suggs:
I should just say "Suffice it to say that there are defects in the immunization counting in Spybot-S&D 1.4" and leave it at that. I am truly hesitant to post the following because I am afraid that it may raise more questions than it answers about immunization counts, but here goes.
With a count of 6131 that user account is fully protected and I still don't know what causes the appearance of the 12 unprotected entries or the extra 12 entries on the accounts that appear to be fully immunized.
With the updates of 2006-11-10, Spybot is actually blocking 963 ActiveX processes, 136 cookies, adding 2348 sites to the restricted zone by domain and adding 64 sites to the restricted zone by zone (IP Address). If you add that up you get 3511 (963 + 136 + 2348 + 64 = 3511).
So were does the 6131 come from? Spybot immunizes the same entries in multiple registry hives and counts the additional entries in most by not all cases (another immunization counting anomaly).
In a Windows 2000 system immunization is done in the following registry hives:
- ActiveX Blocking
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility]
- Cookie Blocking
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
- Restricted Zone by Domain (Site Name)
Code:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
- Restricted Zone by Range (IP Address)
Code:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
Immunization counts (Windows 2000):
- ActiveX Blocking – 963 times 1 registry hive = 963
- Cookie Blocking – 136 times 3 registry hives = 408
- Restricted Site (by Domain) - 2348 times 2 registry hives = 4696
- Restricted Site (by Range) - 64 times 1 registry hive = 64 (it appears that instead counting restricted site by range entries for each registry hive they are immunized in (2) they are only counted once)
963 + 408 + 4696 + 64 = 6131
That leaves the Mystery Six (6) or on a Windows 2000 system:
- Mystery Six (6) - 6 times 2 registry hives = 12
963 + 408 + 4696 + 64 + 12 = 6143
The counts on my Windows XP system are:
- ActiveX Blocking – 963 times 1 registry hive = 963
- Cookie Blocking – 136 times 6 registry hives = 816
- Restricted Site (by Domain) - 2348 times 5 registry hives = 11740
- Restricted Site (by Range) - 64 times 1 registry hive (although it should be times 5) = 64
- Mystery Six (6) - 6 times 5 registry hives = 30
963 + 816 + 11740 + 64 + 30 = 13613
