Teatimer closes after some seconds for no apparent reason

[Laura Genetti]

After I launch the TeaTimer (c:\program files\spybot - search & destroy\teatimer.exe) I see an icon in my tray bar for some seconds and some popup notifications "19.43 Registry change allowed"... Then the icon disappears and the process teatimer.exe disappears too from Task Manager.

Is it normal? or I have to suspect that a virus is killing it?

If it's not normal, how can I troubeshoot the (virus) problem?

If it's normal, is Spybot S&D still operating without the TeaTimer active? is Teatimer not meant to remain active as process and in the tray bar?

[Zenobia]

Teatimer is meant to remain active.Are you having any other problems with your computer(pop-ups,etc.)?
Would you please open Spybot,and (if you aren't already in Advanced Mode),click mode,then advanced mode,then click Tools,then Resident.Over to the right,scroll down to the bottom,then highlight a couple of items from the bottom up(say,about 20 or so lines),then rightclick,select Copy,then Paste the lines here.

[Laura Genetti]

I also tried to delete C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes\RegKeyBlack.sbe and RegKeyWhile.sbe as suggested from others in this forum, with no success. I restored them.

Here is what you asked:

22/05/2007 19.21.20 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 19.21.20 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 19.21.20 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 19.21.20 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 19.21.20 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 19.26.57 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!
22/05/2007 19.26.57 Allowed value "updateMgr" (new data: "") deleted in System Startup user entry!
22/05/2007 19.26.57 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 19.26.57 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 19.26.57 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 19.26.58 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 19.26.58 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 19.27.23 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!
22/05/2007 19.27.23 Allowed value "updateMgr" (new data: "") deleted in System Startup user entry!
22/05/2007 19.27.23 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 19.27.23 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 19.27.23 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 19.27.23 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 19.27.23 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 19.43.20 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!
22/05/2007 19.43.20 Allowed value "updateMgr" (new data: "") deleted in System Startup user entry!
22/05/2007 19.43.20 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 19.43.20 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 19.43.20 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 19.43.21 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 19.43.21 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 19.57.22 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!
22/05/2007 19.57.22 Allowed value "updateMgr" (new data: "") deleted in System Startup user entry!
22/05/2007 19.57.22 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 19.57.22 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 19.57.22 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 19.57.22 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 19.57.23 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 20.03.26 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!
22/05/2007 20.03.26 Allowed value "updateMgr" (new data: "") deleted in System Startup user entry!
22/05/2007 20.03.26 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 20.03.26 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 20.03.26 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 20.03.26 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 20.03.26 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 22.15.23 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!
22/05/2007 22.15.23 Allowed value "updateMgr" (new data: "") deleted in System Startup user entry!
22/05/2007 22.15.23 Allowed value "H/PC Connection Agent" (new data: "") deleted in System Startup user entry!
22/05/2007 22.15.28 Allowed value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
22/05/2007 22.15.28 Allowed value "SunJavaUpdateSched" (new data: ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"") changed in System Startup global entry!
22/05/2007 22.15.28 Allowed value "NvMediaCenter" (new data: "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit") changed in System Startup global entry!
22/05/2007 22.15.28 Allowed value "scrnsave.exe" (new data: "C:\WINDOWS\System32\logon.scr") changed in Desktop settings!
22/05/2007 22.29.39 Allowed value "SpybotSD TeaTimer" (new data: "") deleted in System Startup user entry!

[Zenobia]

You deleted regkeywhite and regkeyblack,and Teatimer still shuts down?
I see these:

22/05/2007 20.03.26 Allowed value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") changed in System Startup user entry!

and also the last entry shows Teatimer was deleted from Startup.

Could you post or attach your Spybot S&D log here,and maybe someone can see if you need to go to Malware Removal:
Provide a Spybot-S&D log

1. * Close all browsers.
2. * Open SpyBot, check for and get any updates available.
3. * Check for problems and fix everything found in red
4. * Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except
   
5. * Uncheck[ ] do not report disabled or known legitimate Items.
6. * Uncheck[ ] Include a list of services in report.
7. * Uncheck[ ] Include uninstall list in report.
   
8. * Now select (near the top) view report.
9. * Click export and in the 'save in' box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach or post that report

Also,maybe could you navigate back to C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes,rightclick RegKeyWhite.sbe and then select Open With...,and then select Notepad.If you have to choose a program,make sure Always use the selected program to open this file is not checkmarked when you select Notepad,then copy and paste the text here.And then,could you do the same with regkeyblack.sbe.If there isn't enough room,just put them into a new reply.

[wfx34]

It started after downloading the 2007-05-02 update.

I thought that maybe it was a setting on my laptop that caused it, but when I downloaded the same update on my desktop pc, it did the same thing; loaded teatimer - then disappeared, including the process list.

I did notice one thing though, this is only happening on my user accounts that have admin privileges.

I uninstalled spybot, reloaded, and still have the same problem.

I updated my kids laptop this evening, and after downloading the updates, teatimer disappeared as well.

Any ideas?

[Laura Genetti]

After a long trial and error session I finally found the cause of our problem!!!!

THE CAUSE IS:..........the tray icon of Microsoft OneNote!

Remove it and teatimer.exe will stay forever. Open it and teatimer.exe will crash in less than a minute!

I think Spybot developers should fix this bug.

[wfx34]

Unfortunately for me, I don't use MS OneNote.
Anyone else have the same problem, or have some suggestions?

[Zenobia]

After a long trial and error session I finally found the cause of our problem!!!!

THE CAUSE IS:..........the tray icon of Microsoft OneNote!

Remove it and teatimer.exe will stay forever. Open it and teatimer.exe will crash in less than a minute!

I think Spybot developers should fix this bug.

Glad you found out what was causing Teatimer to close.

[Laura Genetti]

wfx34 use my method to find out what causes it to crash:

- download the FileMon application from Microsoft
- open teatimer.exe manually (launch the .exe)
- open the FileMon app.
- filter the lines for "teatimer.exe"
- as soon teatimer crashes look at the last lines in FileMon.
In my case the *last* file it touched before crashing was that of MS OneNote and I tested it to really be the cause.

Let us know your results