2005 7:35:11 PM Denied value "{8E718888-423F-11D2-876E-00A0C9082467}" (new data: "") deleted in Global browser toolbar!
11/15/2005 7:35:12 PM Denied value "{8E718888-423F-11D2-876E-00A0C9082467}" (new data: "") deleted in Global browser toolbar!

[md usa spybot fan]

It is not spyware/malware. CLSID={8E718888-423F-11D2-876E-00A0C9082467} is the Internet Explorer 5.0 / 5.5 Radio_Bar. See:
Tune in to a wider world of radio
http://www.microsoft.com/windows98/u...3Mar/radio.asp

[stormlightning]

I have this same problem, and I blocked it. Now how to not-block it?

[md usa spybot fan]

stormlightning:

You can edit the entries that TeaTimer uses to automatically "Allow" or "Deny" changes that were based on the use of "Remember this decision" as follows:

• Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
  • Allowed processes
  • Blocked processes
  • Allowed registry changes
  • Blocked registry changes
    
    Note: If you don't see all four buttons, try expanding the window to the right.
  
  
  
• You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in "Allowed registry changes" and "Blocked registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

[benhulkower]

I'm having the same problem as Katiesdad, but it's two requested registry changes. The log looks like this: Denied value "wifvl" (new data: "") deleted in System Startup user entry!
4/2/2006 8:07:54 PM Denied value "alxukg" (new data: "") deleted in System Startup global entry!
Can anyone help? Thanks

[vladilych]

I have a similar problem.
The log looks like this -
9/04/2006 1:32:31 PM Denied value "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" (new data: "") deleted in Global browser toolbar!
Which is basically the same as what is appearing in the flashing box which won't go away.
What should I do?
By the way, I can't find the TeaTimer system tray icon. Can someone tell me where it is?
thanks

[Zenobia]

Teatimer should be down by your clock in the Notification Area(system tray.)
If you have XP,maybe it's hidden.If so,try clicking the chevron to be able to see it.

Does the flashing box say something like resident denied the change of
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} based on your black list?

[vladilych]

Thanks Zenobia,
That's exactly what the flashing box says.
I have XP Home. I'll set off in search of Tea Timer and let you know if I have any problems.