Suspicious Registry Entries

Mark Fuller · Jul 3, 2005

Hi I have hundreds of malicious looking entries in my
registry and was hoping someone could let me know if
these are protective or dangerous ,They are in

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current
Version\Internet Settings\ZoneMaps\Domains

Theres really to many to list and ive never heard of any
of the sites listed,they all look like malware related
sites (CoolWeb,PornSites Etc..)

I have Spybot,MS Antispy,Spyware Guard & Spyware Blaster
and i at first thought maybe they are being blocked but i
tested it by trying a couple of the site names and the
ones i tried all open fine

Heres some of the entries if i need to delete these is
there a way i can delete them all or can i just delete
the domains folder as there is hundreds of entries in
there which i havn't added or even heard of most of the
sites listed.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\008i.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\008k.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\00hq.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\0190-dialers.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\02pmnzy5eo29bfk4.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\07ic5do2myz3vzpk.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\08nigbmwk43i01y6.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\093qpeuqpmz6ebfa.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\0calories.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\0cj.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1-domains-
registrations.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1-se.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\100gal.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\100sexlinks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\101lottery.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\123expressview.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\123found.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\123keno.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\139mm.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\139mm.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\143f*ck.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\17-plus.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\171203.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\180solutions.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1gb.ru]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1gb.ru\people]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1se.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1sexparty.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1stfind.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\1stpagehere.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\2020search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\20x2p.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\24teen.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\2ndpower.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\30search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\31234.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\34f.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\34yo.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\356563.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\36site.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\39-93.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\4-counter.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\4corn.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\4pokertips.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\53ia49772x7r16ks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\5hvx2m8sixttkn8a.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\600pics.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\69teenage.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\75tz.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\777search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\777top.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\7adpower.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\7search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\888net.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\8ad.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\99livecam.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\a2zlinks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aamhi.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aavc.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\abcsearch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\about-blank.biz]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\about-blank.ws]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aboutclicker.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\abrp.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\absolutdialer.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\absolutdialer.cz]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\accessthefuture.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\accipiter.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\acculoader.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ace-webmaster.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\acemedic.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\achea.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\acjp.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\actionbreastcancer.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\activexupdate.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ad25.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ad45.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ad77.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ad86.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adamsupportgroup.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adasearch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adbot.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adclick.de]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\addictivetechnologies.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adipics.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\adoptawaitingchild.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adpowerzone.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adrevolver.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adsag.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adspics.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adsrve.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adult-engine-
search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adult-erotic-
guide.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adult-friends-
finder.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adult-host.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adult-
host.org\sexycat]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adult-personal.us]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adultden.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\adulterotica4free.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adulthyperlinks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adultlinksco.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\adulttds.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\advnt01.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\africaspromise.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\afterlifetelegrams.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\agentstudio.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aifind.cc]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aifind.info]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\akril.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\alcatel.ws]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aleateia.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\alfa-search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\alfreethought.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\all-dating-
secrets.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\all-inet.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\allabtcars.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\allabtjeeps.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\allcybersearch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\allcybersearch.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\allhyperlinks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\allinternetbusiness.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\allneedsearch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\allsearch.ws]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\alltheweb.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\almarvideos.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\amandamountains.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\amateurliveshow.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\american-teens.net]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\american-
teens.net\hot-cartoon-sex.anime]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\amigeek.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\amisbusiness.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\amisexyornot.co.uk]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\analmovi.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\anarchylolita.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\anarchyporn.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\anin.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\annaromeo.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\antrocity.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\anything4health.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\approvedlinks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\apsua.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aregay.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\arheo.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\arizonaweb.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\armitageinn.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\aroundweb.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\art-func.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\art-xxx.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\artachnid.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ashenvale.xu.pl]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\asiangirls.ss.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\asiankingkong.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\askgates.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ass-gals.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\asuid.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\atdmt.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\athenrye.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\audioseek.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\auto-parts.ws]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\autosearch.cc]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\avian-ads.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\awebfind.biz]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ayakawamura.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ayumitaniguchi.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\b00gle.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\babenet.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\babenet.com\r]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\babeweb.de]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\baccarat.md]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bad-credits.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bad-url.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\badboss.tv]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bankruptcy-
