unreadable warning

[EhudR]

After updating some programs, a window opens with the warning "spybot has detected an important registry entry that has been changed", but the buttons at the bottom of the window are only half exposed (the top half), and I have no idea what's written on each button.
How can I see the buttons? (The window only expands horizontally).
By the resulting notification that I noticed now, I guess that the right button denies a change of entry (and thus probably ruining something), and the left one accepts the change).
I have, thus far, hit the buttons randomly, forgetting the consequence from the previous time, and have thus probably ruined my Windows Explorer. Any suggestions on that?

[md usa spybot fan]

It sounds like you are running an old version of Spybot (Spybot 1.5 is the latest).

There was a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" button (on the left) and "Deny change" button (on the right) are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". Note: If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied.

If you can't deal with the problem that way, you can:

1. Download and install Spybot 1.5.
   
   • The downloads can be found here:
     
     • Mirror selection - The home of Spybot-S&D!
       http://www.spybot.info/en/mirrors/index.html
   
   
   
2. Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
   
   • Solution to fix the pop-ups in TeaTimer
     http://forums.spybot.info/showthread.php?t=122
   
   
   There are three (3) fixes published in that thread. They are:
   
   
   
   1. The ResHacker fix published by ElPiedra here:
      
      • http://forums.spybot.info/showpost.p...23&postcount=1
   2. The murdo patch published here:
      
      • http://forums.spybot.info/showpost.p...75&postcount=9
      
      Also republished by RuggeR29 (which I have never tried) here:
      
      • http://www.fureyonline.com/downloads/patch.zip
   3. The patch originally by SyreneD that I published here:
      
      • http://forums.spybot.info/showpost.p...0&postcount=38
      
      Also republished by SyreneD himself here:
      
      • http://forums.spybot.info/showpost.p...&postcount=125
   
   
   
3. Disable TeaTimer as follows:
   • Go into Spybot > Mode > Advanced Mode > Tools > Resident.
   • Uncheck the following:
     • Resident "TeaTimer" (Protection of over-all system settings) Active.

********************

Notes about the patches (b. and c. above):

• If you installed Spybot in the default location:
  
  • C:\Program Files\Spybot - Search & Destroy
  
  The following patch (c.) defaults to that location:
  
  • The patch originally by SyreneD that I published here:
    
    • http://forums.spybot.info/showpost.p...0&postcount=38
    
    Also republished by SyreneD himself here:
    
    • http://forums.spybot.info/showpost.p...&postcount=125
• If you use the following patch (b.) you have to navigate to the correct location (See Note #1) unless you execute the patch from within the "C:\Program Files\Spybot - Search & Destroy" folder:
  
  • The murdo patch published here:
    
    • http://forums.spybot.info/showpost.p...75&postcount=9
    
    Also republished by RuggeR29 (which I have never tried) here:
    
    • http://www.fureyonline.com/downloads/patch.zip
    
    
    Note# 1: To the right of the Target File (TeaTimer.exe) there is a button that looks like "[ . . . ]". Click on that button, navigate to the correct folder, click "Open" and then "Start".

[EhudR]

MD USA fan,
Thanks for the advice. I installed Spybot 1.5, and indeed this time when I got a registry change warning, I saw the buttons! btw, for some reason, after installing 1.5, my XP couldn't restart, only after 3 or 4 attempts to start did I get my computer back (this probably doesn't happen in Mac's). But all's well that ends well.
I still though have a problem with programs. especially Windows Explorer (!), that I corrupted when I pressed the wrong button. Is there any way to change the registries as if I had pressed the correct, left button?
Thanks

[md usa spybot fan]

There is no feature to reverse any registry change decisions ("Allow change" or "Deny change") that you make with TeaTimer. You have to redo whatever you were doing so that the Registry change is done again (or manually edit the Registry).

There is a log of the actions taken with TeaTimer. If you post the portion of the Resident.log file that shows the registry changes that you denied in error, perhaps someone can help you reverse the affects of the denials. To do that:

• Go into Spybot > Mode > Advanced Mode > Tools > Resident.
• Page (scroll) to the bottom of the listing and highlight a portion of the log that shows the denied registry change.
• Then right click and select Copy.
• Paste (Ctrl+V) the log entries to another post in this thread.

However, since you are running on a Windows XP system, your best bet may be to do a System Restore to a Restore Point immediately prior to when you encountered the problems with the bad TeaTimer dialog.

