I'm still having Immunization Problems...

[Bumblebee4711]

I have problems with the IMMUNISATION too. I get the message: "Diese Aktion wird aufgrund fehlender AdministationsRechte unter Umständen nur teilweise durchgeführt. Etc. etc. . . " This warning is correct, SPYBOT does a partly immunisation.

The warning "Windows Vista - Für einige Funktionen werden Administratorrechte benötigt" does not help. I am working under/with the administration-rights, but get only "partly immunisation". The current help does not help too much either. I am missing the option under SPYBOT to get the administration-right.

I hope it will work under the new release. 19.01.2008 http://forums.spybot.info/images/smilies/sad.gif

[Bumblebee4711]

I checked this time the ENGLISH help. There it is written, how to overcome the "you need authorisation rights". It works. But the problem, that SPYBOT takes very, very long to start is still present.

[spybotsandra]

Hello,

So have you already upgraded to the new Spybot beta?
The problem with the long start is fixed there.

Best regards
Sandra
Team Spybot

[Titano]

Spybot 1.5.2 (in reality 1.5.1.19)

I have not a great problem to point out, but just an annoying issue.

It is already the second time that I download updates (since I installed the new beta) and I noticed that after the process of downloading and after having immunized, some files are still Unprotected (being 33 the first time and 3 the second).

In conclusion, every week, in correspondence of update-day, I have Immunize--> Undo --> Immunize again and sometime Immunize--> Deselect all-->Undo--> Immunize--> Select all--> Immunize again (maybe it is not the correct procedure but to the end I get the complete protection).

Using Spybot 1.4 (for years) I never had this issue.

Regards

Titano
__________________________________

Online Armor Beta Tester

[poolsharkzz]

md usa spybot fan & PepiMK,

Hello again to all!

Sorry it's been a week, been very busy!

Okay...

I have downloaded System Internal's Regmon, and made a few reports for your review, which are attached along with Free Window Registry Repair 1.2's Report.

Regmon's Reports are broken down as such:

Regmon1: Report was created right before I ran Free Window Registry Repair 1.2

Regmon2: Report was created right after I cleaned registry with Free Window Registry Repair 1.2

Regmon Final: Report was created right after restarting my system, which I did right after I cleaned registry and created Regmon2 Report.

Free Window Registry Repair 1.2's Reports are broken down by S-1-5-18, S-1-5-20, and S-1-5-21.

The S-1-5-20_Classes and S-1-5-21-3305080096-3069123988-1010101338-1006_Classes Items: They still show up after restarting and still do not Immunize.

This is a bit over my head, please comment and make suggestions.

If you need any additional information, please request.

Thanks again!

OddTodd


PS. I am having problems uploading the Regmon Reports. I think they are too big - any suggestions?

Could I directly e-mail them to you?

Please advise.

[md usa spybot fan]

OddTodd:

We have established that if certain registry sub-keys are present on your system where they should not normally be (namely the S-1-5-20_Classes and S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx_Classes registry hives) that Spybot to attempts to immunize in those keys. Patrick Kolla is now aware of that and may eventually find and fix the problem.

To overcome that problem from a Spybot immunization standpoint, just stop attempting to immunize those registry hives.

Other than that, you have not mentioned any other adverse affects the presents of those sub-keys are causing, so it may be wise to just well enough alone.
_______________

On the other hand, if you intend on continuing to try and find what software is recreating the registry keys that you claim you have deleted, there a few things that you should understand. I recommended the possibility of using Regmon because it monitors and displays Registry activity. In order to do that you must run the program while the registry is being changed, not before or after changes as you indicate that the Regmon reports you took so far represent. In other words you must run Regmon during the activity that you are interested in monitoring i.e. when the changes are occurring.

Also, if you are going to continue to use Regmon, I suggest that you the read the "Filtering Output" section in the REGMON Help File (REGMON.HLP), so that you can attempt to limit the output to just the registry keys that you are interested in. In addition, if you are correct that the registry key are being recreated at system startup, it is most likely that you will have to do a "Log Boot" to find what is doing it, so I suggest that you read the "Monitoring Boot-Time Registry Access (Windows NT/2K only)" section of the REGMON Help File also. It should be noted that when I used previous versions of Regmon, filtering did not appear work while doing a "Log Boot".

What you are looking for in the Regmon output is the program (Process) that is doing a Create Key (Request) on the sub-keys (Path) that you indicate are being recreated.

Good luck