Scan Result

[md usa spybot fan]

I do not have an "iexplore.exe" entry in my HKEY_USERS registry hive:

[HKEY_USERS\S-1-5-21-1957994488-790525478-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]

[HKEY_USERS\S-1-5-21-1957994488-790525478-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings]

However, I do have one in the HKLM:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
@=""
"iexplore.exe"=dword:00000001
"explorer.exe"=dword:00000001
"msimn.exe"=dword:00000001
"wmplayer.exe"=dword:00000001
"waol.exe"=dword:00000001

[md usa spybot fan]

Firstly, Spybot does not appear to detect "iexplore.exe"=dword:00000000 in the HKLM registry hive. This entry was not detected:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
@=""
"iexplore.exe"=dword:00000000

It is detected in the users registry hive. This entry was detected:

[HKEY_USERS\S-1-5-21-1957994488-790525478-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
@=""
"iexplore.exe"=dword:00000000

As:

Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1957994488-790525478-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1

Doing a "Fix selected problems" changes the "iexplore.exe"=dword:00000000 to "iexplore.exe"=dword:00000001:

[HKEY_USERS\S-1-5-21-1957994488-790525478-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
@=""
"iexplore.exe"=dword:00000001

Log from the fix:

Windows.Security.InternetExplorer: Settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-1957994488-790525478-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1

I ran the same test with the Security.sbi file from the 2006-08-11 updates and the registry entry of "iexplore.exe"=dword:00000000 was not detected proving the the detection was added with 2006-08-18 updates.

[UserChris]

Thanks md usa, that answers a lot of questions.

But why do you suppose that change doesn't stick on my user? Does your system retain that change when you do another Spybot scan, perhaps after restart, or does it flag the same issue over and over(as it does with me)?

Chris

[Ron in RI]

This is a most interesting thread...though it's getting beyond my competence.

I expect that this change might have occured after I downloaded S&D definition updates....as I did updates just before running this particular scan.

The bottom line question for me is: Is this "LOCKDOWN/iexplore.exe" item a problem? Is there something we should do? Leave it alone? Fix it? Or.....?

Thanks

[md usa spybot fan]

UserChris:

I can only assume that something is preventing Spybot from actually changing the entry to begin with or something that is changing the registry entry back after Spybot alters it. If your wife's entry has not been changed back than it would seem to be something you are running under your account that is not being run under your wife's account.

[eliuri]

Thanks md usa, that answers a lot of questions.

But why do you suppose that change doesn't stick on my user? Does your system retain that change when you do another Spybot scan, perhaps after restart, or does it flag the same issue over and over(as it does with me)?

Chris

************************************************


Hello again, Chris:

I too have two users on my PC. One of them got that Spybot: Windows.Security.Internet Explorer reading; the other did not.

Here’s how I resolved it without asking Spybot to fix anything::

Internet Explorer-->Properties->Options--> Advanced-->Scroll down to Security.

Uncheck the top two boxes. In my case, the “culprit” was the second box from top checked box reading:


“Allow active content to run in files on My Computer".

The user getting that Spybot alert had that checked in; the one without the alert had that unchecked.

I suppose that the upper box reading:


“Allow active content from CDs to run on My Computer”

might trigger that alert as well if checked in.

It seems that the option allowing active content to run in files on My Computer in effect overrides the SP2 Default of locking down the Local Machine Zone.

At times, an Information Bar appears on top of a page asking you if you’d like to allow active content to run , and you’re prompted with several options. I’m wondering if you might have allowed that after you fixed it via Spybot, and thus undid the Local Machine Zone lockdown? Perhaps some program you were running prompted you about this and you opted to allow it?

In any case, my altering the Internet Options--> Advanced security settings as described above did fix it –at least for now—without having Spybot alter the registry, and neither of the two users are getting that Windows.Security.Internet Explorer registry item in the Spybot scan.

I’m wondering if the same happens in your case.

I found the following site useful in explaining some of this.

http://www.microsoft.com/windows/ie/...rovements.mspx


Best of luck:

-Eliuri

[UserChris]

Thanks for the post eliuri.

I discovered the same thing last night, but in my case the culprit was “Allow active content from CDs to run on My Computer”.

Once I unchecked that and ran a Spybot scan all was well. Whew! What a relief.

Would it be possible for us to recommend to the makers of Spybot that they add to the description of this problem a suggestion that the user check that Internet Options panel to see if any of these boxes are checked? Spybot seems to be unable to fix the problem if these boxes are checked so this would be a very helpful piece of advice.

Thanks to everyone! I really appreciate all the feedback and suggestions I've received here.

Chris

[Ron in RI]

Hi Folks....

Unchecking the "active content" culprit settled the problem for me, too.

THANKS so much to all who participated in this discussion!!

Ron in RI

[folsombob]

I have the same or similar problems as the others.
In addition, all of my .htm and .html files have lost there icons.

The files STILL OPEN in IE, but they now sport the generic icon.

This happened to me after I installed Adobe Photoshop CS2. It may be connected to the install, or just a coincidence.

I, too, do not like to mess around in the Registry.

What is the solution to SpyBot's recognition of this?

Should I "fix selected problem..." or just let it ride?

Thanks,

folsombob

[eliuri]

Hello folsombob:

You might wish to try the following:

In IE go to: Tools--->Internet Options--->Advanced.

Scroll down to Security.

Uncheck the following top two boxes [if checked]:

--Allow active content from CDS to run on My Computer

--Allow active content to run on files on My Computer

If you run the Spybot scan again, you might not get that

Windows.Security.Internet Explorer

-Eliuri