Constant "ITBarLayout" alerts with Teatimer 1.5.0.0

[Reggie Stry]

Every time I close Teatimer, I see an "ITBarLayout" alert, which I've blocked.
Now it seems when I look at the log I see:

3/22/2007 1:40:32 PM Denied (based on user decision) value "ITBarLayout" (new data

: (followed by a load of hexadecimal data)

and then:

added in User-specific browser toolbar!

I also see from time to time:

3/20/2007 6:14:23 PM Allowed (based on user decision) value "{0E5CBF21-D15F-11D0-8301-00AA005B4383}" (new data: "hex:21,BF,5C,0E,5F,D1,D0,11,83,01,00,AA,00,5B,43,83,22 and so on, followed by:
added in User-specific browser toolbar!

Other times it says:

/20/2007 6:11:24 PM Denied (based on user decision) value "{0E5CBF21-D15F-11D0-8301-00AA005B4383}" and followed by data with:

added in User-specific browser toolbar!

When I look at the Black and White List, both of the above are listed on the "blocked registry changes" tab. I've even tried deleting them, but the popup alerts appear again and I deny the registry change.

I've searched the net and found quite a few posts here that refer to this problem with Teatimer. I've used Hijackthis (after closing Teatimer as recommended) and don't see anything other than all the processes I'm aware of and personally loaded (all safe).
I check my running processes frequently, and use TCPview to watch internet activity.

Another site recommends deleting ITBarLayout from:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Explorer

and:


HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser


Any solution?

[md usa spybot fan]

Reggie Stry:

From the title of your thread:


Constant "ITBarLayout" alerts with Teatimer 1.5.0.0
You could be running a version of beta TeaTimer from as early as November 24, 2006 1:30:00 PM (actually October 24, 2006 5:46:46 AM, but that was not released to the public).

Teatimer 1.5.0.0 is neither the current production version of TeaTimer nor the most resent beta version of TeaTimer as I tried to indicate in my responses to your previous two queries (here (http://forums.spybot.info/showthread.php?p=75929#post75929) and here (http://forums.spybot.info/showthread.php?p=75933#post75933)).

TeaTimer.exe (Version 1.4.0.2, dated May 31, 2005 2:04:00 AM) is latest production version of TeaTimer.exe and TeaTimer.exe (Version 1.5.0.6, dated February 07, 2007 3:39:06 PM) is the most resent beta version. Teatimer 1.5.0.0 is neither the current production version of TeaTimer nor the most resent beta version of TeaTimer. In fact you pointed out in this post (http://forums.spybot.info/showpost.php?p=75927&postcount=1) that there are several versions of the beta TeaTimer.


I've found version 1.5.0.3 and 1.5.0.5, but not 1.5.0.4.
If you are going to participate in the TeaTime beta program, please use the most resent beta version or else your findings may have already been reported and corrected in more resent renditions of the beta release.

-------------------------------------------------------------------------

ps: Since you are running a beta version of TeaTimer, please post you findings, concerns, etc. in the Spybot-S&D Beta (http://forums.spybot.info/forumdisplay.php?f=12) forum rather than the regular Spybot-S&D (http://forums.spybot.info/forumdisplay.php?f=4) forum so that Spybot users who are not participating the TeaTimer beta program don't accidentally mistake your finings and any responses you get as things that they should concern about.

[Reggie Stry]

Thanks for responding. If the alerts continue, I'll post to the Beta forum as you suggest, since I've just updated to version 1.5.0.6.

As I've stated in another thread, it's not easy to find these beta updates.
I changed my Spybot settings in order to download the beta updates, but I've
noticed that the update for Teatimer only reflected it was a 1.5 beta version and not the full 1.5.0.6 version number. I have noticed that a right click on the icon will now tell you the version number, so that's a nice improvement over beta version 1.5.0.0.


Wouldn't it be easier to have a one post moderator only sticky here that just lists the latest beta updates, rather than mention it in a thread that has over 100 replies?

http://forums.spybot.info/forumdisplay.php?f=12

Another possibility would be to have a beta area on the download page, that shows version changes.



I checked Castle Cops BHO list for string mentioned above:

{0E5CBF21-D15F-11D0-8301-00AA005B4383}

They say it's a legit IE Toolbar.

Should I remove the 2 blocked registry changes from the Black and White List (as mentioned in first post)?

[md usa spybot fan]

Should I remove the 2 blocked registry changes from the Black and White List (as mentioned in first post)?
Certainly.