police.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bannedhost.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\barbudafarms.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\barnandfence.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\barnetshenkinbridge.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\batsearch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\baygraphicsllc.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bb-search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bbbsearch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bedhome.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bediadance.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\begin2search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bellabasketsfl.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bernaolatwin.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\best-counter.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\best-hardpics.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\best-offers-for-
you.ws]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\best-search.info]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\best-
searchengine.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\best-winning-
casino.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestbabekiss.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestcrawler.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestfor.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestfreepic.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestporngate.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestpornnews.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestsearch.cc]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestteenagers.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bestxporno.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\biblelifechurch.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bigbr.cc]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bigpornguide.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bitchonmydick.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\biz-partner.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\biz-partners.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blackjack-free.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blackjack.md]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blazefind.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blender.xu.pl]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blondetgp.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blue-elefant.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blue-elefant.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\blussy.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bodaciousbabette.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bonzi.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bonzi.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\boobdoll.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\boobsandtits.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\boobsclub.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\boredlife.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bowlofogumbo.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bradcoem.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\brainbeat.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\brandiyoung.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\brookeburn.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\browserplugin.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\browserwise.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\browserwise.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\brutal-video.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bsnlbuldhana.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bucketbooks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bucps.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buddylinks.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buildhere.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\burgerkingbigscreen.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buscards.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\business-cc.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\bustyrussell.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buttejazz.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buymeds.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buysearch.cc]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buyselldomain.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\buz.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\by.ru]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\by.ru\superwp]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\c911c.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cadabra.biz]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\calcioturris.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cameup.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\canberracricketcoaching.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\candyasians.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\candycantaloupes.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cantfind.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\carsands.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\carsrentals.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casalemedia.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cashsearch.biz]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cashsurfers.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cashsurfers.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cashtoolbar.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casino-007.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casino-gambling-
1.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casino-gambling-
2.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casino-onlines.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casino2win.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casinomidas.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casinonline.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\casinos-online.md]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\castingsamateur.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\catallogue.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cataloweb.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\catsss.da.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\caxa.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cc-debt.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cclebali.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ceewawires.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\celeb-dialer.de]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\centralmedia.ws]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\centralmedia.ws\ads]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\centralmedia.ws\c]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\certumgroup.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chargitdial.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chelancatering.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chfela.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chicagocub.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\childpaysite.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\childrenvilla.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\china-design.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chipovka.ru]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chips-4-free.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chrisswasey.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\chriswallace.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ciaclinton.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cigarettes-directory-
usa.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cimfel.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cjb.net]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cjb.net\dialer]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\ckick4thumbs.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cl55.biz]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet
Settings\ZoneMap\Domains\clackamasliteraryreview.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\claria.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clearsearch.cc]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clearsearch.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\click-now.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\click-
now.net\ufindall]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\click2findnow.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clickaire.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clickfor-xxx.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clickyestoenter.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cliks.org]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cliks.org\xads]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\closexxx.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clrsch.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\club-super-sex.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\clubasean.org]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cmtapestry.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cnetadd.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cnetadd.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\collcom.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.au]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.au\imrworldwide]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.br]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.br\haren]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.ru]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.ru\xxxxxx]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\com.ru\you-search]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\commonname.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\commonname.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\conetka.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\consumer-credits.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\contextplus.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\contextplus.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool-homepage.co]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool-homepage.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool-search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool-search.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool-web-search.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool-xxx.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool.ne.jp]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\cool.ne.jp\urawa]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\coolfetishsite.com]
"*"=dword:00000004

