Spybot Registry Changes (lists)

[Micaw]

Hi,

I'm just after some information.

I've been checking the registry on a pc and in the following locations:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_USERS\S-1-5-21-1074107145-997900802-3445936614-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\domains

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

HKEY_USERS\S-1-5-21-1074107145-997900802-3445936614-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\domains

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains


I found lists of what appears to be web addresses.

Many of these are Adult or Gambling web sites that the user says they haven't visited.

Elsewhere on the web I read that Spybot may use these locations to store web lists of sites that the software blocks.

Is this correct and is this what I'm seeing?

Thanks,

Mick

[Zenobia]

Elsewhere on the web I read that Spybot may use these locations to store web lists of sites that the software blocks.
Yes,that is correct,Spybot does place sites in those places as part of it's immunization. :)

[Micaw]

Yes,that is correct,Spybot does place sites in those places as part of it's immunization. :)

OK thanks, that explains a lot.

[Zenobia]

You're welcome. :)