ITBarlayout Problem

[Pantera]

Yesterday i started getting a pop up everytime i opened up my internet explorer and also if i click a link on a page now it will close the current browser first then open the new one. But here is the error i keep getting.

12/31/2005 2:12:22 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:22:21 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:22:43 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:24:38 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:24:43 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:25:49 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:32:47 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:39:44 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!

Teatimer pops up everytime i open a new browser so if someone has a solution to fix this annoyance i would greatly appreciate it. Thank You, Pantera:D

[md usa spybot fan]

Are the pop-ups that you are getting dialogs that you have to answer or are they notifications that the registry change has been denied "... based on your black list."?

[Pantera]

They are just notifications that the change has been denied.

[md usa spybot fan]

Something is continually attempting to change an "ITBarLayout" entry and I believe that you answered the original pop-up dialog with "Deny change" and "Remember this decision". Now that the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" changes. Check and see if you have any entries stored for the registry entries that are being denied as follows:Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":

Allowed processes
Blocked processes
Allowed registry changes
Blocked registry changes

Note: If you don't see all four buttons, try expanding the window to the right.


You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in "Denied registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

You can answer the pop-up dialog accordingly when it is received again. Note: The change that you showed was actually deleting the entry (new data: ""), so allow the change and the loop of messages should stop.

[Pantera]

Ok thank you very much i will give that a shot and see what happens :D

[Pantera]

Ahhhh yes MD that is just what the doctor ordered lol. The problem is fixed. Many thanks to you for the help. Happy New Year to you and everyone else on the spybot team.:bigthumb:

[Raymond]

Thanks MD :beerbeerb

That fixed that, once I was able to get Teatimer to stay still long enough to click on settings.

[cnsublett]

I've read these posts and know how to stop the Resident notices; that's not my main worry.

I start getting these "Registry change denied" messages out of the clear blue ether. Regardless of what I do, when I close Internet Explorer and open it again, my toolbar is changed. It has added the "Links" toolbar (which I never display), removed my "Norton Antivirus" toolbar, and changed the position of the Standard Buttons and Address Bar.

Something is attacking my registry and changing these settings; Resident is the only warning I have that anything is going on.

If I click "Allow" I get a changed toolbar. If I click "Deny" and "Remember this decision" I get a constant display going up the right-hand side of my screen that Resident is denying the change, and my toolbar gets changed anyway. (OK, you covered how to fix the looping notices in previous posts, but I don't want to fix them, I want them not to happen in the first place!)

My question is: how do I find out what is causing this and block/remove/delete it?I can't find a pattern of when or why it happens; it doesn't seem to be related to any specific sites, etc. Help? Thanks!

[md usa spybot fan]

cnsublett:


My question is: how do I find out what is causing this and block/remove/delete it?I can't find a pattern of when or why it happens; it doesn't seem to be related to any specific sites, etc.
Since it is not apparent what is changing the registry, about the only thing that you can do is run some registry monitoring program such as Regmon by Sysinternals to try determine what is changing the registry. TeaTimer does not capture that information because it detects changes after the fact.

Sysinternals:
Sysinternals Freeware
http://www.sysinternals.com/
Regmon:
Regmon v7.03
http://www.sysinternals.com/Utilities/Regmon.html
Note: If you use Regmon as soon as the program starts it will immediately start collecting registry entries, so I suggest that you review the following before using Regmon:
Start Regmon.exe
Immediately hit Ctrl+E or the click Blue Magnifying Glass symbol (second button from the left) to stop the data collection.
In the pull down Edit menu select Clear Display (Ctrl+X).
In the pull down Options menu select Filter/Highlight (Ctrl+L).
Make the following changes in the Regmon Filter window (see Note #1 below):
In the Include box type "ITBarLayout" (no quotes).
In the Exclude box type "TeaTimer" (no quotes).
Uncheck everything at the bottom of the Regmon Filter except "Log Writes".
Click OK.
Hit Ctrl+E or the click Blue Magnifying Glass (second button from the left) to start the data collection.
If you get a TeaTimer pop-up dialog which indicates that a change has take place, check Regmon and see if you trapped what is changing the ITBarLayout registry entry.

Note #1: The options used in the Regmon Filter window may have to be modified somewhat. I believe that options that I outlined will work, but because I don't have the problem I am not 100% sure.

[cnsublett]

Thank you for the information; I've downloaded Regmon and am running it every time I'm on the internet.

I waited this long in hopes that I could report, "It worked!" and what the problem was; however, I haven't experienced the problem again. (Figures.)

There have been a couple of Microsoft updates of late; maybe that took care of it. I was having the problem at least every other day, so something changed!

I really do appreciate the help—it's nice to know there's a place to come and ask questions.

Thanks so much, and have good days.
cns

[md usa spybot fan]

cnsublett:

That was the first time I ever suggested that someone use Regmon, so I'm glad you're trying it. I also hope that you are able to capture a registry change and back track it to the source.

