Registry settings (Spybot - Search & Destroy)

From SpybotWiki
Jump to: navigation, search

Spybot - Search & Destroy stores various information inside (and retrieves from) a systems registry, sometimes in the user part, sometimes in the global part, and sometimes from both.

This list is not complete yet.

HKLM & HKCU (Read from both locations)

HKEY_LOCAL_MACHINE\Software\Safer Networking Limited\SpybotSnD\
HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\

By default, global settings override user settings (called restrictive); where this is not the case, it will be noted below.


REG_SZ; The default value of these keys will indicate the fully qualified filename of the application when the AutoSave feature is toggled in the user interface.


REG_DWORD; boolean value to determine whether the folders set up through the Download Directories feature are to be scanned recursively. Not restrictive.


REG_SZ; the proxy address used for updating. Note that this entry is scrambled and even its existence does not inform you whether the proxy is actually used or not, for that, see Configuration.ini.


REG_DWORD; the amount of days it takes until a recovery (quarantine) item is shown greyed out to indicate its age, in days. This has a default value of 30 days. Not restrictive.


REG_SZ; The folder used to store scanning results and other application data in. By default, this is

 <$COMMONAPPDATA>\Spybot - Search & Destroy\

Please not that while we use a path template to describe this to not stick to one specific locale, the application does not support them. Not restrictive.


REG_DWORD; the width of the navigation bar at the left, in pixels. Values smaller than 10 will be fixed to the default value of 129. Not restrictive.


REG_SZ; fully qualified filename for a skin file (.ini).


REG_DWORD; may change the priority that is used by TeaTimers monitoring threads. The default priority is idle, the lowest choice available. Possible values for this setting are:

  • 0 = idle
  • 1 = lowest (aka low)
  • 2 = lower (aka below normal)
  • 3 = normal
  • 4 = higher (aka above normal)
  • 5 = highest (aka high)
  • 6 = time critical (aka realtime)

These are the same priority levels you might know from using Windows Task Manager.


REG_DWORD; boolean to show settings page again after updates. Not restrictive.


REG_SZ; the version text, used to identify an updated version as well. Not restrictive.


REG_DWORD; the delay to use before starting automated actions through /waitstart; by default this is 3 seconds. Not restrictive.


REG_DWORD; the delay to use after automation actions have taken place and before /autoclose would close the application, triggered by /waitmore to allow the user to interact. This has a default value of 10 seconds if not specified. Not restrictive.


REG_SZ; fully qualified name of a .wav file that should be played if malware has been found, and if the corresponding option has been enabled on the settings page (see also Configuration.ini). Not restrictive.


REG_SZ; fully qualified name of a .wav file that should be played when a scan has come up without finding any malware, and if the corresponding option has been enabled on the settings page (see also Configuration.ini). Not restrictive.


REG_DWORD; boolean, anything larger than 1 will indicate that the wizard has already been shown to the user.

HKCU (separate for each user)

HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\

Download directories

A subfolder containing information about every folder that should be scanned by the feature of the same name. Important in this case are just the names of the values which should represent fully qualified path names, including trailing backslashes. The type and data of these is not important.


Each page inside Spybot - Search & Destroy has a small description of what it offers at its top. These can be hidden, and whether panels are hidden or not is stored here. Each entry in this subfolder is named after the panel, is of type REG_DWORD and may be 1 for panels shown, or 0 otherwise. A few example names follow; for now experiment by turning panels on and off in the GUI to see their names appear in the registry.

  • panelHostsFileInfo
  • panelProcessListInfo
  • panelResultsInfo
  • panelSettingsMainInfo
  • panelSettingsSchedulerInfo


This subfolder contains yet again subfolders named after various dialogs used in Spybot - Search & Destroy. A few examples:

  • formLanguagePick (the wizard shown on first start)
  • formMain (the main user interface)
  • fromProgress (the window shown during scanning on system start)

Each of these subfolders contains values Left, Top, Width and Height to indicate positions and dimensions of these dialogs.


This is a subfolder containing entries regarding the settings for bug reports. Each value inside it has to be of type REG_DWORD, set to 1 to include the specified type of information in the report, or 0 otherwise. The available entries are:

  • IncludeActiveX
  • IncludeBHO
  • IncludeBrowserPages
  • IncludeProcessList
  • IncludeResults
  • IncludeServices
  • IncludeStartup
  • IncludeSysInfo
  • IncludeUninstall
  • IncludeWinsockLSPs

In custom compiles, these settings are also stored in and retrieved from Configuration.ini.

HKLM (global)

HKEY_LOCAL_MACHINE\Software\Safer Networking Limited\SpybotSnD\


REG_DWORD as boolean; can be used to have no visible tray icon for TeaTimer.