IzNoGud78

I think the problem might occur because the dword value is present, but in underlying paths: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\google] "*"=dword:00000004 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\www.google] "*"=dword:00000004 Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com\mystart] "*"=dword:00000004 Windows Registry Editor Version 5.00 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\google] "*"=dword:00000004 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\www.google] "*"=dword:00000004 Windows Registry Editor Version 5.00 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com\mystart] "*"=dword:00000004 Windows Registry Editor Version 5.00 [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\google] "*"=dword:00000004 [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\www.google] "*"=dword:00000004 Windows Registry Editor Version 5.00 [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com] [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com\mystart] "*"=dword:00000004

I just saw now the responses on the Spybot forum. What is sure is that the domains have not been added among the trusted sites, so the false positive report remains plausible.

Neither of the domains appear among the trusted sites. I tried to ask for explanations on the Spybot forum as well, but i still haven't received a response at the moment.

I have noticed that whenever I use the Spybot Search & Destroy immunization tool, AdwCleaner detects the registry entries in the attached log file as PUPs. I'm not sure of the actual usefulness of these items, but I'm sure they are entries created by Spybot S&D because if I run the immunization check again after removing or quarantining these entries, the immunization status comes back incomplete. After several detections and being sure that these entries are somehow related to the use of Spybot S&D's immunization tool, I considered adding these entries to the exclusion rules. AdwCleaner[S11].txt