Problems with Resident TeaTimer

[G-Veronica B.O.W]

I have a problem with the resident teatimer and I was wondering if anyone could help.

Last night I was surfing the net and I got a message from the resident teatimer that something was trying to change the settings on my browser. I clicked deny change.

2 seconds later the same message came up and no matter how much I clicked deny change the message would come back up so i checked the little box that would make it so it would give the same response each time which would be to deny it.

The next day I turned on my PC, logged in and all these little tea timer messages came up in the right hand corner of the screen saying that it was denying a process, it kept doing this until the right edge of the screen had filled up, I had to open up the control panel and exit Spy Bot for it to stop. It does this everytime I start up my PC.

I ran Spy Bot and It found 9 traces of Win32.Agent.PZ. I clicked th fix problem button and it could only fix one saying that I would have to restart my PC to get rid of the other ones.

I did and ran spybot again only to get the same teatimer messages and when I ran spybot I got 8 results for Win32.Agent.PZ.

Could someone please help me on my issue? I would like someone to tell me how to stop these little messages from coming up everytime I turn my windows XP on.

I think it is being caused by Win32.Agent.PZ, for some reason there is no teatimer icon on the toolbar and my system clock does not work.

Thank you for any help you may give me. :cowboy:

[md usa spybot fan]

G-Veronica B.O.W:

re: The repetitive TeaTimer change.

Please post the portion of the Resident.log that shows the changes you are having problems with.
There are several ways (4 listed below) to access the TeaTimer's Resident.log file:
Right click on the TeaTimer (Spybot-SD Resident) system tray icon and select Show Log.
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Select the Resident.log file and open it.
Using Windows Explorer, navigate to the Resident.log file located in one of the following directories:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows Vista:
C:\ProgramData\Spybot - Search & Destroy\Logs
Double click on Resident.log file and it should open with Notepad.
To copy information from the log into a post in the forum:
Copy the information into the Clipboard:
Highlight the portion of the log that you want to copy.
Right click and select Copy.
Paste (Ctrl+V) the information from the Clipboard to a new post in this thread.

[pablo1000]

Partial log below

25/03/2008 23:03:03 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
25/03/2008 23:56:42 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
26/03/2008 22:25:00 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
27/03/2008 18:08:24 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
29/03/2008 00:10:59 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
29/03/2008 11:30:14 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
30/03/2008 11:03:14 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
31/03/2008 21:41:15 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
01/04/2008 18:35:25 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
01/04/2008 23:03:46 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
02/04/2008 07:28:14 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
02/04/2008 17:58:46 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
03/04/2008 19:41:49 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
04/04/2008 19:35:59 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
04/04/2008 22:20:49 Allowed (based on user decision) value "QuickTime Task" (new data: ""C:\Program Files\QuickTime\QTTask.exe" -atboottime") added in System Startup global entry!
04/04/2008 22:22:13 Allowed (based on user decision) value "iTunesHelper" (new data: ""C:\Program Files\iTunes\iTunesHelper.exe"") added in System Startup global entry!
05/04/2008 11:18:36 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
06/04/2008 14:30:53 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:18:49 Allowed (based on user decision) value "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}" (new data: "") added in Browser Helper Object!
07/04/2008 18:22:42 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:14 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:17 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:21 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:24 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:28 Denied (based on user decision) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:29 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:30 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:31 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:32 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:34 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:35 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:36 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:37 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:38 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:39 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:40 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:41 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:42 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:44 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:45 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:46 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:47 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:48 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:49 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:50 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:51 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:52 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:54 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:55 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:56 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:57 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:58 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:23:59 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:00 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:01 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:02 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:04 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:05 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:06 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:07 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:08 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:09 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:10 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:11 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:12 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:13 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:15 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:16 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:17 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:18 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:19 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:20 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:21 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:22 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:23 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:24 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:25 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:26 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:28 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:29 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:30 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:31 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:32 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!
07/04/2008 18:24:33 Denied (based on user blacklist) value "swg" (new data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe") added in System Startup user entry!

[G-Veronica B.O.W]

I can't paste it all, it's 168833 characters long.

