ITBarlayout Problem

[Pantera]

Yesterday i started getting a pop up everytime i opened up my internet explorer and also if i click a link on a page now it will close the current browser first then open the new one. But here is the error i keep getting.

12/31/2005 2:12:22 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:22:21 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:22:43 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:24:38 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:24:43 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:25:49 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:32:47 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!
12/31/2005 2:39:44 PM Denied value "ITBarLayout" (new data: "") added in User-specific browser toolbar!

Teatimer pops up everytime i open a new browser so if someone has a solution to fix this annoyance i would greatly appreciate it. Thank You, Pantera:D

[md usa spybot fan]

Are the pop-ups that you are getting dialogs that you have to answer or are they notifications that the registry change has been denied "... based on your black list."?

[Pantera]

They are just notifications that the change has been denied.

[md usa spybot fan]

Something is continually attempting to change an "ITBarLayout" entry and I believe that you answered the original pop-up dialog with "Deny change" and "Remember this decision". Now that the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" changes. Check and see if you have any entries stored for the registry entries that are being denied as follows:

• Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
  
  • Allowed processes
  • Blocked processes
  • Allowed registry changes
  • Blocked registry changes
    
    Note: If you don't see all four buttons, try expanding the window to the right.
  
  
  
• You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in "Denied registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

You can answer the pop-up dialog accordingly when it is received again. Note: The change that you showed was actually deleting the entry (new data: ""), so allow the change and the loop of messages should stop.

[Pantera]

Ok thank you very much i will give that a shot and see what happens :D

[Pantera]

Ahhhh yes MD that is just what the doctor ordered lol. The problem is fixed. Many thanks to you for the help. Happy New Year to you and everyone else on the spybot team.

[Raymond]

Thanks MD :beerbeerb

That fixed that, once I was able to get Teatimer to stay still long enough to click on settings.

[cnsublett]

I've read these posts and know how to stop the Resident notices; that's not my main worry.

I start getting these "Registry change denied" messages out of the clear blue ether. Regardless of what I do, when I close Internet Explorer and open it again, my toolbar is changed. It has added the "Links" toolbar (which I never display), removed my "Norton Antivirus" toolbar, and changed the position of the Standard Buttons and Address Bar.

Something is attacking my registry and changing these settings; Resident is the only warning I have that anything is going on.

If I click "Allow" I get a changed toolbar. If I click "Deny" and "Remember this decision" I get a constant display going up the right-hand side of my screen that Resident is denying the change, and my toolbar gets changed anyway. (OK, you covered how to fix the looping notices in previous posts, but I don't want to fix them, I want them not to happen in the first place!)

My question is: how do I find out what is causing this and block/remove/delete it?I can't find a pattern of when or why it happens; it doesn't seem to be related to any specific sites, etc. Help? Thanks!

[md usa spybot fan]

cnsublett:

My question is: how do I find out what is causing this and block/remove/delete it?I can't find a pattern of when or why it happens; it doesn't seem to be related to any specific sites, etc.

Since it is not apparent what is changing the registry, about the only thing that you can do is run some registry monitoring program such as Regmon by Sysinternals to try determine what is changing the registry. TeaTimer does not capture that information because it detects changes after the fact.

Sysinternals:

• Sysinternals Freeware
  http://www.sysinternals.com/

Regmon:

• Regmon v7.03
  http://www.sysinternals.com/Utilities/Regmon.html

Note: If you use Regmon as soon as the program starts it will immediately start collecting registry entries, so I suggest that you review the following before using Regmon:

• Start Regmon.exe
  
  • Immediately hit Ctrl+E or the click Blue Magnifying Glass symbol (second button from the left) to stop the data collection.
  • In the pull down Edit menu select Clear Display (Ctrl+X).
  • In the pull down Options menu select Filter/Highlight (Ctrl+L).
  • Make the following changes in the Regmon Filter window (see Note #1 below):
    
    • In the Include box type "ITBarLayout" (no quotes).
    • In the Exclude box type "TeaTimer" (no quotes).
    • Uncheck everything at the bottom of the Regmon Filter except "Log Writes".
    • Click OK.
  • Hit Ctrl+E or the click Blue Magnifying Glass (second button from the left) to start the data collection.
  
  If you get a TeaTimer pop-up dialog which indicates that a change has take place, check Regmon and see if you trapped what is changing the ITBarLayout registry entry.
  
  Note #1: The options used in the Regmon Filter window may have to be modified somewhat. I believe that options that I outlined will work, but because I don't have the problem I am not 100% sure.

[cnsublett]

Thank you for the information; I've downloaded Regmon and am running it every time I'm on the internet.

I waited this long in hopes that I could report, "It worked!" and what the problem was; however, I haven't experienced the problem again. (Figures.)

There have been a couple of Microsoft updates of late; maybe that took care of it. I was having the problem at least every other day, so something changed!

I really do appreciate the help—it's nice to know there's a place to come and ask questions.

Thanks so much, and have good days.
cns