Page 1 of 2 12 LastLast
Results 1 to 10 of 13

Thread: Microsoft.Windows.Security.InternetExplorer - what do these entries typically imply?

  1. 2009-01-12, 09:18 #1
    el nemto
    el nemto is offline
    Member
    Join Date
    May 2006
    Posts
    30

    Default Microsoft.Windows.Security.InternetExplorer - what do these entries typically imply?

    Just did a fresh scan on my system for the first time in a few months, and for the first time ever with 1.6 (on this PC) and one of these entries popped up. Are they typically security settings in IE, and if so, what does removing the entry do, restore the option to the default setting?

    note: there is no malware/viruses/trojans on this PC, and this lone entry was the only one detected

    I don't have any specific information aside from what's in the Spybot statistics, which also curiously said it was last fixed on 12/31/1969 for some reason.

    EDIT: Also, since removing it with Spybot it seems like I'm seeing a lot more fully loaded "Internet Explorer cannot display the webpage" errors in the boxes/frames where ads are blocked by my HOSTS file. Before they would mainly would just be blank white space.
    Last edited by el nemto; 2009-01-12 at 09:24.
    Reply With Quote Reply With Quote
  2. 2009-01-12, 15:48 #2
    md usa spybot fan
    md usa spybot fan is offline
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    el nemto:

    Although the "Last fixed" date in Spybot's Statistics seems to be incorrect you should have a corresponding "Last found" date that is correct. From that date please find and post the Checks.yymmdd-hhmm.txt or Fixes.yymmdd-hhmm.txt log from when you received and fixed the detection in question.

    Getting an answer is one thing, learning is another.

    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
    Reply With Quote Reply With Quote
  3. 2009-01-12, 19:30 #3
    el nemto
    el nemto is offline
    Member
    Join Date
    May 2006
    Posts
    30

    Default

    Where can I find these logs?

    EDIT: Also now this is getting somewhat annoying. When I navigate to a page with blocked ad framed, each frame is now becoming it's own entry in the back/forward history so I have to hit back multiple times to move to the previous page. This never happened before.
    Last edited by el nemto; 2009-01-12 at 19:45.
    Reply With Quote Reply With Quote
  4. 2009-01-13, 00:35 #4
    md usa spybot fan
    md usa spybot fan is offline
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    el nemto:

    By default here are two Checks.yymmdd-hhmm.txt log files produced during a scan. The second Checks.yymmdd-hhmm.txt file has the details of what the scan found. A Fixes.yymmdd-hhmm.txt log file is produced if you fix or attempt to fix something.

    There are two methods to copy and post that information from previous scans:
    • Method 1:
      • Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Look for the Checks.yymmdd-hhmm.txt or Fixes.yymmdd-hhmm.txt log file that contains the detection that you would like help with. Open it. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
    • Method 2
      • The Checks.yymmdd-hhmm.txt and Fixes.yymmdd-hhmm.txt files are stored in the following folders:
        • Windows 95 or 98:
          C:\Windows\Application Data\Spybot - Search & Destroy\Logs
        • Windows ME:
          C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
        • Windows NT, 2000 or XP:
          C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
        • Windows Vista:
          C:\ProgramData\Spybot - Search & Destroy\Logs
      • Using Windows Explorer, navigate to the correct Checks.yymmdd-hhmm.txt or Fixes.yymmdd-hhmm.txt log file. Double click on it and it should open with Notepad. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.

    Getting an answer is one thing, learning is another.

    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
    Reply With Quote Reply With Quote
  5. 2009-01-13, 01:41 #5
    el nemto
    el nemto is offline
    Member
    Join Date
    May 2006
    Posts
    30

    Default

    Thanks,

    Here are the log files:

    --- Report generated: 2009-01-12 03:09 ---

    Hint of the Day: Click the bar at the right of this to see more information! ()


    Microsoft.Windows.Security.InternetExplorer: [SBI $A3433CBF] Settings (Registry change, nothing done)
    HKEY_USERS\S-1-5-21-1060284298-1993962763-854245398-1003\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe


