Why are there porn entries included in my system registry?

GenerationXtreme

Prominent
Feb 18, 2017
6
0
510
I first ran into this quite a few years ago while scanning through my registry in hopes of fixing an unrelated issue I was facing. I ran across a barrage of entries for all kinds of porn websites I was certain I wasn't visiting. I was using windows Vista Ultimate x64 by the way. I deleted all the entries one by one. It probably took me at least an hour to complete, although I wasn't really watching the time.

Since then I have encountered this issue with every copy of Windows where I worked with the registry, whether it be Windows Vista, 7, 8, or 8.1 32bit or x64 editions(I have little experience with Windows 10 registry-wise but I suspect it is very similar to other versions of Windows).

Whenever I work with a new registry (or a fresh copy of Windows) I search for the word "porn" in the registry to see just how universal this issue is.

I get the sense that these unknown sites might actually be sites that Microsoft pre-blacklisted for security reasons but I am uncertain.

The specific region of the registry I found these entries in (at least at the moment on Win 7 Ultimate x64) is:

HKEY_CURRENT_USER---->Software--->Microsoft--->Windows--->CurrentVersion--->Internet Settings--->P3P--->ZoneMap--->Domains

Under this sub-folder, not only did I see listings of porn websites but also other random sites that I can't make out the specific purpose of....but I think some of them may be Ad and/or Malware related. Perhaps anti-malware or ad related.

Ultimately, I would like to know whether it's smart to delete the entries or not.

Here are some examples of the multitude of sites listed(WARNING: Just in case you don't know any better....DO NOT OPEN ANY OF THESE LINKS!!! They could be malicious!!!)

Also, ignore the "$" symbol on each side of each listed item below. I included this in case any of these sites are capable of self-activation on this server(if possible). I have hopes that by changing the names slightly it will increase security for Tom's Hardware.
________________________________________________
$008i.com$
$008k.com$
$0190-dialers.com$
$02pmnzy5eo29bfk4.com$
$100sexlinks.com$
$101hotteens.com$
$123expressview.com$
$1ive.net$
$1-britney-spears-nude.com$
$2-antispyware.com$
$4pokertips.com$
$600pics.com$
$600pics.com$
$700xxx.com$
$adultan.com$
$antivirusdoc-scanner.net$
$antivirusgolden.com$
$antivirus2008x.com$
$antivirus-2008-pro.net$
$antivirus-2008-noadware.com$
$art-xxx.com$
$barnandfence.com$
$beast-cartoons.com$
$bestmovszone.com$
$candyasians.com$
$carsands.com$
_________________________________________________
That was only a VERRRY small portion of the list. Otherwise I could be here for a couple days typing.

Also, if your curious, try searching your own registry for "porn" (without quotes). This will probably bring you close to the same location in the registry hive I was looking through.

Many thanks in advance.
 
Solution
I noticed this too, and the same ones are in multiple places.

As many of the URLs are the same as the ones blocked at 3rd-party hosts files like this one, I assume it's because Windows Defender hard codes those URLs to redirect elsewhere right in the registry, especially because so many parts of Windows now ignore the hosts file entirely.

GenerationXtreme

Prominent
Feb 18, 2017
6
0
510
Thanks for the responses guys.

I am the only user of this computer and I am quite certain there isn't any adware, spyware, malware or the likes floating around in in it besides in my system registry(maybe). I scan my system with multiple tools regularly. I am careful as to what I download and the sites I visit are limited to what I've determined to be safe after repeated use.

Also, just to recap:

This registry list of porn and ad related websites is included with every fresh installation of Windows I've checked (about 24 installations). It doesn't matter which sites I visit or if I've ever browsed the Internet at all on a given PC. The majority of the entries, from what I can tell, were implemented into the registry by Microsoft themselves or an affiliate of Microsoft before distributing their product. If I had to guess I'd say the majority of these registry entries are included in EVERY Windows PC by default. There's probably a good reason for it but it'd be nice to know what that reason is.

Check for yourself if your comfortable and knowledgeable with the windows registry. You'll probably come to the same or similar conclusion. Bare in mind not all the listings were porn websites. Perhaps I should have clarified that in the title. Adware, malware, spyware, virus related sites along with other random sites are included with Windows by default in the previously posted location of the registry.
 

IDProG

Distinguished
Then it's not the OS problem, it's the drive problem. It's impossible that the registry occurs in every fresh installation and it's the OS' fault. Try deleting your temporary files (in the temp folder in Windows folder). Most of my viruses came from there.
 
I noticed this too, and the same ones are in multiple places.

As many of the URLs are the same as the ones blocked at 3rd-party hosts files like this one, I assume it's because Windows Defender hard codes those URLs to redirect elsewhere right in the registry, especially because so many parts of Windows now ignore the hosts file entirely.
 
Solution

USAFRet

Titan
Moderator
This does not exist in a pristine Win 10 Pro install, with only Windows Defender installed, nor in a well used daily driver Win 10 Pro install.

Either in the reg location you describe, or searching for any of those words in that list.
The "P3P" location exists, but nothing underneath it.
 

GenerationXtreme

Prominent
Feb 18, 2017
6
0
510
Thank you for letting me know of the absence of these entries on Windows 10 Pro USAFret. It might be good to know in the future if I need to dig further. Thanks to everyone for taking the time to answer. I feel fairly comfortable that these entries are blacklist related but if anyone has anything to add I'll be checking back here every now and then.
 

USAFRet

Titan
Moderator


Yes, that would seem to be a blacklist from something. But not in a bare Win 10 install.
Seems like it would have come from something else.
 
Seems to be present in XP and Win7 with Microsoft Security Essentials/Defender/Forefront/GIANT antispyware installed. The only other AV type software ever installed on these machines is Spybot.

As was pointed out, it is NOT in Win 10 with Defender, and it's possible such vulnerabilities were ironed out of that OS so they aren't needed. I don't have a Win 8 machine to check.
 

GenerationXtreme

Prominent
Feb 18, 2017
6
0
510
I messed up on the reg location guys. sorry. It was actually HKEY_CURRENT_USER---->Software--->Microsoft--->Windows--->CurrentVersion--->Internet Settings--->ZoneMap--->Domains

Basically the same minus "p3p"

So there still might be a chance that the entries exist in editions of Windows 10 as well. Either way, if the entries are a blacklist, then there is probably no cause for further concern.
Thanks again, everyone!!!