The Sophos anti-rootkit found \HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\888.com

The Rootkit Revealer found HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed

And the McAfee Rootkit Detective found a whole bunch of these HKLM\SOFTWARE\Microsoft\Protected Storage Provider\* Local Machine *\Data

These are not rootkits. Rootkit detectors do not always distinguish between legit and malicious entries.

The only registry key of possible concern is this one:
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\888.com

Have you used an immunize function to add sites to the restricted zone of IE, such as Spybot S&D, SiteAdvisor does this, too, and as well as some other programs.

The domain 888.com is an online casino and gameroom website.

You can tell by using Regedit to look at the DWORD value for this key whether 888.com is in the trusted zone or restricted zone of Internet Explorer. If the value is 4 then that domain is in the restricted zone. If it is 2, then the domain is in the Trusted Zone (you don't want it there). If you can't find this key and it is hidden, then that's a bad sign.

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\888.com

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

Thanks for reading and replying to my post. Sophos is the only program that finds it. I looked through the registry for it, nothing.
I have alot of wierd web sites under my domain area, ones Ive never even been to. So.... What to do now?

The fact that you are seeing all those weird domains in your registry indicates that you have used a program with an "immunization" function. Some programs like SiteAdvisor do not inform you in the description on their product page that immunization is done.

Let's use a tool to automatically search your Registry for all occurrences of the string 888.com

• Download RegSearch and extract the contents of the zip file.
  
• Double-click the icon for RegSearch.exe to launch the program.
  
• Enter 888.com in the first box, as string to search for and click "OK".
  
• After completion Notepad will be opened with all the found instances of the string.
  
• The resulting file is saved in the same location as RegSearch.exe.
  
• Please post back the results - only if any occurrences were found.

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 6/11/2008 3:44:17 PM for strings:
; '888.com'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\888.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\888.com]

; End Of The Log...

Those keys are used for cookie handling both globally and for the current user. You can check the DWORD value data for that key using Regedit to determine whether your IE settings ares blocking or allowing cookies for that domain:

0x00000005 - Blocks cookies
0x00000001 - Allows cookies

Ideally, the data value is a 5.

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

It doesnt show up on regedit.

Please download ATF Cleaner by Atribune.

This program is for Vista, XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
  
• Under Main choose: Select All
  
• Click the Empty Selected button.

• Click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  
• NOTE: If you would like to keep your saved passwords, please click
• No at the prompt, and uncheck cookies.

• Click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  
• NOTE: If you would like to keep your saved passwords, please click No at the prompt, and uncheck cookies.

• Type or paste the following to unload the gmer driver:
• net stop gmer
• Hit Enter
• Exit the command prompt.

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\888.com]
there was no 888.com there was just an 888net.net REG_DWORD 0X00000004 (4)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\888.com]
this one said REG_DWORD 0X00000005 (5)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\888.com]
and this one said REG_WORD 0X00000005 (5)

When I typed net stop Gmer in the command promp it said:
System error 1060 has occurred.
The specified service does not exist as an installed service.

The Security programs I use are as follows: Kaspersky Internet security 7.0 (I disabled all but the antivirus on this because I could not understand the complexity of the other programs),
Comodo Firewall Pro, Comodo BOClean 4.25, AVG Anti-Rootkit,
Sophos Anti-Rootkit, SUPERAntiSpyware, Rootkit Detective,
Spybot - Search and Destroy, WinPatrol, Rootkit Revealer,
HijackThis, SpywareBlaster, and CCleaner.

Long list huh? Im kinda paranoid.
Ok, thats it. Hope you can figure out whats going on from here.
Thanks again for your help.

Please give me further information or instructions. Thank you.

Both Spybot S&D and SpywareBlaster perform an "immunize" function. In addition SpywareBlaster blocks harmful cookies which is what is happening here with 888.com. The upshot of all this, is that these entries in your registry are simply your security programs protecting you from dodgy domains. I do not know why Rootkit Detective flagged them previously but they are not cause for concern, just the opposite in effect.

I have SpywareBlaster installed and I can confirm that 888net.net it is one of the domains it puts in the IE Restricted zone. The "Restrictive Site Protection" function within SpywareBlaster will allow you to view all the domains it restricts. Doing this prevents harmful downloads, ActiveX installations, script execution, and "spyware cookies".

The Gmer error just means the driver was already unloaded so no problem there.

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

Thank you for your time and help. Im glad to hear its nothing to worry about.

Your welcome, WillysWonka79.

Since this issue has been resolved I will mark this topic as "Fixed".

_________________
Negster22 - MS MVP - Consumer Security 2006-2008