Immunization Problems - XP Home SP2

[poolsharkzz]

Hello to all,

Not sure if this is the right place to post this...

I also have been having Immunization Problems, well, at least, sometimes I am.

I just ran Spybot 1.5.1.18 and the following entries did not Immunize:

Under Internet Explorer (32/64 bit)

S-1-5-18 - ???
S-1-5-20_Classes (Cookies) 176 Unprotected
S-1-5-20_Classes (Domains) 7803 Unprotected
S-1-5-20_Classes (IPs) 77 Unprotected
S-1-5-21_Classes (Cookies) 176 Unprotected
S-1-5-21_Classes (Domains) 7803 Unprotected
S-1-5-21_Classes (IPs) 77 Unprotected

Unprotected: 16112
Protected: 48978
Total: 65090


After the Spybot scan was completed (no nasties found!), I ran Advanced WindowsCare 2.57 Personal (it found 8 invalid registry entries that needed cleaning up) and Free Windows Registry Repair 1.2 (it found 253 errors).

I then launched Spybot again and to my amazement, all entries (48978) were fully immunized!

(The S-1-5-20 entries and S-1-5-21 entries were not listed to be Immunized)

I then rebooted my computer...

I then re-launched Spybot...

Now I have the Immunization Problems again.


My setup:

Windows XP Home SP2
Internet Explorer 7
Intel Pent Dual-Core 2160 @ 1.80 GHz
350 GB Hard Drive - 1.0 GB Ram

All are latest versions and fully updated:

Comodo Firewall Pro
Ad-Aware 2007
AVG Antivirus
Spyware Terminator
Windows Defender
Spyware Blaster
Pivx PreEmpt Security
HostsMan v3.1.54 RC2


I'm thinking it's a few registry entries, but which ones?

I tried all the fixes and work-arounds listed on your site but nothing "repairs" this, execpt only after I run Advanced WindowsCare and Free Windows Registry Repair - Do you want to see their reports?

Thank you for your time,

Merry Christmas & Happy New Year!

OddTodd


PS: I have a quick suggestion:

Recovery Icons: Change back the Green "cross" to a Red "cross" like in older Spybot versions.

[md usa spybot fan]

OddTodd:

Are you logging on using the same Computer administrator account each time you immunize?

What were the register entries Free Windows Registry Repair 1.2 fixed?

[poolsharkzz]

md usa spybot fan,

I hope you had a great holiday, thanks for your reply.

I just ran a full scan with Free Windows Registry Repair 1.2 and I have 251 entries, I will attached them to this posting.

Yes, I log in only as the Computer Administrator, at least, I think I am (LOL) I have only one account on this computer, that is the "Automatic" log-in. I turn on the computer, it fires up, I see the Welcome screen for 3 or 4 seconds and then the desktop loads up. I do not put a user name or password in or anything like that.

Just as an FYI: I was a die-hard Win 9x User (Win Me) for many, many years until I totally upgraded my entire rig two months ago - and I am very glad I did!!!!

Please bear with me for I am brand new to Win XP as a whole but learning quite fast.

I see quite alot of S-1-5-18, S-1-5-20, and S-1-5-21 entries under HKEY_USERS - I understand that these are the Immunization entries for Spybot S&D, but who or what is creating these entries in the first place?

If we could stop the creation of these non-needed user entries in the first place, maybe then Spybot S&D will not try to immunize them?

I also noticed that AVG 7.5.516 also "reads" these entries as well, I noticed that from Spybot S&D System Startup page - I will attached that report to this post as well.

Thanks!

OddTodd

[md usa spybot fan]

OddTodd:

Normally Spybot immunizes in the following registry keys (among others):

• HKEY_USERS\S-1-5-20
• HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxx

Not in:

• HKEY_USERS\S-1-5-20_Classes
• HKEY_USERS\S-1-5-21_Classes

My HKEY_USERS\S-1-5-20_Classes key has no subkeys and I do not have a HKEY_USERS\S-1-5-21_Classes key (I have a HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxx_Classes key).

I was able to reproduce the problem of Spybot attempting to immunize in the HKEY_USERS\S-1-5-20_Classes key by adding the following subkey:

[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

I don't know how the problem started but it appears that the presents of the subkey in the registry hive stimulates Spybot to immunize the key.

If you delete the subkeys of the HKEY_USERS\S-1-5-20_Classes key the problem disappears and Spybot no longer attempts to immunize in that key.

I don't know what to tell you about the HKEY_USERS\S-1-5-21_Classes key because I don't have one and don't know how it is used.
_______________

ps: I initially thought that Free Windows Registry Repair 1.2 might have something to do with the problem, but I didn't see anything in the listing that that looks suspicious.