'Looping Denials' and ITBarLayout

[ddasddascra]

When starting up my PC the usual things happened including the registry entry allowed pop ups and some denied - the latter were all ITBarLayout. The allowed entries disappeared. The denied ones kept flashing in the right hand side of the screen - maybe half a dozen of the same message.

I found an archived 2005 set of posts that helped me edit the registry and one made reference to previous threads about looping notices. I assume these are what I was experiencing.

I cannot find the instructions to solve this proble, Can anyone please help?

I have got rid of these in an unsatisfactory manner - with the greatest of difficulty I accessed the black and white list and pressed the black cross to remove the item from the black list.

The difficulty was that whilst these notices were constantly on screen right click access was only momentary and therefore trial and error as to whether I managed to start the B&W list. There seems no way to access these via the standard program. Why? You go to settings and there is no B&W listing. There ought to be incase access to the icon at the bottom right of the screen is unavailable.

So now ITBarLayout is allowed when I want it denied. I need to solve the looping notices problem. Presumably with the looping working properly then I can deny the program? Can anyone confirm this to be the case?

Incidentally, I noticed a music website set as default in the IE7 search box. I have removed this. Don't know if this is widely the source?

Help would be most appreciated.

[md usa spybot fan]

Please show us what change is being denied:

• Go into Spybot > Mode > Advanced Mode > Tools > Resident > page (scroll) to the bottom of the listing and highlight a portion of the log that shows the denied ITBarLayout, then right click and select Copy. Paste (Ctrl+V) the log entries to another post in this thread.

Thanks.

[ddasddascra]

28/05/2007 14:37:51 Denied value "ITBarLayout" (new data: "") deleted in User-specific browser toolbar!
28/05/2007 14:37:53 Denied value "ITBarLayout" (new data: "") deleted in User-specific browser toolbar!
28/05/2007 14:37:54 Denied value "ITBarLayout" (new data: "") deleted in User-specific browser toolbar!
28/05/2007 14:37:58 Allowed value "ITBarLayout" (new data: "") deleted in User-specific browser toolbar!

There are so many of these entries that there are too many for this message box.

[md usa spybot fan]

Something is continually attempting to delete an "ITBarLayout" entry and I believe that you answered the original pop-up dialog with "Deny change" and "Remember this decision". Now that the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" changes. Check and see if you have any entries stored for the registry entries that are being denied as follows:

• Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
  
  • Allowed processes
  • Blocked processes
  • Allowed registry changes
  • Blocked registry changes
    
    Note: If you don't see all four buttons, try expanding the window to the right.
  
  
  
• You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in "Denied registry changes". You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete and then clicking the "OK" button when you're done. This will in effect make TeaTimer forget what you told it to remember so that during future changes to these items TeaTimer will issue a pop-up dialog rather then just a notification pop-up.

You can answer the pop-up dialog accordingly when it is received again. Note: The change that you showed was actually deleting the entry (new data: ""), so allow the change and the loop of messages should stop.

For more information on how to trace what is attempting to delete the "ITBarLayout", see the following thread:
http://forums.spybot.info/showthread.php?t=1380

[ddasddascra]

Thanks.

Your last reply I recognise. because a google search brought it and the link you provided to my attention which I have printed off.

It does say in that post:

(OK, you covered how to fix the looping notices in previous posts, but I don't want to fix them, I want them not to happen in the first place!)

This I cannot find and was the main reason for entering this forum. Perhaps you can help provide this info?

Yes I did finanlly get to the B&W list and click on the black cross. This removed it from the denied list and put it in the allowed list. This I did not want, but am afriad to deny it again in case I get this 'looping; affect - as if the denial was stuck. Back to my request for that previous info.

Hope you can help.

[md usa spybot fan]

It does say in that post:

(OK, you covered how to fix the looping notices in previous posts, but I don't want to fix them, I want them not to happen in the first place!)

This I cannot find and was the main reason for entering this forum. Perhaps you can help provide this info?

I can't possible tell you how to keep a particular registry change from happening unless I know what is issuing the change. Actually, what cnsublett stated in that post was:

(OK, you covered how to fix the looping notices in previous posts, but I don't want to fix them, I want them not to happen in the first place!)

My question is: how do I find out what is causing this and block/remove/delete it?I can't find a pattern of when or why it happens; it doesn't seem to be related to any specific sites, etc. Help? Thanks!

I covered "how do I find out what is causing this" in this post:

• http://forums.spybot.info/showpost.p...55&postcount=9

__________________

Yes I did finanlly get to the B&W list and click on the black cross. This removed it from the denied list and put it in the allowed list. This I did not want, but am afriad to deny it again in case I get this 'looping; affect - as if the denial was stuck.

Unless I am misunderstanding, I don't quite understand why after removing the entry from the "Blocked registry changes" to keep the change from looping you added an entry to the "Allowed registry changes". If you want to attempt to determine what is causing the change you should not have entries in either the "Allowed registry changes" or the "Blocked registry changes". You must start monitoring registry changes when one of these registry changes occurs, do a "Deny change" without a "Remember this decision" and when the registry change is repeated see if you have trapped what is issuing the change.

I my opinion, "Remember this decision" should be used sparingly, if at all. I personally do not currently have any entries in TeaTimer's "White & Black List" for either the "Allowed registry changes" or the "Blocked registry changes".

[ddasddascra]

When I pressed the black cross the denied entry disappeared. When I checked the allowed entried it was in there as well. It seemed to me that once it was deleted from denied it appeared in allowed.

Should I delete it from allowed as well?

[ddasddascra]

PS I was not using the PC when ITBarLayout must have first appeared. Others in the family do not know how to use the security software I have installed so who knows what was pressed if any messages came up.

[ddasddascra]

PPS Sorry about this. I have just deleted (pressed the black cross) in the allowed list and it has not reappeared in the blocked list.

What I did notice was an entry much earlier in the allowed list for an ITBar7Layout.

Is this news to you?

[md usa spybot fan]

I have an "ITBar7Layout" registry entry that was added the day I installed Windows Internet Explorer 7:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBar7Layout"=hex:13,00,00,00,00,00,00,00,00,00,00,00,30,00,00,00,10,00,00,00,\
…

My Resident.log indicates that I allowed the change:

1/11/2006 12:21:45 PM Allowed value "ITBar7Layout" (new data: "hex:13,00,00,00,00,00,00,00,00,00,00,00,30,00,00,00,10,00,00,00, …,") added in User-specific browser toolbar!

However, I do not have an entry in TeaTimer's "White & Black List" under "Allowed registry changes". By using "Remember this decision" and creating an "Allowed registry changes" entry would have defeat the purpose of TeaTimer by allowing like registry changes in the future without the opportunity intervene and reverse the change.