Immunization changed from 9239 to 7577

[slotdr]

Hi all, first time at this forum, for some reason after the 3-10-06 update it showed 9239 immunized, after I re-started my PC it now shows 7577. I have tried un-installing and in-stalling and I can't get past 7577. What happened? I never had a problem with spybot before

[stevek]

It probably has to do with your authority to change registry keys. See this thread (MD USA Spybot Fan's post #2) for explanation:

http://forums.spybot.info/showthread.php?t=1933&highlight=immunization

This thread explains that the dif should be 1662 (your dif) after 3/10/06.

http://forums.spybot.info/showthread.php?t=3007&highlight=immunization

[md usa spybot fan]

stevek:


It probably has to do with your authority to change registry keys.
You could be right because I've never heard of anything quite like this.

slotdr:

Are you running Windows XP?

If so, how many user accounts are there on the system by type (Computer Administrator, Limited, Power User and Guest).

Are you running the Spybot Immunize from the same user account with the same access rights that you were before the immunization count dropped? What type on account is that?

Have you re-booted again since Spybot’s immunization count dropped and if so has the count returned to 9239?

Between the time the count was 9239 and it was 7577 did you do anything that:
Could have affected the user's access to the system Registry?
May have changed the registry, like use a Registry cleaner, etc.?

***********

My first inclination is to suggest that you do a system restore to a point prior to when this happened.

***********

Assuming that you are running Windows XP, the user account that you are immunizing from is the same user account where the counts came from initially, no changes were made to that user account and that you did not perform some sort of cleanup of the registry; the only thing that I can think of is that the user lost access to an entire group of Registry keys.

If you can not figure out what may have happened:
Download the attached RegExport.zip file.
Extract RegExport.bat into its own folder (see Note #1).
Execute RegExport.bat by double clicking on it.
After the execution of RegExport.bat it should have created a RegExport.txt file (see Note #2). Copy the contents of the RegExport.txt file to the clipboard:
Double click on the RegExport.txt file and it should open with Notepad.
Select all (Ctrl+A)
Copy (Ctrl+C)
Then Paste (Ctrl+V) into a new post (reply) in this thread.
Then we can see what Registry keys are/are not accessible by the user.

Note #1: The code in the RegExport.bat.


Echo RegExport

del "RegExport.txt" "RegExport.tmp"

reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com" "RegExport.tmp"

if exist "RegExport.txt" goto concat1
copy "RegExport.tmp" "RegExport.txt"
goto around1
:concat1
Copy "RegExport.txt"+"RegExport.tmp" "RegExport.txt"
:around1
del "RegExport.tmp"

reg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com" "RegExport.tmp"

if exist "RegExport.txt" goto concat2
copy "RegExport.tmp" "RegExport.txt"
goto around2
:concat2
Copy "RegExport.txt"+"RegExport.tmp" "RegExport.txt"
:around2
del "RegExport.tmp"

reg export "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com" "RegExport.tmp"

if exist "RegExport.txt" goto concat3
copy "RegExport.tmp" "RegExport.txt"
goto around3
:concat3
Copy "RegExport.txt"+"RegExport.tmp" "RegExport.txt"
:around3
del "RegExport.tmp"

reg export "HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com" "RegExport.tmp"

if exist "RegExport.txt" goto concat4
copy "RegExport.tmp" "RegExport.txt"
goto around4
:concat4
Copy "RegExport.txt"+"RegExport.tmp" "RegExport.txt"
:around4
del "RegExport.tmp"

reg export "HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com" "RegExport.tmp"

if exist "RegExport.txt" goto concat5
copy "RegExport.tmp" "RegExport.txt"
goto around5
:concat5
Copy "RegExport.txt"+"RegExport.tmp" "RegExport.txt"
:around5
del "RegExport.tmp"

reg export "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com" "RegExport.tmp"

if exist "RegExport.txt" goto concat6
copy "RegExport.tmp" "RegExport.txt"
goto around6
:concat6
Copy "RegExport.txt"+"RegExport.tmp" "RegExport.txt"
:around6
del "RegExport.tmp"
Note #2: The output that I get (Windows XP Home from a Computer Administrator account).


