I'm still having Immunization Problems...

[poolsharkzz]

Hello to all,

I am still having Immunization Problems with the new Spybot 1.5.2.19 RC1.

I wrote about this problem back on 12-22-07, md usa spybot fan replyed, but no real solution found.

Does anyone have any ideas?

Please advise,

Odd Todd

[honda12]

Hi OddTodd,

Have you tried immunizing then pressing the undo button - and then re-immunizing?

honda

[poolsharkzz]

honda12,

Thanks for responding, that was really quick...

Yes, I just followed your instructions, but it didn't work.

I want to get to the bottom of this, if possible!

Did you get the chance to review my past thread from 12-22-07?

OddTodd

[honda12]

Hi OddTodd,

I see you are running spyware-blaster - Try disabling it's protection and then try to immunize spybot.

I believe there has been cases in the past where some programs 'undo' each others protection (non-intentionally)

[honda12]

Also I see you ran Free Windows Registry Repair - I recommend you use a more reputable cleaner (for example ccleaner) because there have been reports that Free Windows Registry Repair gives the user huge amounts of registry entries to be cleaned. This registry cleaner, I would class as over-vigorous in its cleaning, and therefore increasing it's risk of you deleting an important entry.

Registry cleaning should be done in a careful manner

Always remember to backup your registry before cleaning

[md usa spybot fan]

OddTodd:

Solution from your other thread:

I don't know how the problem started but it appears that the presents of the subkey in the registry hive stimulates Spybot to immunize the key.

If you delete the subkeys of the HKEY_USERS\S-1-5-20_Classes key the problem disappears and Spybot no longer attempts to immunize in that key.

I don't know what to tell you about the HKEY_USERS\S-1-5-21_Classes key because I don't have one and don't know how it is used.

[poolsharkzz]

Guys - Please listen....

I am sorry, but I think you guys are missing what I am trying to ask/tell you....

1) I have done every trick mentioned and not mentioned in these forums to try to solve this - nothing works.

2.) Many times - with all the newer (1.5) versions of Spybot - I have deleted the keys responsible for the non-Immunization (S-1-5-20 & S-1-5-21).

3) What is happening here is that after I have deleted these registry keys and then I either restart my system or even just reboot - them registry keys keep returning!

4.) Something - it's either a program or a service or a tweak I did or a unknown or unneeded user profile or something new or ???????? is re-creating those registry keys each and every time after I have deleted them...

or could it be possibly be something that still needs fixing with Spybot???

I have not deleted these keys manually using the built-in registry editor - I have always used Free Windows Registry Repair 1.2 - which seems to be the only program to find these unneccessary keys.

5.) My question is this:

What is creating/re-creating these registry keys and how do I stop it from happening?

I really appreciate all your help. I am just a little bit frustrated about all of this - I am not angry - I just want to figure out the root cause and solve the problem.


md usa spybot fan -

Yes, you are completely correct, deleting the subkeys of HKEY_USERS\S-1-5-20_Classes key fixes the problem - but only for the S-1-5-20 "Immunization Items" in Spybot and thats only until I either restart my rig or reboot - this move is only a temp band-aid - I need to learn the root cause....

Not to mention HKEY_USERS\S-1-5-21_Classes key, which you said you had no clue...


honda12 -

Yes, I use Free Windows Registry Repair, I have had no problems with using it to date (as yet) and I agree, it is very much more of an "over-vigorous" registry cleaner, but that's what I use it for and I always create a backup file - as well as a complete registry backup.

I use CCleaner as well - great program but it doesn't find the S-1-5-20 and S-1-5-21 "problem keys".

I am stuck in the mud - any ideas??

Where do we go from here??

[md usa spybot fan]

md usa spybot fan -

...

Not to mention HKEY_USERS\S-1-5-21_Classes key, which you said you had no clue...

What I said was that I don't have the HKEY_USERS\S-1-5-21_Classes key.

User's have HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxx_Classes key but I don't know how a HKEY_USERS\S-1-5-21_Classes gets geterated or is used.

_______________

You could us a registry monitor program such as Sysinternals Regmon to attempt to determine what is recreating the registry entries after you delete them.

Sysinternals:

• Windows Sysinternals Documentation, downloads and additional resources
  http://technet.microsoft.com/en-us/s...s/default.aspx

[PepiMK]

Hmmm... in some something_Classes keys, I've seen parts of the standard immunization path (\Software\Microsoft\Windows\CurrentVersion\........). These do not belong there (often contain just empty keys), but can fool the immunization to believe this is a regular user key (and not the classes key).

Haven't found out yet if that was a very early Spybot beta doing this, or any other software capable of doing the same kind of immunization, or something completely different...

[poolsharkzz]

md usa spybot fan -

All right, now we are getting somewhere!

I will be downloading Sysinternals Regmon sometime in the next few days, been mega-swamped but this is high on the priority list.

What I will do is compile and attach reports with my next post for your and PepiMK's review - maybe we can get to the bottom of all this?


Quick question - is anybody else still having "Immunization problems"?

Thanks,

OddTodd