windows.Security.InternetExplorer:Settings-Registry Key-What does this refer to?.

[eliuri]

Hello:

I am somewhat perplexed by the following finding in my Spybot 1.4 scan:


==========================


Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-746137067-764733703-1801674531-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1


==========================

I'm not sure if this refers to some security issue I need to attend to , or if it merely reflects a change I've made recently in my browser use.

I recently installed Firefox 1.5.0.6 as a browser, set it to the default browser , and then reset Internet Explorer back to the default. Under "Set Program Access and Defaults" in the Control Panel, I have: Custom: Default Web Browser: Use my Current Web Browser

Other that that , I don't know whether to allow Spybot to change this regisrty key or not. I'd rather not if there's no real security issue here.

Suggestions please?

I'm including the text of that scan. I assume that the Windows Security Center. FirewallOverride registry key item merely refrs to my using Zone Alarm insread of the built in Windows XP Firewall, which is presently disabled.


Thanks in Advance:

-Eliuri

Windows XP Professional Edition

Internet Explorer 6.0.2900.2180

Zone Alarm Security Suite 6.1.744.001 [Firewall and Antivirus]

A-Squared 2.0 Trojan Scanner

*********************************


--- Search result list ---
Windows Security Center.FirewallOverride: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0

Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-746137067-764733703-1801674531-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

[md usa spybot fan]

For the following detection:

Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-746137067-764733703-1801674531-1004\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1

See:

• Scan Result
  http://forums.spybot.info/showthread.php?t=6749

***************

For this detection:

Windows Security Center.FirewallOverride: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0

I suggest that you go into Start > Control Panel > Security Center > look at the right hand side of the window and check the settings under "Firewall" (expanding if necessary). I believe that you have overridden the protections and that you will find a button labeled "Recommendations". If you click on the "Recommendations" button I believe that you will get a window that indicates something like:

• I have a firewall that I'll monitor myself.

Uncheck that setting and let Windows Security Center monitor the ZoneAlarm firewall.