Spywareblaster and Spysubtract

I have learned by process of elimination the when I run Spywareblaster and then run Spysubtract, SpySubtract shows:
Coolwebsearch info(7items)
HKCU\software\microsoft\windows\currentversion\internetsettings\zonemap\
domains\blazefind.com
mt-download.com
searchbarcash.com
searchmiracle.com
skoobidoo.com
slotch.com
xxxtoolbar.com
Previously, in Wilders forum, I was told that it was probably Spyware blaster putting these into the registry. I just want to be sure they are harmless. I delete then with SpySubract but when I go into the registry they are still there. Does Spywareblaster put them in "domain" as a way of blocking coolwebsearch?

 

Hi auggief,

What is the Reg Dword Value?

A value of 4 is good as that means you are protected against it. If the value was 2, that would mean you were infected.

Yes ... This is how SB protects you ... if the value is 4 it is a F/P by Spy-Subtract

dog -

 

Dog, in the registry under type it says REG SZ Value not set.

 

That's right ... Is the Dword Value 4 for those entries?

Find/Click on one of these enteries ... in that sub set

mt-download.com
searchbarcash.com
searchmiracle.com
skoobidoo.com
slotch.com
xxxtoolbar.com

And you will see the Dword Value for the given entry. In the right pane.

 

Dog, sorry for my ignorance but there isn't any Dword value showing in the right side of registry next to blazefind.com and the others. If I right click it on the left side and click new it will let me set dword to 1 but I know nothing about it so I deleted that and left it with only REGZ value not set.

 

It should look like this.

Is this of any Help?

Steve

 

I'd like to copy and paste my Registry Editor for you to see but can't figure out how to do it like you just did.

 

IF I click on 0190 Dialer shown in your example I get what you get dword and all but not with the items in our discussion.

 

OK ... While the reg editor is the active window.

Press Ctrl + Print Screen (located in the small cluster above the Home & Page up Keys)

Open M$ Paint, or any Photo Editing software you may have.

Select new ... Then press Ctrl + V

And save as a Jpeg.

You can then upload it using the manage attachments button ... in the aditional options menu below "Submit Reply" & "Preview Post"

Just navigate to the file and then upload.

Steve

 

Ok ... Open Spyware Blaster ... and select enable ALL protection.

Then recheck the value of those enteries.

 

SpySubstract....or any similar cleaning program for that matter....does not delete the whole Domain key(blazefind.com for example)....it only removes the DWORD value found in the right hand section that denotes either a Trusted Site(0x00000002) or Restricted Site(0x00000004).

 

OK ... See the above posts first.

If that doesn't work ... You can manually enter them ... Navigate to those enteries ... Right Click on a entery --> select new, then select Dword Value. Enter the name as * (shift + 8 ) Hit enter ... then left click that entery in the right pane ... and set the Dword Value to 4.

 

Ok Dog I need to go drink some beer. I didn't do anything that I know of and now all of a sudden all the items have dword value of 4 showing.

 

Oh boy spoke too soon. I downloaded and installed update to Spysubtract, then went back into regedit and now the dword valus is no longer there.

 

Now dword value of 4 showing again. Thanks for your help. I think I am OK BYE

 

OK ... glad I could help & that it seems to be resolved.

If you run a scan with spysubtract and it finds those enteries, do not have it fix them. As you will end up running in circles ... with it deleting the value, and then using SB 3.2 to rewrite them. If it is possible I would suggest adding those findings to Spysubtracts ignore list, if there is one. (I'm unsure, as I have never tried the program) ... Then as time passes ... remove them from the ignore list ... and see if this issue has been resolved. To speed up this process, you could write a brief email to their support staff, alerting them to the problem.

Warm Regards,

Steve