First scan of my XP Pro system and the new MS Anti-
Spyware program found the following registry entry and
wanted to remove it. The problem is this is a site I had
entered in my Restricted Sites Zone. I've seen this
happen before with other anti-spyware programs. Each one
finds one or more of the domains I've added to the
Restricted sites in Internet Explorer Properties. Each
time I had to choose 'IGNORE' or the entry would have
been removed, opening up a security breach in my settings.

What gives with this?

Actually, I think the other program was CounterSpy,
another look-alike program engined by Giant Software
antispyware technology.

Opps, forgot to include the registry key

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\searchsquire.com]
"*"=dword:00000004

I always wondered why ASware programs try to remove
certain domains discovered in the Restricted zone.
Sometimes I think, maybe they're paying off the
programmer to look the other way? Nawww....just crazy
talk

>-----Original Message-----
>First scan of my XP Pro system and the new MS Anti-
>Spyware program found the following registry entry and
>wanted to remove it. The problem is this is a site I had
>entered in my Restricted Sites Zone. I've seen this
>happen before with other anti-spyware programs. Each one
>finds one or more of the domains I've added to the
>Restricted sites in Internet Explorer Properties. Each
>time I had to choose 'IGNORE' or the entry would have
>been removed, opening up a security breach in my
settings.
>
>What gives with this?
>
>Actually, I think the other program was CounterSpy,
>another look-alike program engined by Giant Software
>antispyware technology.
>.
>

DReCo wrote:
> Opps, forgot to include the registry key
>
> Windows Registry Editor Version 5.00
>
> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
> on\Internet Settings\ZoneMap\Domains\searchsquire.com]
> "*"=dword:00000004
>
> I always wondered why ASware programs try to remove
> certain domains discovered in the Restricted zone.

In this case a guess would be because of the "search" within the name. Keep
in mind that one favorite trick for getting malware on a gullible user's
system is to cloak it as an advanced searching tool or browser toolbar.

Suggest you send in a report on this as a false positive.

--

....Sky

Tom "Sky" King
=============