    --- Spybot - Search & Destroy version: 1.6.0 (build: 20080707) ---

    2008-07-07 blindman.exe (1.0.0.8)
    2008-07-07 SDMain.exe (1.0.0.6)
    2008-07-07 SDShred.exe (1.0.2.3)
    2008-07-07 SDUpdate.exe (1.6.0.8)
    2008-07-07 SDWinSec.exe (1.0.0.12)
    2008-07-07 SpybotSD.exe (1.6.0.30)
    2008-09-16 TeaTimer.exe (1.6.3.25)
    2009-01-11 unins000.exe (51.49.0.0)
    2008-07-07 Update.exe (1.6.0.7)
    2008-10-22 advcheck.dll (1.6.2.13)
    2007-04-02 aports.dll (2.1.0.0)
    2008-06-14 DelZip179.dll (1.79.11.1)
    2008-09-15 SDHelper.dll (1.6.2.14)
    2008-06-19 sqlite3.dll
    2008-07-07 Tools.dll (2.1.5.7)
    2008-11-04 Includes\Adware.sbi (*)
    2008-12-29 Includes\AdwareC.sbi (*)
    2008-06-03 Includes\Cookies.sbi (*)
    2009-01-06 Includes\Dialer.sbi (*)
    2009-01-06 Includes\DialerC.sbi (*)
    2008-07-23 Includes\HeavyDuty.sbi (*)
    2008-11-18 Includes\Hijackers.sbi (*)
    2009-01-05 Includes\HijackersC.sbi (*)
    2008-12-09 Includes\Keyloggers.sbi (*)
    2008-12-22 Includes\KeyloggersC.sbi (*)
    2008-11-18 Includes\Malware.sbi (*)
    2009-01-06 Includes\MalwareC.sbi (*)
    2008-12-16 Includes\PUPS.sbi (*)
    2009-01-06 Includes\PUPSC.sbi (*)
    2007-11-07 Includes\Revision.sbi (*)
    2008-06-18 Includes\Security.sbi (*)
    2008-12-29 Includes\SecurityC.sbi (*)
    2008-06-03 Includes\Spybots.sbi (*)
    2008-06-03 Includes\SpybotsC.sbi (*)
    2008-12-10 Includes\Spyware.sbi (*)
    2009-01-06 Includes\SpywareC.sbi (*)
    2008-06-03 Includes\Tracks.uti
    2009-01-05 Includes\Trojans.sbi (*)
    2009-01-06 Includes\TrojansC.sbi (*)
    2008-03-04 Plugins\Chai.dll
    2008-03-05 Plugins\Fennel.dll
    2008-02-26 Plugins\Mate.dll
    2007-12-24 Plugins\TCPIPAddress.dll
    --- Report generated: 2009-01-12 03:11 ---

    Hint of the Day: Click the bar at the right of this to see more information! ()


    Microsoft.Windows.Security.InternetExplorer: [SBI $A3433CBF] Settings (Registry change, fixed)
    HKEY_USERS\S-1-5-21-1060284298-1993962763-854245398-1003\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe


    --- Spybot - Search & Destroy version: 1.6.0 (build: 20080707) ---

    2008-07-07 blindman.exe (1.0.0.8)
    2008-07-07 SDMain.exe (1.0.0.6)
    2008-07-07 SDShred.exe (1.0.2.3)
    2008-07-07 SDUpdate.exe (1.6.0.8)
    2008-07-07 SDWinSec.exe (1.0.0.12)
    2008-07-07 SpybotSD.exe (1.6.0.30)
    2008-09-16 TeaTimer.exe (1.6.3.25)
    2009-01-11 unins000.exe (51.49.0.0)
    2008-07-07 Update.exe (1.6.0.7)
    2008-10-22 advcheck.dll (1.6.2.13)
    2007-04-02 aports.dll (2.1.0.0)
    2008-06-14 DelZip179.dll (1.79.11.1)
    2008-09-15 SDHelper.dll (1.6.2.14)
    2008-06-19 sqlite3.dll
    2008-07-07 Tools.dll (2.1.5.7)
    2008-11-04 Includes\Adware.sbi (*)
    2008-12-29 Includes\AdwareC.sbi (*)
    2008-06-03 Includes\Cookies.sbi (*)
    2009-01-06 Includes\Dialer.sbi (*)
    2009-01-06 Includes\DialerC.sbi (*)
    2008-07-23 Includes\HeavyDuty.sbi (*)
    2008-11-18 Includes\Hijackers.sbi (*)
    2009-01-05 Includes\HijackersC.sbi (*)
    2008-12-09 Includes\Keyloggers.sbi (*)
    2008-12-22 Includes\KeyloggersC.sbi (*)
    2008-11-18 Includes\Malware.sbi (*)
    2009-01-06 Includes\MalwareC.sbi (*)
    2008-12-16 Includes\PUPS.sbi (*)
    2009-01-06 Includes\PUPSC.sbi (*)
    2007-11-07 Includes\Revision.sbi (*)
    2008-06-18 Includes\Security.sbi (*)
    2008-12-29 Includes\SecurityC.sbi (*)
    2008-06-03 Includes\Spybots.sbi (*)
    2008-06-03 Includes\SpybotsC.sbi (*)
    2008-12-10 Includes\Spyware.sbi (*)
    2009-01-06 Includes\SpywareC.sbi (*)
    2008-06-03 Includes\Tracks.uti
    2009-01-05 Includes\Trojans.sbi (*)
    2009-01-06 Includes\TrojansC.sbi (*)
    2008-03-04 Plugins\Chai.dll
    2008-03-05 Plugins\Fennel.dll
    2008-02-26 Plugins\Mate.dll
    2007-12-24 Plugins\TCPIPAddress.dll

