Registry Changed Denied Overwhelming my System

[mb310]

I am receiving an alert from the resident (Approximately 50 per minute)informing me of a Registry change denied. I can't click on the icon to enter my black list because system is overwhelmed by these messages. Also If I open SB and go to tools and try to run Resident I get an error "Text exceeds memo capacity"

The message States:
Resident denied the change of (F79Ad27F-8140-4E33-881D-C4FC68663CCA) (Category Global browser toolbar) based on your black list.

Last Night while surfing something unusual happened when something tried to change my homepage and toolbar which I denied. Unfortunately, also yesterday I also removed using SB startup entry of Earthlink toolbar which should not be in my system because I don't use it but that was early. I had rebooted after doing that I didn't receive the message. Last night I ran NIS antivirus, SB S&D check, Adaware se check, and SWS shredder. Please help. SB 1.4, Win 98se, NIS 2005
Thanks for your help

[md usa spybot fan]

TeaTimer takes snapshots of Registry entries and compares these snapshots with the Registry. Until these snapshots are updated it is possible that TeaTimer itself is generating those changes. Please try to close and restart TeaTimer as suggested which will refresh TeaTimer's snapshot files. See if that resolves your problem.

To refresh TeaTimer's snapshot files:
Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
TeaTimer closes.
TeaTimer's snapshot files are refreshed at this time.

Restart TeaTimer:
Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
Double click TeaTimer.exe to start it.

[mb310]

I followed your instructions but as soon as I re-activated teatimer the the alerts began again. Is there a way to find out what this browser toolbar is and delete it from my system?

[md usa spybot fan]

To stop the pop-up messages from TeaTimer, stopping TeaTimer from running:
Make sure that TeaTimer is not running by checking for the TeaTimer System Tray Icon. If the icon is there:
Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident. TeaTimer should close.
Go into Spybot > Mode > Advanced Mode > Tools > Resident
Uncheck (if checked) the following:
Resident "TeaTimer" (Protection of over-all system settings) Active.
This will keep TeaTimer from restarting if you re-boot the system.
Go into Spybot > Mode > Advanced mode > Resident and check the actual the GUID/CLSID of the registry change message that you are getting. I can not find any reference to a
F79AD27F-8140-4E33-881D-C4FC68663CCA

re: F79AD27F-8140-4E33-8B1D-C4FC6B663CCA
vs. F79AD27F-8140-4E33-881D-C4FC68663CCA

From: castlecops.com
GUID (CLSID): {F79AD27F-8140-4E33-8B1D-C4FC6B663CCA} is:
Description: Copernic Meta toolbar
Filename: CopernicMeta.dll

For a description see:
http://www.copernic.com/en/products/meta/

Since there appears to be some kind of loop occurring, evidently based on a "Deny change" with a "Remember this change" because of the repetitive:

Resident denied the change of (F79Ad27F-8140-4E33-881D-C4FC68663CCA) (Category Global browser toolbar) based on your black list.
Try to remove that black listed item manually (with TeaTimer down) as follows:
Edit the RegKeyBlack.sbe file located in one of the following directories:

Windows 95/98
C:\Windows\Application Data\Spybot - Search & Destroy\Excludes
Windows ME
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Excludes
Windows NT/2000/XP
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes

Remove the entry that contains the actual GUID/CLSID that you found by inspecting the Resident Log.

Restart TeaTimer and see if the pop-up notifications have stopped. If you get a pop-up dialog for the same GUID/CLSID either "Allow change" or "Deny change" but do not use "Remember this decision" on either. If you "Deny change" and you get another pop-up dialog for the same GUID/CLSID, "Allow change" without "Remember this decision".

After you get your system stabilized, take a look at the following and see if you are actually dealing with the Copernic Meta toolbar:
Look in C:\%root%\Downloaded Program Files\ for CopernicMeta.dll
After that, I suggest that you visit the Malware Removal forum and post a request to look at your system:
Follow the instructions here:
Before you post a log
http://forums.spybot.info/showthread.php?t=288
Then post in the following forum:
Malware Removal
http://forums.spybot.info/forumdisplay.php?f=22

[saigontiger]

Hi: I made the same mistake since I can't see the buttons, and now I can't edit the RegKeyBlack.sbe file. It was invisible, then i searced for it and found it, but nothing happens when i open it. What do I do now?

Thanks for your help..
Chris

[mb310]

Thanks MD for your help. First, you were right when I put my glasses on the 8 was a B. I used the copernic toolbar with IE but I am now on Firefox and they don't offer it. Second, when I opened the excludes Folder it was blank. Then I thought of using the run - edit which worked and opened Spybot\Excludes and the Resident Log. I located the entry and deleted it. I then closed everything and reopened SB and rechecked resident, closed and reopend. When Teatimer began I just accepted the toolbar for now. I will work on removing it later. Being it is a program I used in the past, should I still follow the links and for Malware Removal? ........Thanks again MD for your help

Mike

[md usa spybot fan]

saigontiger:

re: Missing buttons.

Pleaswe see this post:
http://forums.spybot.info/showpost.php?p=3968&postcount=2

re: Normal method to edit the "White & Black List" (Allowed registry changes and Blocked registry changes) that were stored in TeaTimer 1.4 when "Remember this decision" was used.

Please see this post:
http://forums.spybot.info/showpost.php?p=4040&postcount=2

[saigontiger]

sjdf;lasdfsahuhdfhsj

[i_r_baboon]

Hi im getting these popups constantly that states

Registry change denied

Resident denied the change of Start Page
(Category Browser Page) based on your black list.

Is there any way to just keep these from showing up? I don't really care that they're being blocked thats why i got the program, but these popups consume the side of my screen.

[i_r_baboon]

Bump

I Hate Popups

[md usa spybot fan]

i_r_baboon:

Go into Spybot > Mode > Advanced Mode > Tools > Resident > page to the bottom of the listing and highlight a portion of the log that shows the registry changes being processed, then right click and select Copy. Paste the log entries to another post in this thread and maybe we can figure out what's wrong.