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

[slotdr]

Thanks for your help, I am the only user on this PC, this happened after I repaired Microsoft office 2000. When I restore a image dated 3-10-06 it 9239 but then Microsoft word doesn't work correctly so I fix it with the CD and I'm back to 7577. The reg. zip file looked complicated to add,does anyone have a reg file I can just merge in my registry

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\180solutions.com]
@=dword:00000005

圚椀渀搀漀眀猀 刀攀最椀猀琀爀礀 䔀搀椀琀漀爀 嘀攀爀猀椀漀渀 㔀⸀　　ഀ਀ഀ਀嬀䠀䬀䔀夀开唀匀䔀刀匀尀匀ⴀ㄀ⴀ㔀ⴀ㈀　尀匀伀䘀吀圀䄀刀䔀尀䴀椀挀爀漀猀漀昀琀尀圀椀渀搀漀眀猀尀䌀甀爀爀攀渀琀嘀攀爀猀椀漀渀尀䤀渀琀攀爀渀攀琀 匀攀琀琀椀渀最猀尀倀㌀倀尀䠀椀猀琀漀爀礀尀㄀㠀　猀漀氀甀琀椀漀渀猀⸀挀漀洀崀ഀ਀䀀㴀搀眀漀爀搀㨀　　　　　　　㔀ഀ਀ഀ਀

[md usa spybot fan]

I think that you may have a problem with your registry. Compare you registry with the way mine looks:
Go into Start > Run… > type "regedit" (no quotes) > then click "OK".
Expand HKEY_USERS by clicking the + (plus sign) in front of it.
Does your registry look like the attached thumbnail?


The reg. zip file looked complicated to add,does anyone have a reg file I can just merge in my registry
I don't know what reg. zip file you are referring to.

[slotdr]

This is mine, XP home

[md usa spybot fan]

It looks like you are either missing HKEY_USERS\S-1-5-19 or the user no longer can access it.

HKEY_USERS\S-1-5-19 is the user profile for SID (security identifier) S-1-5-19.

S-1-5-19 is the security identifier for LocalService:
An identity used by services that are local to the computer, have no need for extensive local access and do not need authenticated network access. Services that run as LocalService access local resources as ordinary users, and access network resources as anonymous users. As a result, a service that runs as LocalService has significantly less authority than a service that runs as LocalSystem — both locally and on the network.
I don’t what to tell you other that try to boot in safe mode and see if the HKEY_USERS\S-1-5-19 profile is visible there and if so look at the permissions. However, from the garbled listing that you posted earlier it looks like you have a corrupted registry.

[slotdr]

Thanks everyone, problem solved. After reading the last post I realized I disabled windows user mode driver framework in my services,when I put it back to automatic I get 9239 in immunization. Thanks again

[14771820]

Hello
I am facinated by this thread since I too have 9239 bad products blocked and I have often wondered where this number came from,.Presumably it comes from the down load details(or am I off course with this presumption? )
14771820:scratch:

[md usa spybot fan]

When you “Immunize”, entries are added to the system Registry. This blocks cookies from some sites, places other sites in the restricted zone and blocks the download/execution of selected ActiveX scripts.

The counts you receive during Spybot’s immunization is not the number of different items that Spybot is protecting you against it is actually the count of the items that Spybot is adding or attempting to add to the system’s Registry. Depending on the type of immunization, Spybot may add the same entries into multiple Registry keys not to just to one key. Spybot attempts to immunize in the following registry keys:
ActiveX Blocking

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility]
Cookie Blocking

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]

Restricted Zone by Domain (Site Name)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

Restricted Zone by Range (IP Address)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]


If those registry keys and/or hives are not valid on a particular operating system or a user does not have authorization to add entries to those keys, the immunization counts will vary.

Other threads about immunization:
Question about Spybot S&D accounts and Immunize
http://forums.spybot.info/showthread.php?t=1933
Immunization
http://forums.spybot.info/showthread.php?t=1988
Comparing Immunization Spybot Numbers
http://forums.spybot.info/showthread.php?t=3007

[14771820]

Thank you very much for your very instructive and useful reply.
I am only sorry that I did not join your forum some time before when I was struggling: for information.
Thank you
14771820:scratch: