Registry settings (Spybot - Search & Destroy)

Spybot - Search & Destroy stores various information inside (and retrieves from) a systems registry, sometimes in the user part, sometimes in the global part, and sometimes from both.

This list is not complete yet.

HKLM & HKCU (Read from both locations)

HKEY_LOCAL_MACHINE\Software\Safer Networking Limited\SpybotSnD\
HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\

By default, global settings override user settings (called restrictive); where this is not the case, it will be noted below.

(default)

REG_SZ; The default value of these keys will indicate the fully qualified filename of the application when the AutoSave feature is toggled in the user interface.

CheckDownloadSubs

REG_DWORD; boolean value to determine whether the folders set up through the Download Directories feature are to be scanned recursively. Not restrictive.

ProxyAddress

REG_SZ; the proxy address used for updating. Note that this entry is scrambled and even its existence does not inform you whether the proxy is actually used or not, for that, see Configuration.ini.

RecoveryAged

REG_DWORD; the amount of days it takes until a recovery (quarantine) item is shown greyed out to indicate its age, in days. This has a default value of 30 days. Not restrictive.

ResultsDir

REG_SZ; The folder used to store scanning results and other application data in. By default, this is

 <$COMMONAPPDATA>\Spybot - Search & Destroy\

Please not that while we use a path template to describe this to not stick to one specific locale, the application does not support them. Not restrictive.

ShortcutbarWidth

REG_DWORD; the width of the navigation bar at the left, in pixels. Values smaller than 10 will be fixed to the default value of 129. Not restrictive.

Skins

REG_SZ; fully qualified filename for a skin file (.ini).

Updated

REG_DWORD; boolean to show settings page again after updates. Not restrictive.

Version

REG_SZ; the version text, used to identify an updated version as well. Not restrictive.

WaitStartDelay

REG_DWORD; the delay to use before starting automated actions through /waitstart; by default this is 3 seconds. Not restrictive.

WaitMoreDelay

REG_DWORD; the delay to use after automation actions have taken place and before /autoclose would close the application, triggered by /waitmore to allow the user to interact. This has a default value of 10 seconds if not specified. Not restrictive.

WaveAlertFile

REG_SZ; fully qualified name of a .wav file that should be played if malware has been found, and if the corresponding option has been enabled on the settings page (see also Configuration.ini). Not restrictive.

WaveCleanSoundFile

REG_SZ; fully qualified name of a .wav file that should be played when a scan has come up without finding any malware, and if the corresponding option has been enabled on the settings page (see also Configuration.ini). Not restrictive.

WizardRun

REG_DWORD; boolean, anything larger than 1 will indicate that the wizard has already been shown to the user.

HKCU (separate for each user)

HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\

Download directories

A subfolder containing information about every folder that should be scanned by the feature of the same name. Important in this case are just the names of the values which should represent fully qualified path names, including trailing backslashes. The type and data of these is not important.

InfoPanels

Each page inside Spybot - Search & Destroy has a small description of what it offers at its top. These can be hidden, and whether panels are hidden or not is stored here. Each entry in this subfolder is named after the panel, is of type REG_DWORD and may be 1 for panels shown, or 0 otherwise. A few example names follow; for now experiment by turning panels on and off in the GUI to see their names appear in the registry.

• panelHostsFileInfo
• panelProcessListInfo
• panelResultsInfo
• panelSettingsMainInfo
• panelSettingsSchedulerInfo

UI\Forms

This subfolder contains yet again subfolders named after various dialogs used in Spybot - Search & Destroy. A few examples:

• formLanguagePick (the wizard shown on first start)
• formMain (the main user interface)
• fromProgress (the window shown during scanning on system start)

Each of these subfolders contains values Left, Top, Width and Height to indicate positions and dimensions of these dialogs.

ViewReportConfig

This is a subfolder containing entries regarding the settings for bug reports. Each value inside it has to be of type REG_DWORD, set to 1 to include the specified type of information in the report, or 0 otherwise. The available entries are:

• IncludeActiveX
• IncludeBHO
• IncludeBrowserPages
• IncludeProcessList
• IncludeResults
• IncludeServices
• IncludeStartup
• IncludeSysInfo
• IncludeUninstall
• IncludeWinsockLSPs

In custom compiles, these settings are also stored in and retrieved from Configuration.ini.