Spybot 1.6 locking user registry hives

[PepiMK]

Anyone else tested the new release?

Got an advcheck.dll and a tools.dll beta update coming tomorrow as well - a week after that, probably a beta 1.6.1 installation package

[jjjdavidson]

I just downloaded and briefly tested SpybotSD.exe 1.6.1.35 on two Windows XP Pro machines. Things are looking up!

On the machine where I couldn't get user hives to load, 1.6.1.35 still doesn't load them by default, but your new /userhives parameter does cause them to load. (I'd still like to know why /nouserhives is apparently the default on this machine and one other. Could it have anything to do with the XP Remote Desktop feature?)

On both test machines, the user hives still stay loaded after 1.6.1.35 is shut down normally, as they did with 1.6.1.33. Since you now use the SID key name, I can switch users without a problem, but I don't know if the open hives tie up any memory or other system resources.

[PepiMK]

Yes, the Remote Desktop feature might be the reason. User hives do not get loaded if WTS (Windows Terminal Services) is detected to be running, and the remote desktop seems to be just that (I even tested WTS with the Remote Desktop feature because it was easier than doing so on a real server).

As for resources, MS says that XP etc. do not have a registry size limit any more. But I already wrote about that

Think I found a possible reason for the later one. We still have two kind of user registry keys - SIDs can only be used for hives of the current system. Hives from inactive installations would still have the old name, and unloading had problems seeing the difference and deciding there. Going to finish that testing tomorrow

[MrGreg]

Hi Everyone,

I just tested 1.6.1.35 on my system. I am the same as jjjdavidson in that the other user hives are still not unloading after normal termination of Spybot.

[jjjdavidson]

User hives do not get loaded if WTS (Windows Terminal Services) is detected to be running, and the remote desktop seems to be just that....

Is WTS the Terminal Services service? If so, it runs all the time on all of my XP Pro systems, the two that always load the user hives and the two that don't. The description under Services.msc says, "The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server" (italics mine), so I guess it's supposed to be.

I have used Remote Desktop on the two problem systems, but not for several months (and dozens of reboots). So if RDP is the problem, then using RDP once apparently makes a permanent change in system settings that Spybot is detecting. Am I off base here?

(By the way, since 1.6.1 seems to beautifully resolve MrGreg's original problem, should we swap this discussion back to my more specific thread?)

[PepiMK]

Made a 1.6.1.36.

WTS is "Windows Teminal Services", yes. For detecting it, WTSEnumerateSessions is used to determine the count of sessions. If the Remote Desktop / Assistance / Terminal Server is active, there are at least two sessions.

[MrGreg]

Hi PepiMK,

The link to 1.6.1.36 is not working. There are only links to 1.6.1.33 and 1.6.1.35.

[spinout]

Hi PepiMK,

The link to 1.6.1.36 is not working. There are only links to 1.6.1.33 and 1.6.1.35.

You really think?

5 second...

http://www.spybotupdates.biz/files/b...e-1.6.1.36.zip

[PepiMK]

Hehe, true, but .36s new dialogs are not yet well integrated with the localization, and I have a .37 with some special PE booting improvements nearly ready, so I disabled the download page entry

[spinout]

Hehe, true, but .36s new dialogs are not yet well integrated with the localization, and I have a .37 with some special PE booting improvements nearly ready, so I disabled the download page entry

SpybotSD 1.6.1.36 russian localization:
Attachment 2632