As you can see this list just goes from a to c and this
isnt even a quarter of the list i have

I was going to delete them all but thought id better post
it and see what others think,My system always shows clean
when i run scans and im not sure what could of created
all these entries as they dont appear to be blocked so it
probably rules out a genuine program creating them

Thanks Mark

Anonymous Bob · Jul 3, 2005

Mark Fuller said:
Hi I have hundreds of malicious looking entries in my
registry and was hoping someone could let me know if
these are protective or dangerous ,They are in

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current
Version\Internet Settings\ZoneMaps\Domains

Theres really to many to list and ive never heard of any
of the sites listed,they all look like malware related
sites (CoolWeb,PornSites Etc..)

I have Spybot,MS Antispy,Spyware Guard & Spyware Blaster
and i at first thought maybe they are being blocked but i
tested it by trying a couple of the site names and the
ones i tried all open fine

Heres some of the entries if i need to delete these is
there a way i can delete them all or can i just delete
the domains folder as there is hundreds of entries in
there which i havn't added or even heard of most of the
sites listed.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\008i.com]
"*"=dword:00000004

http://support.microsoft.com/default.aspx?scid=182569

Zones
The Zones key contains keys that represent each security zone that
is defined for the computer. By default, the following five zones
are defined (numbered zero through four): Value Setting
------------------------------
0 My Computer
1 Local Intranet Zone
2 Trusted sites Zone
3 Internet Zone
4 Restricted Sites Zone

My guess is that you've enabled the "Content Advisor" or that you've
run some kind of nanny ware that blocks offensive sites. Therefore I
would advise leaving the entries as they are.

Bob Vanderveen

Mark Fuller · Jul 4, 2005

Thanks for the reply ,

Im glad you know what your doing i was tempted to just
delete the domains folder as i thought it would take
hours to delete each entry but then realised this would
probably be a very bad idea so thought id post some of
the contents.

Visiting some of the sites again like you say even though
they all open they are restricted,I have alot of
protection products but if these have all been added as
restricted sites it must be either spyware blaster or
spybots immunize entries

Thanks again for the reply i did have the sdbot virus
which i was stupid enough to open through msn then
started getting strange entries in a hijack this log
showing F2 shell entries and alot of unknown services
running ive managed to clean everything up and all my
scanners are showing clear i just came across the entries
as i downloaded a toolbar called stumble which i like up
to now as users add sites they like and then choosing
some topics and pressing stumble scans through different
sites which others have recommended.Its fun up to now and
i have found some good sites (mostly flash games and html
related sites)

The only downside was that they entered themselves into
my trusted zone list ,MS Antispy gave me the option if i
wanted to allow it which i didnt then when it showed the
area of the registry is had tried to enter into i checked
that area and came accross all these files.

Its great to know that they are protective entries and i
really should of checked if they were restricted i just
opened a few of them and assumed they may be malicious as
each site was opening

Thankyou Bob for puttin my mind at ease i was worried i
still had some malware installed that may of created them

Regards Mark

JRosenfeld · Jul 4, 2005

Yes, both Spywareblaster and Spybot's immunize feature put
domains into IE's restricted zone by adding entries at
that registry key.

Restricted zone does not mean that you can't access the
page, but it blocks download of any cookies, activeX
components etc. from those sites.

If you want to completely block access to a site or
domain, add an entry to your HOSTS file, redirecting it to
your own PC (127.0.0.1) and then if you try to access the
site you'll get page not found (since it obviously is not
on your PC). Ready made hosts files are available to block
access to 'bad' sites, for example mvps.org has one

http://www.mvps.org/winhelp2002/hosts.htm

spybot also has one (not very comprehensive) which it will
add to whatever hosts file you already have.

-----Original Message-----

message news:[email protected]...

Hi I have hundreds of malicious looking entries in my
registry and was hoping someone could let me know if
these are protective or dangerous ,They are in

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current
Version\Internet Settings\ZoneMaps\Domains

Theres really to many to list and ive never heard of any
of the sites listed,they all look like malware related
sites (CoolWeb,PornSites Etc..)

I have Spybot,MS Antispy,Spyware Guard & Spyware Blaster
and i at first thought maybe they are being blocked but i
tested it by trying a couple of the site names and the
ones i tried all open fine

Heres some of the entries if i need to delete these is
there a way i can delete them all or can i just delete
the domains folder as there is hundreds of entries in
there which i havn't added or even heard of most of the
sites listed.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\008i.com]
"*"=dword:00000004

Click to expand...

http://support.microsoft.com/default.aspx?scid=182569

Zones
The Zones key contains keys that represent each security zone that
is defined for the computer. By default, the following five zones
are defined (numbered zero through four): Value Setting
------------------------------
0 My Computer
1 Local Intranet Zone
2 Trusted sites Zone
3 Internet Zone
4 Restricted Sites Zone

My guess is that you've enabled the "Content Advisor" or that you've
run some kind of nanny ware that blocks offensive sites. Therefore I
would advise leaving the entries as they are.

