Under the restricted sites protection enabled, 4 sites had been unchecked somehow. cwshredder 008i.com, cwshredder 5427, greg search, cwshredder 1242, cash search.biz, and cws 1249 myexexex.com. At the same time I found the search for it also disabled. I figured out the search for it had been disabled by the spybot scan false positive. The same spybot scan showed 4 LH entries, is it possible that they were the above four entries?