[md usa spybot fan]

pablo1000:




I have a similar problem,
Then I suggest that you start your own thread (topic) rather than potentially confuse the communications between G-Veronica B.O.W (http://forums.spybot.info/member.php?u=38852) and those who may respond to the specific issue that they started this thread to address.

[G-Veronica B.O.W]

What should I do?

Find a place on the internet to paste it then send a link?

[md usa spybot fan]

G-Veronica B.O.W:

Please do not post the entire log!!!

Perhaps instead of saying:




Please post the portion of the Resident.log that shows the changes you are having problems with.
I should have said:

Please post a representative sample of the Resident.log that shows the changes you are having problems with.

Again, to do that:




b. To copy information from the log into a post in the forum:
Copy the information into the Clipboard:
Highlight the portion of the log that you want to copy.
Right click and select Copy.
Paste (Ctrl+V) the information from the Clipboard to a new post in this thread.

[pablo1000]

I've now resolved my problem

[G-Veronica B.O.W]

This is it.

01/01/2001 00:07:21 Allowed (based on user decision) value "Start Page" (new data: "http://www.google.com/") added in Browser page!
01/01/2001 01:58:32 Allowed (based on user decision) value "MSConfig" (new data: "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto") added in System Startup global entry!
01/01/2001 00:05:58 Allowed (based on user decision) value "MSConfig" (new data: "") deleted in System Startup global entry!
01/01/2001 00:33:16 Denied (based on user decision) value "{D8E11460-0D64-4a20-BED9-BA68BED58342}" (new data: "") added in Browser Helper Object!
01/01/2001 00:33:30 Denied (based on user decision) value "UserInit" (new data: "C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ntos.exe,") changed in Winlogon!


It repeats the following code many times

01/01/2001 00:33:30 Denied (based on user decision) value "UserInit" (new data: "C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ntos.exe,") changed in Winlogon!

[md usa spybot fan]

G-Veronica B.O.W:


... Last night I was surfing the net and I got a message from the resident teatimer that something was trying to change the settings on my browser. I clicked deny change.

2 seconds later the same message came up and no matter how much I clicked deny change the message would come back up so i checked the little box that would make it so it would give the same response each time which would be to deny it. ...
Firstly, the entries from the Resident.log that you posted seem to indicated that there is problem with the time/date in your system.

This type of problem is usually caused by the CMOS battery on your motherboard being dead so that when you power off the time/date clock is not maintained.

In addition:


...

The next day I turned on my PC, logged in and all these little tea timer messages came up in the right hand corner of the screen saying that it was denying a process, it kept doing this until the right edge of the screen had filled up, I had to open up the control panel and exit Spy Bot for it to stop. It does this everytime I start up my PC.

...
The entries that you posted indicate:

"mm/dd/yyyy hh:mm:ss Denied (based on user decision) ..."

If you were getting "… little tea timer messages came up in the lower right hand corner of the screen saying that it was denying a process …", normally the log entries would indicate:

"mm/dd/yyyy hh:mm:ss Denied (based on user blacklist) ...".

Since I can not tell from the time stamps in the log, did you post the latest (last) entries in the log?

[G-Veronica B.O.W]

Yes, these are the latest entires in the blog.

I think this is a malware problem with Win32.Agent.PZ and I think it will clear up when I get rid of it.

Should I take my problem to the malware part of the forums?

[md usa spybot fan]

G-Veronica B.O.W:

That may be the best course of action.

[vinngambini]

hi !
i have similar proplem WIN32.AGENT.PZ......
ntos.exe ??
\system32\wsnpoem\video.dll
and in last topic this is not a spyware ??
i try to remove it with hijackthis ...cant remove ccleaner ,spybot, spywareterminator, nothing work to remove infected file ???


01/01/2001 00:33:30 Denied (based on user decision) value "UserInit" (new data: "C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ntos.exe,") changed in Winlogon!


It repeats the following code many times

01/01/2001 00:33:30 Denied (based on user decision) value "UserInit" (new data: "C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ntos.exe,") changed in Winlogon![/QUOTE]