Finding the origin of a blocked TeaTimer denied value

[patch227]

Hello

Can you please explain to a newby what type of object would attempt to to write the following value:

3/15/2007 12:11:50 PM Denied value "{EFA24E64-B078-11D0-89E4-00C04FC9E26E}" (new data: "") added in User-specific browser toolbar!

I am having freezing problems with my pc and was wondering if this had anything to do with it

Thanks

[md usa spybot fan]

patch227:

CLSID={EFA24E64-B078-11d0-89E4-00C04FC9E26E} deals with the display of one of the standard Explorer Bars ("Folders") in Internet Explorer.

What were you doing at the time you receive the TeaTimer message?

[patch227]

I have received it a few times in the past. I am a stock trader so several programs related to trading were open , it popped up once when IE was not open so I have not been able to identify a specific cause

[patch227]

So is it then correct to say that there is no way of tracing the origin of these attempts?

[md usa spybot fan]

There is no way to tracing the origin of previous attempts to change the registry. The Windows operating system does not record what makes changes to the registry and TeaTimer does not capture that information because it detects changes after the fact and provides you with the opportunity to reverse the registry change.

Since it is not apparent what is changing the registry, about the only thing that you can do is run some registry monitoring program to try to determine what is changing the registry. One such program is Regmon:
RegMon for Windows v7.04
http://www.microsoft.com/technet/sysinternals/utilities/regmon.mspx

[Reggie Stry]

Hello

Can you please explain to a newby what type of object would attempt to to write the following value:

3/15/2007 12:11:50 PM Denied value "{EFA24E64-B078-11D0-89E4-00C04FC9E26E}" (new data: "") added in User-specific browser toolbar!

I am having freezing problems with my pc and was wondering if this had anything to do with it
Thanks


I just blocked the same alert. I've had other alerts recently which I've mentioned in several posts. (http://forums.spybot.info/showthread.php?t=12361 and http://forums.spybot.info/showthread.php?goto=newpost&t=12452).


According to these newsgroup posts:

http://groups.google.com/group/microsoft.public.windowsxp.customize/browse_thread/thread/e831e4540f14952b/378358e09e0e1944?lnk=st&q=&rnum=3&hl=en#378358e09e0e1944

http://groups.google.com/group/microsoft.public.windowsxp.customize/browse_thread/thread/b9ade507be1b81f9/f39bf952b0af1b1e?lnk=st&q=&rnum=4&hl=en#f39bf952b0af1b1e

It is just a standard explorer bar.

These sites explains the bar in more detail. It seems that the clsid has to do with the folder bar and whether it's greyed out. I don't have that problem even when blocking the string:

http://forums.techguy.org/archive-windows-nt-2000-xp/113867-explorer-folder-pane-grayed-out.html

http://www.toejumper.net/surf7/msie7.htm


Some users are finding themselves with a greyed-out left pane in Windows Explorer after installing IE 5.5. Here's the fix: save the following as a Registry file (.REG) and import it into your Registry:
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E}] @="Explorer Band"
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E} \ InProcServer32] @="C:\\WINDOWS\\SYSTEM\\SHDOCVW.DLL"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E} \ Implemented Categories]
[HKEY_CLASSES_ROOT \ CLSID \ {EFA24E64-B078-11d0-89E4-00C04FC9E26E} \ Implemented Categories \ thre{00021493-0000-0000-C000-000000000046}]
and this site describes it as follows:

http://www.myplugins.info/guids/guid.php?guid=ef


{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band
%SystemRoot%\System32\shdocvw.dll


If that's the case, why am I getting a registry change alert and should I be blocking it?