Spybot Shows IE Registry error

[lfletch46]

This is the spyware error:

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1

I click on Spybot fix and the error just keeps coming back after reboot.
Can anyone help me fix this?
Lynne

[Zenobia]

Hello.Please see this post:
http://forums.spybot.info/showpost.php?p=39911&postcount=9

[lfletch46]

I've tried all that. Thanks.
Didn't work.
L
p.s. I was not shouting. I simply copied the SpyBot error message as is....some of it was in caps and some was not.

[Zenobia]

The post I showed you was in response to another person,it did not mean you yourself were shouting.

[Zenobia]

Okay,I set HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe
to 0,and had Spybot fix it,and it did change it to 1,so I'm not sure why it was unable to change yours.

Do you have Windows XP with Service Pack 2?

And do you know if that was set to 0 in your registry for any specific reason?
Such as this,for example:
http://support.microsoft.com/kb/883969/en-us?spid=2514&sid=256

Here's some more info about that detection:
http://msdn.microsoft.com/security/productinfo/XPSP2/securebrowsing/locallockdown.aspx

[lfletch46]

Thanks.
Yes, I have WinXP Pro with SP2.
I don't have any idea how the registry got changed or why SpyBot all of a sudden picked it up.

I revised the registry to DWORD with setting of 1 and Spybot no longer gives error.

No problems seem to exist with this registry change so I will not worry about it any longer.

Thanks for the several replies and links !!!!!
Have a great week, L

[Zenobia]

Glad you got it sorted out.Thanks,you have a great week,too. :)

[JeffW]

I have a similar problem. I run Win XP HE SP2, which is kept fully updated. Since the recent Spybot S&D IE security update, each day when I run a Spybot S&D scan it finds a problem:

Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1708537768-2077806209-839522115-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1

If I allow Spybot S&D to fix it, the problem is back the next day or the next time I reboot. I have followed a previous thread on this topic: http://forums.spybot.info/showthread.php?t=6749. Neither of the top two IE security boxes are ticked. I tried ticking them/apply/etc then going back in and unticking them. I thought this had cracked it but a couple of days later the problem was back. I know enough to know I know nothing about registry! I had a look at the relevant key and the entry is:

(Default) REG_SZ Blank
explorer.exe REG_DWORD 0x00000001(1)
iexplorer.exe REG_SZ Blank
msimn.exe REG_DWORD 0x00000001(1)
wmplayer.exe REG_DWORD 0x00000001(1)

Now I have looked at this entry before and after Spybot S&D fixes the problem and it does not change.

Reading this thread, should I modify iexplorer.exe to REG_DWORD with a value 1?

[md usa spybot fan]

JeffW:

There appears to be something very quirky with the settings of FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe.

See this post by Viral (http://forums.spybot.info/member.php?u=10921) in post:
IE oddity
http://forums.spybot.info/showthread.php?p=39830#post39830
In this thread:
Scan Result
http://forums.spybot.info/showthread.php?t=6749
They claim that by checking and applying the first three (3) items under Security and then un-checking them and applying again solved the problem.

In other words, try the following:
Go into Internet Explorer > Tools > Internet Options > Advanced tab > scroll down to Security (near the bottom).
Check these three (3) items:
Allow active content from CDs to run on My Computer
Allow active content to run in files on My Computer
Allow software to run or install even if the signature is invalid
Then click "OK" on the bottom of the Internet Options dialog window.
Go back into Internet Explorer > Tools > Internet Options > Advanced tab > scroll down to Security (near the bottom).
Uncheck these three (3) items:
Allow active content from CDs to run on My Computer
Allow active content to run in files on My Computer
Allow software to run or install even if the signature is invalid
Then click "OK" on the bottom of the Internet Options dialog window.

[JeffW]

Thanks for the suggestion. Tried the 'checking and applying the first three (3) items under Security and then un-checking them and applying again solved the problem'.

Unfortunately I still got the same problem this morning.

I had Sptbot 'fix' the problem. I then checked the relevant Registry entries for type and value. They were as my original post, above. So I immediately ran Spybot again, without doing anything else. The same problem was reported, so either Spybot is confirming that it has fixed the problem when it has not done so or something is immediately changing the settings.

[JeffW]

Rereading my above post, I realised that I might have given the wrong impression. Checking and applying the first three (3) items under Security and then un-checking them, etc. did not solved my problem.

Also if I have Spybot 'fix' the problem and rerun Spybot the problem is back, without doing a reboot. So either Spybot is confirming that it has fixed the problem when it has not done so or something is immediately changing the settings.

[SteveS]

I was having the same problems. I had clicked to fix the problem. I was told that the entry would be deleted and asked if that was OK. I said yes. Later, when I went to the registry, I saw that the iexplore.exe type was "REG_SZ" and that the data column was blank. I highlighted it, right clicked and deleted it. I then moved the cursor over any value in the type column and right clicked. It shows "NEW" and an arrow on the right. Moving the cursor right opens another drop down menu that includes "DWORD Value". Click on that. That inserts a new item on the list. Name it "iexplore.exe" then right click on it. Highlight and click "Modify" (the top entry). Change the value from 0 to 1 and make sure that the base is hexidecimal, not decimal. I haven't had a problem since doing that.

[JeffW]

Many thanks and sorry for the belated reply. I thought that would be the answer but did not have the courage of my own convictions, as I am not confident editing Registry. Followed your advice and the problem has been solved. Thanks again.