Registry Changed Denied Overwhelming my System

M

mb310

New member
I am receiving an alert from the resident (Approximately 50 per minute)informing me of a Registry change denied. I can't click on the icon to enter my black list because system is overwhelmed by these messages. Also If I open SB and go to tools and try to run Resident I get an error "Text exceeds memo capacity"

The message States:
Resident denied the change of (F79Ad27F-8140-4E33-881D-C4FC68663CCA) (Category Global browser toolbar) based on your black list.

Last Night while surfing something unusual happened when something tried to change my homepage and toolbar which I denied. Unfortunately, also yesterday I also removed using SB startup entry of Earthlink toolbar which should not be in my system because I don't use it but that was early. I had rebooted after doing that I didn't receive the message. Last night I ran NIS antivirus, SB S&D check, Adaware se check, and SWS shredder. Please help. SB 1.4, Win 98se, NIS 2005
Thanks for your help
 
Last edited:
TeaTimer takes snapshots of Registry entries and compares these snapshots with the Registry. Until these snapshots are updated it is possible that TeaTimer itself is generating those changes. Please try to close and restart TeaTimer as suggested which will refresh TeaTimer's snapshot files. See if that resolves your problem.

To refresh TeaTimer's snapshot files:
  • Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
    • TeaTimer closes.
    • TeaTimer's snapshot files are refreshed at this time.
  • Restart TeaTimer:
    • Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
    • Double click TeaTimer.exe to start it.
 
I followed your instructions but as soon as I re-activated teatimer the the alerts began again. Is there a way to find out what this browser toolbar is and delete it from my system?
 
To stop the pop-up messages from TeaTimer, stopping TeaTimer from running:
  • Make sure that TeaTimer is not running by checking for the TeaTimer System Tray Icon. If the icon is there:
    • Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident. TeaTimer should close.
  • Go into Spybot > Mode > Advanced Mode > Tools > Resident
    • Uncheck (if checked) the following:
      Resident "TeaTimer" (Protection of over-all system settings) Active.
    This will keep TeaTimer from restarting if you re-boot the system.
Go into Spybot > Mode > Advanced mode > Resident and check the actual the GUID/CLSID of the registry change message that you are getting. I can not find any reference to a
F79AD27F-8140-4E33-881D-C4FC68663CCA

re: F79AD27F-8140-4E33-8B1D-C4FC6B663CCA
vs. F79AD27F-8140-4E33-881D-C4FC68663CCA

From: castlecops.com
GUID (CLSID): {F79AD27F-8140-4E33-8B1D-C4FC6B663CCA} is:
Description: Copernic Meta toolbar
Filename: CopernicMeta.dll

For a description see:
http://www.copernic.com/en/products/meta/

Since there appears to be some kind of loop occurring, evidently based on a "Deny change" with a "Remember this change" because of the repetitive:
mb310 said:
Resident denied the change of (F79Ad27F-8140-4E33-881D-C4FC68663CCA) (Category Global browser toolbar) based on your black list.
Click to expand...
Try to remove that black listed item manually (with TeaTimer down) as follows:
Edit the RegKeyBlack.sbe file located in one of the following directories:
  • Windows 95/98
    C:\Windows\Application Data\Spybot - Search & Destroy\Excludes
  • Windows ME
    C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Excludes
  • Windows NT/2000/XP
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes
Remove the entry that contains the actual GUID/CLSID that you found by inspecting the Resident Log.

Restart TeaTimer and see if the pop-up notifications have stopped. If you get a pop-up dialog for the same GUID/CLSID either "Allow change" or "Deny change" but do not use "Remember this decision" on either. If you "Deny change" and you get another pop-up dialog for the same GUID/CLSID, "Allow change" without "Remember this decision".

After you get your system stabilized, take a look at the following and see if you are actually dealing with the Copernic Meta toolbar:
  • Look in C:\%root%\Downloaded Program Files\ for CopernicMeta.dll
After that, I suggest that you visit the Malware Removal forum and post a request to look at your system:
 
Hi: I made the same mistake since I can't see the buttons, and now I can't edit the RegKeyBlack.sbe file. It was invisible, then i searced for it and found it, but nothing happens when i open it. What do I do now?

Thanks for your help..
Chris
 
It Worked

Thanks MD for your help. First, you were right when I put my glasses on the 8 was a B. I used the copernic toolbar with IE but I am now on Firefox and they don't offer it. Second, when I opened the excludes Folder it was blank. Then I thought of using the run - edit which worked and opened Spybot\Excludes and the Resident Log. I located the entry and deleted it. I then closed everything and reopened SB and rechecked resident, closed and reopend. When Teatimer began I just accepted the toolbar for now. I will work on removing it later. Being it is a program I used in the past, should I still follow the links and for Malware Removal? ........Thanks again MD for your help

Mike
 
Last edited:
Hi im getting these popups constantly that states

Registry change denied

Resident denied the change of Start Page
(Category Browser Page) based on your black list.

Is there any way to just keep these from showing up? I don't really care that they're being blocked thats why i got the program, but these popups consume the side of my screen.
 
i_r_baboon:

Go into Spybot > Mode > Advanced Mode > Tools > Resident > page to the bottom of the listing and highlight a portion of the log that shows the registry changes being processed, then right click and select Copy. Paste the log entries to another post in this thread and maybe we can figure out what's wrong.
 
You must log in or register to reply here.
Back
Top