Fixing TeaTimer Garbled Windows with Resource Hacker

It is hard to determine what the buttons on the window will do, if you click on them. The text description of the buttons appears to be missing or in the wrong place, if you hit the Enter key you will be opting to not allow the change, because the right-most button is selected by default and that is the one to not allow the change. Hitting the tab key will move to the left-most button, which is the one that will allow the change. With it selected, you can hit enter, if you want to allow the change. Or you can just hit the "A" key on your keyboard to allow the change or the "D" key to deny it.

The developer of Spybot explains the problem, which was caused by an issue with the Borland Delphi development software used to create Spybot. The explanation can be found at Small bugs in TeaTimer, a part of which I've included below:

Many of those who're using our new version 1.4 have already noticed an obvious bug: on the Registry Warning dialog, the buttons are misplaced and partly hidden by the checkbox text. But while every software has some bugs, this is one that shouldn't have been necessary. It comes from a bug in our development environment - Borland Delphi - that automatically rearranges graphical items on the user interface every time one works on the project, which basically means about half an hour of work correcting everything each morning before the actual work can begin. And sometimes, like in this case, the errors created by Delphi even sneak into final releases. We will release an updated version as soon as we've fully tested some workarounds.

The problem can be fixed by using a tool, Resource Hacker™ by Angus Johnson. Resource Hacker is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). The steps to fix the problem are listed below. The instructions are based on those provided by ElPiedra at Solution to fix the pop-ups in TeaTimer on one of the Safer Networking Forums.

1. Deactivate TeaTimer by right-clicking on its icon, which looks like a padlock over a small window, in the notification area (the area where you will likely see a row of icons on the bottom right-hand part of your screen) and choosing "Exit Spybot-S&D Resident".



2. Open Resource Hacker.



3. Click on File.
4. Click on Open.
5. Browse to the location of TeaTimer, typically C:\Program Files\Spybot - Search & Destroy.
6. Select the teatimer.exe file and open it in Resource Hacker.
7. Click on View and select Find Text or use the Ctrl-F shortcut alternative.

   

8. When asked to "find what", type the word decision and click on Find Next.



9. You will see the following code:

   
    object cbRemember: TCheckBox
       Left = 8
       Top = 160
       Width = 339
       Height = 17
       Anchors = [akLeft, akTop, akRight]
       Caption = '&Remember this decision.'
       TabOrder = 2
     end
   
   

   Change the value of "Top" from "160" to "190" by clicking to the right of the "6" then backspacing and typing over it.



10. Click on the Compile Script button.
11. Click on File.
12. Click on Save.
13. Click on File then Exit to close Resource Hacker.
14. Restart TeaTimer by locating it (it is typically in C:\Program Files\Spybot - Search & Destroy) and double-clicking on it. You should see its icon, which looks like a padlock on top of a small window, reappear in the notification area at the bottom right-hand corner of your screen

The next time TeaTimer warns that it has detected an important registry change, you should be able to easily determine what clicking on a button will do.

You can test the change, if you like, by running regedit, navigating to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, and then clicking on Edit, New, and String Value. This will cause a TeaTimer warning window to appear. You can click on Allow Change and then delete the New Value # 1 entry from the registry afterwards by right-clicking on it and choosing Delete.

The TeaTimer.exe file I had on a system experiencing the problem was dated May 31, 2005. It was part of Spybot - Search & Destroy 1.4.

As a side note, the TeaTimer problem that leads to the unreadable windows led to Symantec, the maker of Norton AntiVirus and its corporate counterpart, Symantec AntiVirus, to recommend that Spybot be deinstalled prior to the installation of Symantec's AntiVIrus products (see Symantec and Spybot: Ward of the Words). Supposedly, Symantec may even have claimed at one time that there was an incompatibility between Norton Ghost and Spybot that could lead to corrupted drive images when creating backup images of a hard drive with Norton Ghost.

I use Norton AntiVirus or Symantec AntiVirus on most of the PCs I maintain. And I use Norton Ghost on many systems. I've never encountered any problems on those systems due to Spybot. But then those applications have been installed prior to Spybot's installation, so I've never inadvertently denied any registry change during the installation of one of those products due to the unreadable TeaTimer alerts. There should not be any need to deinstall Spybot on a system on which you are going to install one of those products as long as you patch TeaTimer first, if you are using it, or are careful to always allow any registry changes needed during the installation of one of those programs.

References:

1. Small bugs in TeaTimer
   June 22, 2005
   Safer Networking
2. Solution to fix the pop-ups in TeaTimer
   By ElPiedra
   October 29, 2005
   Safer Networking Forums
3. Unreadable dialogues
   By LordGrover
   November 7, 2006
   Safer Networking Forums
4. Tea Timer Allow, deny does not show fully
   By spybotsandra
   June 7, 2006 Safer Networking Forums
5. Question About Recent Update
   By PepiMK - Member of Team Spybot
   October 2005
   Safer Networking Forums
6. Symantec and Spybot: Ward of the Words
   By Mary Landesman
   October 3, 2006
   About: Antivirus Software
7. Resource Hacker
   By Angus Johnson