Bob Vanderveen

.

Anonymous Bob · Jul 4, 2005

Mark Fuller said:
Thanks for the reply ,

You're welcome.

FWIW, Castlecops rates the stumbleupon toolbar as a legitimate BHO.

http://castlecops.com/CLSID.html

Personally, I prefer not to have such things on my system.

Bob Vanderveen

Guest · Jul 4, 2005

Thanks for the advise J Rosenfeld,

I like to keep the windows host file empty im sure
everyone has different view on that but im happy if they
are just restricted as im not going to visit their sites
anyway,

the only times i get problems with malware is when i open
email attachments that are malicious or as i did more
recently some girl i know sent a link to me and i just
pressed it without thinking ,this downloaded and run the
sdbot virus on my system just by clicking the link which
i cant remember the name but made a reference to a email
address and then she sent a message saying dont click the
link as the virus was sending it self out to people on
her contact list (Abit late for me)

I used to get loads of emails from made up addresses
sometimes even saying security@microsoft or Abuse@hotmail
in the address bar and again when i clicked the links i
was infected with the bagle worm,I got caught out loads
of times then managed to get their accounts cancelled as
they were traced to 4 hotmail accounts which stopped the
problems

I just use the net for these types of forums and
sometimes play games and music on line but i dont think i
need to block the sites using the hosts file as i really
have no intention to visit any of them sites.

It's only with me running the sdbot virus that im now
double checking all the entries i find just incase they
are connected.I believe i may of had about 4 or 5 viruses
running as i found various malware files in my system32
folder and then about 5 files running as windows services
under different names but none were genuine entries.I
visited a site called http://packetstormsecurity.org/ and
i believe i may of downloaded some viruses from there as
i did try to save a few files which i found interesting
but instead of saving them it may of actually run the
virus just by clicking some of the links contained in
that site

Thanks to you and to Bob for helping me out

Best Wishes

Mark

Anonymous Bob · Jul 4, 2005

Thanks again for the reply i did have the sdbot virus
which i was stupid enough to open through msn then
started getting strange entries in a hijack this log
showing F2 shell entries and alot of unknown services
running ive managed to clean everything up and all my
scanners are showing clear i just came across the entries

<snip>

I just ran across this and thought you might be interested.
http://support.microsoft.com/?kbid=890830

Bob Vanderveen

Mark Fuller · Jul 5, 2005

Thanks Bob

I did try the Windows Malicious Software Removal Tool and
it didnt show any problems even though i could clearly
see the problems using Hijack This,Same with my Norton
Internet Security it didnt help and didnt even detect
sdbot entering my system.I only found out it was sdbot by
using search engines on all the suspicious files,Alot of
them didnt have any info at all so makes me think it
could be a new variant of sdbot which has yet to be
written in to the software removal tool and Nortons
definitions list.

With the packetstorm site im fully aware they have live
viruses on that site.Im not trying to say the site is
malicious as im sure most of the viruses on there are for
testing and research, I remembered trying to download
some text files on exploits which sounded interesting but
then when i rebooted the next day the text files i saved
where not on my system and using Hijack this showed like
i say 5 windows services running some with names like -D-
then pointing to temp files or to random named files in
the system32 folder. I tried Norton's scanner and it
didnt detect any problems , same with trend micro , then
i used bitdefender which found 3 viruses including the
sdbot infection which it cleared then i just shut down
the other suspicious files manaully using hijack this and
deleting all the files in safe mode.

I still probably have traces in the registry but i dont
want to make anything worse by deleting something thats
essential.At least i know now that the malware has been
removed but ive never been that impressed with norton as
it always seem to miss the viruses,first by letting it
enter my system even though all the protection levels are
set to high and also by it missing the viruses when it
scans

I'll just be more cautious about what i download in
future as i now know my protection products are not that
great

Thanks Mark

Suspicious Registry Entries

Mark Fuller

Anonymous Bob

Mark Fuller

JRosenfeld

Anonymous Bob

Guest

Anonymous Bob

Mark Fuller