[EhudR]

MD USA fan,
Thanks again.
I understood that you suggested I post here the denied changes found in the log, perhaps so that you can look at it and suggest what to do.
Regarding your suggestion to do a system restore: since I've corrupted WExplorer and who knows what else, opening "system restore" produces a blank window...
Any advice will be welcome.
Thanks

16/06/07 02:21:22 Denied value "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}" (new data: "") deleted in Browser Helper Object!
16/06/07 02:21:39 Denied value "Adobe Reader Speed Launcher" (new data: ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"") added in System Startup global entry!
23/Jul/07 9:38:52 PM Denied value "wextract_cleanup0" (new data: "rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\sande\LOCALS~1\Temp\IXP000.TMP\"") added in System Startup global entry!
23/Jul/07 9:57:13 PM Denied value "wextract_cleanup0" (new data: "rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\sande\LOCALS~1\Temp\IXP000.TMP\"") added in System Startup global entry!
23/Jul/07 9:58:02 PM Denied value "wextract_cleanup0" (new data: "") deleted in System Startup global entry!
23/Jul/07 10:34:25 PM Denied value "Search Page" (new data: "http://go.microsoft.com/fwlink/?LinkId=54896") changed in Browser page!
23/Jul/07 10:34:26 PM Denied value "Start Page" (new data: "http://go.microsoft.com/fwlink/?LinkId=69157") changed in Browser page!
23/Jul/07 10:34:26 PM Denied value "Default_Page_URL" (new data: "http://go.microsoft.com/fwlink/?LinkId=69157") changed in Browser page!
23/Jul/07 10:34:27 PM Denied value "Default_Search_URL" (new data: "http://go.microsoft.com/fwlink/?LinkId=54896") changed in Browser page!
25/Sep/07 12:49:03 AM Denied value "Picasa Media Detector" (new data: "") deleted in System Startup global entry!
12/Oct/07 2:56:26 PM Denied value "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" (new data: "") added in ActiveX Distribution Unit!

[md usa spybot fan]

The only recent denial of a registry change was for the addition of an ActiveX Distribution Unit for which looks like it may be for Sun's Java JRE 6 Update 3:

12/Oct/07 2:56:26 PM Denied value "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" (new data: "") added in ActiveX Distribution Unit!

If I am correct about it being an ActiveX Distribution Unit associated with Java, to correct that problem you should be able to go into add/remove programs remove Java and reinstall.

However, the denial of an ActiveX Distribution Unit should not have cause a problem with Windows Explorer as you indicated you are having (Windows Internet Explorer possibly but not Windows Explorer).

[EhudR]

MD USA fan,
I deeply appreciate the time and effort your investing in helping me.
Trouble started with Internet Explorer and spread to Windows Explorer some two months ago; by the log, I guess it was the end of July incidents.
During this time I kept on using Firefox and Thunderbird, and lost capability to do "search", use IE, set restore points, etc.
Can you help?

[md usa spybot fan]

EhudR:

I'm sorry that I haven't responded in a couple of days. I'm also sorry that I don't have a resolution to your problem.

From the Resident.log that you provided, I can't determine if the cause of your problem was or was not caused by the denial of registry during "... the end of July incidents."

However, my gut feeling from your description that your problems started with Windows Internet Explorer and spread to Windows Explorer is that there is some other cause for the problems you are having rather than just the denial of those registry changes.

The denials of the "wextract_cleanup0" changes could be of some concern. The addition and deletion of the entries for "wextract_cleanup0" appear to be related to cleanup processes for certain Microsoft updates. I have received them in the past, but don't remember the specific event that surrounded the events at this juncture of time. I have never denied those registry changes, so I don't what would happen if I did. The last ones that I encountered were:

6/4/2007 1:24:40 AM Allowed value "wextract_cleanup0" (new data: "rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Lee\LOCALS~1\Temp\IXP000.TMP\"") added in System Startup global entry!
6/4/2007 1:24:44 AM Allowed value "wextract_cleanup0" (new data: "") deleted in System Startup global entry!

At this point in time (several months after the fact), I can not directly relate those particular registry changes to a specific Microsoft update event even in my system (although I've tried), let alone in your system.

I'm truly sorry but I don't think that I can be of further assistance to help resolve your dilemma.

[EhudR]

MD USA fan,
Was away for some time.
Thanks for your reply. My current fix: I'm using a server-based IE when necessary, but still have no WE. I'm afraid to try and fix things, for fear of losing a lot of stuff, perhaps the whole system, and wasting a lot of time on this as a result.
So again I want to thank you for your time and effort.