    I'm using IE7, and WinXP SP3
    Last edited by el nemto; 2009-01-13 at 01:56. Reason: added IE/Windows info
    Reply With Quote Reply With Quote
  6. 2009-01-13, 05:54 #6
    md usa spybot fan
    md usa spybot fan is offline
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    el nemto:

    The default setting for the following registry entry became "iexplore.exe"=dword:00000001 with the introduction of Windows XP Service Pack 2.

    Code:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
"iexplore.exe"=dword:00000001
    Spybot's detection indicates that the registry entry not equal to dword:00000001. In other words the value not set to the default value.

    There is an explanation (relatively technical) of FEATURE_LOCALMACHINE_LOCKDOWN in the following:

    The bottom line is, if you did not intentionally change the default for some reason such as the following, the detection should be fixed:

    Getting an answer is one thing, learning is another.

    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
    Reply With Quote Reply With Quote
  7. 2009-01-13, 06:37 #7
    el nemto
    el nemto is offline
    Member
    Join Date
    May 2006
    Posts
    30

    Default

    The first link you provided gave me a 404. I didn't make any manual changes to that registry key. Is it connected to a setting anywhere in IE7's options or security settings?

    Also, do you have any idea why it would cause the new, annoying ad frame behavior?
    Reply With Quote Reply With Quote
  8. 2009-01-13, 07:26 #8
    md usa spybot fan
    md usa spybot fan is offline
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    el nemto:

    Quote Originally Posted by el nemto View Post
    ... I didn't make any manual changes to that registry key. ...
    Are you running Windows XP SP2 or above? If so the registry entry would have been change from "iexplore.exe"=dword:00000000 to "iexplore.exe"=dword:00000001 when you upgraded to XP SP2.

    There is some information on FEATURE_LOCALMACHINE_LOCKDOWN here:
    • AutoShapes that were added to an HTML or an MHTML file in a Microsoft Office program do not appear when you open the file in Internet Explorer after you install Windows XP SP2
      http://support.microsoft.com/kb/883969


    Quote Originally Posted by el nemto View Post
    ... Also, do you have any idea why it would cause the new, annoying ad frame behavior?
    To see if "SDHelper" is causing the behavior, try disabling "SDHelper". To do that:
    • Go into Spybot > Mode > Advanced Mode > Tools > Resident. Under the heading "Resident protection status" you will see:
      • Resident "SDHelper" (Internet Explorer bad download blocker) active.
      • Resident "TeaTimer" (Protection of over-all system settings) active.
    • Uncheck:
      • Resident "SDHelper" (Internet Explorer bad download blocker) active.
    • Exit Internet Explorer and restart it.

    Getting an answer is one thing, learning is another.

    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
    Reply With Quote Reply With Quote
  9. 2009-01-13, 07:29 #9
    el nemto
    el nemto is offline
    Member
    Join Date
    May 2006
    Posts
    30

    Default

    I'm running WinXP SP3, but I've done Spybot scans (not in 1.6 though) since installing SP2 and SP3 and never had that entry before.

    Also I don't use the Spybot BHO or TeaTimer, so that can't be it.
    Reply With Quote Reply With Quote
  10. 2009-01-13, 07:58 #10
    md usa spybot fan
    md usa spybot fan is offline
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    el nemto:

    The FEATURE_LOCALMACHINE_LOCKDOWN detection has been in Spybot since at least August 2006 (Spybot 1.4 at that time). See:

    Getting an answer is one thing, learning is another.

    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules