Fixing TeaTimer Garbled Windows with Resource Hacker

If you've used the TeaTimer capability in Spybot - Search & Destroy to monitor systems changes, such as changes to the registry, you may have encountered garbled popup windows when changes occur. You may have seen something like the window below:

Garbled TeaTimer with no selected

It is hard to determine what the buttons on the window will do, if you click on them. The text description of the buttons appears to be missing or in the wrong place, if you hit the Enter key you will be opting to not allow the change, because the right-most button is selected by default and that is the one to not allow the change. Hitting the tab key will move to the left-most button, which is the one that will allow the change. With it selected, you can hit enter, if you want to allow the change. Or you can just hit the "A" key on your keyboard to allow the change or the "D" key to deny it.

Garbled TeaTimer with yes selected

The developer of Spybot explains the problem, which was caused by an issue with the Borland Delphi development software used to create Spybot. The explanation can be found at Small bugs in TeaTimer, a part of which I've included below:

Many of those who're using our new version 1.4 have already noticed an obvious bug: on the Registry Warning dialog, the buttons are misplaced and partly hidden by the checkbox text. But while every software has some bugs, this is one that shouldn't have been necessary. It comes from a bug in our development environment - Borland Delphi - that automatically rearranges graphical items on the user interface every time one works on the project, which basically means about half an hour of work correcting everything each morning before the actual work can begin. And sometimes, like in this case, the errors created by Delphi even sneak into final releases. We will release an updated version as soon as we've fully tested some workarounds.

The problem can be fixed by using a tool, Resource Hacker™ by Angus Johnson. Resource Hacker is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). The steps to fix the problem are listed below. The instructions are based on those provided by ElPiedra at Solution to fix the pop-ups in TeaTimer on one of the Safer Networking Forums.

  1. Deactivate TeaTimer by right-clicking on its icon, which looks like a padlock over a small window, in the notification area (the area where you will likely see a row of icons on the bottom right-hand part of your screen) and choosing "Exit Spybot-S&D Resident".
  2. Exit TeaTimer

  3. Open Resource Hacker.
  4. Resource Hacker

  5. Click on File.
  6. Click on Open.
  7. Browse to the location of TeaTimer, typically C:\Program Files\Spybot - Search & Destroy.
  8. Select the teatimer.exe file and open it in Resource Hacker.
  9. Click on View and select Find Text or use the Ctrl-F shortcut alternative.

    Find Text

  10. When asked to "find what", type the word decision and click on Find Next.
  11. Find Decision

  12. You will see the following code:

     object cbRemember: TCheckBox
        Left = 8
        Top = 160
        Width = 339
        Height = 17
        Anchors = [akLeft, akTop, akRight]
        Caption = '&Remember this decision.'
        TabOrder = 2

    Change the value of "Top" from "160" to "190" by clicking to the right of the "6" then backspacing and typing over it.
  13. Found Decision

  14. Click on the Compile Script button.
  15. Click on File.
  16. Click on Save.
  17. Click on File then Exit to close Resource Hacker.
  18. Restart TeaTimer by locating it (it is typically in C:\Program Files\Spybot - Search & Destroy) and double-clicking on it. You should see its icon, which looks like a padlock on top of a small window, reappear in the notification area at the bottom right-hand corner of your screen

The next time TeaTimer warns that it has detected an important registry change, you should be able to easily determine what clicking on a button will do.

You can test the change, if you like, by running regedit, navigating to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, and then clicking on Edit, New, and String Value. This will cause a TeaTimer warning window to appear. You can click on Allow Change and then delete the New Value # 1 entry from the registry afterwards by right-clicking on it and choosing Delete.

Window displayed correctly

The TeaTimer.exe file I had on a system experiencing the problem was dated May 31, 2005. It was part of Spybot - Search & Destroy 1.4.

Original MD5 Sum:70496eee0ddbe485f658693826f44d38
New MD5 Sum:8f1862afc3c79c0ea37621e87cc2fe6e

As a side note, the TeaTimer problem that leads to the unreadable windows led to Symantec, the maker of Norton AntiVirus and its corporate counterpart, Symantec AntiVirus, to recommend that Spybot be deinstalled prior to the installation of Symantec's AntiVIrus products (see Symantec and Spybot: Ward of the Words). Supposedly, Symantec may even have claimed at one time that there was an incompatibility between Norton Ghost and Spybot that could lead to corrupted drive images when creating backup images of a hard drive with Norton Ghost.

I use Norton AntiVirus or Symantec AntiVirus on most of the PCs I maintain. And I use Norton Ghost on many systems. I've never encountered any problems on those systems due to Spybot. But then those applications have been installed prior to Spybot's installation, so I've never inadvertently denied any registry change during the installation of one of those products due to the unreadable TeaTimer alerts. There should not be any need to deinstall Spybot on a system on which you are going to install one of those products as long as you patch TeaTimer first, if you are using it, or are careful to always allow any registry changes needed during the installation of one of those programs.


  1. Small bugs in TeaTimer
    June 22, 2005
    Safer Networking
  2. Solution to fix the pop-ups in TeaTimer
    By ElPiedra
    October 29, 2005
    Safer Networking Forums
  3. Unreadable dialogues
    By LordGrover
    November 7, 2006
    Safer Networking Forums
  4. Tea Timer Allow, deny does not show fully
    By spybotsandra
    June 7, 2006 Safer Networking Forums
  5. Question About Recent Update
    By PepiMK - Member of Team Spybot
    October 2005
    Safer Networking Forums
  6. Symantec and Spybot: Ward of the Words
    By Mary Landesman
    October 3, 2006
    About: Antivirus Software
  7. Resource Hacker
    By Angus Johnson