christos1 adware cleaner

[christos1]

should I restore these registry items found by adware cleaner

***** [ Registry ] *****

Adware.StartPage                HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\qwertysearch123.biz
Adware.StartPage                HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\quertysearch123.biz
Adware.StartPage                HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\qwertysearch123.biz
Adware.StartPage                HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\quertysearch123.biz
Adware.StartPage                HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\qwertysearch123.biz
Adware.StartPage                HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\quertysearch123.biz

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the AdwCleaner Help forum.

Someone will reply shortly, but in the meantime here are a few resources which may help resolve your issue:

• AdwCleaner user guide
• A malicious element isn't being detected? Submit the sample here!
• Need help with another Malwarebytes product or malware removal?
  • Click here for home support
  • Click here for business support
  • Click here for malware removal help

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[Elisabeth]

Hi,

Can you share the content of those registry keys? You can PM me if you prefer.

Thanks!

[exile360]

If you use the Immunize function in Spybot Search & Destroy or Spywareblaster then these are false positives.  You can verify this by checking the registry entries.  If they show the value data as 4 then they are FPs as zone 4 is the restricted zone.  

You can learn more by reviewing the information on this page.

If these entries were set to 2, meaning the trusted zone, then they would not be false positives, however there has been a longstanding known issue with ADWCleaner detecting these types of entries.  Most were corrected in the last 2 releases however it appears that some of them still linger (assuming they are configured to 4 on your system).

The following is a quote from the Microsoft page linked above:

The Zones key contains keys that represent each security zone that is defined for the computer. By default, the following five zones are defined (numbered zero through four):

   Value    Setting
   ------------------------------
   0        My Computer
   1        Local Intranet Zone
   2        Trusted sites Zone
   3        Internet Zone
   4        Restricted Sites Zone

Edited October 5, 2018 by exile360

[christos1]

Th

On 10/4/2018 at 10:01 AM, Elisabeth said:

Hi,

Can you share the content of those registry keys? You can PM me if you prefer.

Thanks!

 

[christos1]

Thanks for the responce having looked in the registry and following exile 360 advice it looks like these are false positives in the registry i found

qwertysearch123.biz   Name        Type                             Data

                                          ab               Reg_S2                     (value not set)

                                         011              Reg_DWORD              0x0000004 (4)

                                         110

Not sure if this is any use as i am not really computer literate

[christos1]

On 10/4/2018 at 1:07 PM, exile360 said:

If you use the Immunize function in Spybot Search & Destroy or Spywareblaster then these are false positives.  You can verify this by checking the registry entries.  If they show the value data as 4 then they are FPs as zone 4 is the restricted zone.  

You can learn more by reviewing the information on this page.

If these entries were set to 2, meaning the trusted zone, then they would not be false positives, however there has been a longstanding known issue with ADWCleaner detecting these types of entries.  Most were corrected in the last 2 releases however it appears that some of them still linger (assuming they are configured to 4 on your system).

The following is a quote from the Microsoft page linked above:

 

 

[christos1]

Thanks for the help exile360

[exile360]

You're welcome

If you still aren't sure how to provide the contents of those keys, all you have to do is open regedit and go to the keys one at a time and for each, right-click on it and select Export and give it a name and save it somewhere convenient where you can easily locate it such as your desktop and after doing so, select all of them and right-click on one of them and hover your mouse over Send to and select Compressed (zipped) folder then attach the resulting ZIP file to your next reply in this topic.  That should give them all the info they need to troubleshoot and correct this issue.