Hi all, A XoftSpy scan (but not SpybotS&D) found CoolWebSearch in my registry. When I went to check out the entry, I found hundreds of advertising, porn, gambling and other sites listed there! Included were such web sites as 180Solutions, 0190-dialers.com, and amigeek.com. For example: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ZoneMap\Domains Folder: cigarettes-directory-usa.com Type: REG_DWORD Value: 0x00000004(4) Every website listed in the ZoneMap\Domains appears to have the same exact entry (REG_DWORD 0x00000004(4)). How could all these website entries get onto a computer? What does the registry entry 0x00000004 mean? Should I delete all these entries? Is this some sort of SpyWare/Adware/etc? Thank you for your advice, Robin24-7

hi robin, have you ever used or are you using spywareblaster? it may put those entries in your registry, and also in your restricted sites. while you are on the internet, go to tools button, internet options, security tab, restricted sites, click on restricted sites, click sites button, they should all be there also. the same situation happened to me but with pestpatrol, its picking up a site it finds in the registry(same place) and says i have the cws google trojan or something to that effect. i submitted the file to ppatrol, and am still waiting for the answer. i deleted the whole key way back and the next day it returned with all the entries. i am assuming that because i had checked with spywareblaster and i had to reprotect my internet setting entries. if anyone out there knows something, i would like to know. all the best, murve

Murve, As a matter of fact, I did install Spywareblaster recently. When I looked, those same websites are indeed in the "restricted" zone of Internet Explorer. Thank you for your help. It is a relief to know that this shocking list is actually there to protect my computer! (That is, assuming that the setting 00000004 is what places them on the "restricted" list.) :-) Robin