Good luck,
md usa spybot fan

[PBSlayer2]

vv From a downloadsite for ITBarLayout.reg (http://www.iecustomizer.com/index.asp?URL=ITBarLayoutDownload.htm)vv
ITBarLayout.reg is a registry script that applies a non-standard layout to the Internet and Shell Explorer's Toolbar, removing all third-party toolbars and displaying the Buttons Toolbar at the top of the bar with text captions.

vv From Microsoft Support (http://support.microsoft.com/default.aspx?scid=kb;en-us;555130) vv
RESOLUTION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this problem, edit the registry to remove the corrupt value(s).

Close all open Internet Explorer and Windows Explorer windows. Start the Registry Editor (Click Start, Run and enter REGEDIT.EXE).

Go to the following Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar

For Windows Explorer: In the right pane, locate the Explorer sub-key and open it. In the right pane, locate the ITBarLayout value. Right click this value and select Delete.

For Internet Explorer: In the right pane, locate the WebBrowser sub-key and open it. In the right pane, locate the ITBarLayout value. Right click this value and select Delete.

Quit Registry Editor.

Open the affected program (Windows Explorer or Internet Explorer) and verify that you're Menu bar/Toolbar has been restored. If not, close all open Windows Explorer and Internet Explorer Windows and repeat the above step. Then locate the ShellBrowser sub-key, open it and delete the ITBarLayout value there.

Notes: Any Toolbar layout customizations will be undone, and the affected Toolbar will be reset to its default configuration. For Windows Explorer, in Windows XP Home Edition, it may be necessary to re-enable the Address bar in Windows Explorer. To do this open Windows Explorer. Then right click a blank area of the Toolbar or Menu bar and select the Address bar item.

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base: 256986 Description of the Microsoft Windows Registry

[adamsdaddy]

From the whole thread, I still don't know if itbarlayout is bad , or are you all saying I should let the system install it? If it is bad, I still have not seen the definitive answer on how to get rid of the annoytance once and for all. Help IS GREATLY appreciated.......:cool:


vv From a downloadsite for ITBarLayout.reg (http://www.iecustomizer.com/index.asp?URL=ITBarLayoutDownload.htm)vv
ITBarLayout.reg is a registry script that applies a non-standard layout to the Internet and Shell Explorer's Toolbar, removing all third-party toolbars and displaying the Buttons Toolbar at the top of the bar with text captions.

vv From Microsoft Support (http://support.microsoft.com/default.aspx?scid=kb;en-us;555130) vv
RESOLUTION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this problem, edit the registry to remove the corrupt value(s).

Close all open Internet Explorer and Windows Explorer windows. Start the Registry Editor (Click Start, Run and enter REGEDIT.EXE).

Go to the following Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar

For Windows Explorer: In the right pane, locate the Explorer sub-key and open it. In the right pane, locate the ITBarLayout value. Right click this value and select Delete.

For Internet Explorer: In the right pane, locate the WebBrowser sub-key and open it. In the right pane, locate the ITBarLayout value. Right click this value and select Delete.

Quit Registry Editor.

Open the affected program (Windows Explorer or Internet Explorer) and verify that you're Menu bar/Toolbar has been restored. If not, close all open Windows Explorer and Internet Explorer Windows and repeat the above step. Then locate the ShellBrowser sub-key, open it and delete the ITBarLayout value there.

Notes: Any Toolbar layout customizations will be undone, and the affected Toolbar will be reset to its default configuration. For Windows Explorer, in Windows XP Home Edition, it may be necessary to re-enable the Address bar in Windows Explorer. To do this open Windows Explorer. Then right click a blank area of the Toolbar or Menu bar and select the Address bar item.

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base: 256986 Description of the Microsoft Windows Registry

[alex_zvezdev]

:bigthumb:
Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":

* Allowed processes
* Blocked processes
* Allowed registry changes
* Blocked registry changes

that solved the persisten pop ups for me, the "I got a popup warning from Spybot S&D Resident of ItBarLayout" thing, I will try and run the Regmon tool to try figure out what modifies my registry - just curious thou... :oops:
No mather what, I beleive it is a bad thing to modify IE bars without asking me! :mad:

[alex_zvezdev]

That is what Regmon found:
12.02895069 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\System SUCCESS ""
12.05132580 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\System SUCCESS ""
12.05136395 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.08259010 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.08262444 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.11382580 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.11386013 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.14511395 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.14514828 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
12.17632389 TeaTimer.exe:2880 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName SUCCESS "user"
1688.39685059 explorer.exe:2848 QueryValue HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout NOT FOUND
1701.83984375 explorer.exe:2848 SetValue HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout SUCCESS 11 00 00 00 4C 00 00 00 ...

[dvanmers]

http://www.dougknox.com/xp/tips/toolbar_restore.htm