Zonemap.Ranges - What Does This Mean?

[OldRebel]

I ran a scan tonight with Spybot and it gave "Zonemap.Ranges" as a problem to be fixed. However, there is no additional information about what this means. I just had a bad experience yesterday with another antispyware product that prompted me to delete several registry items, and I found out later it was a false positive. Now I am hesitant to do anything about what Spybot found. I need to know whether the "fix" would be to remove something from the registry that should not be there OR to add something to the registry that is needed and is missing. My scan log follows:

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-21-4018711648-284700086-2646643178-1010\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-21-4018711648-284700086-2646643178-1010\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-21-4018711648-284700086-2646643178-1010\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range

Zonemap.Ranges: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-12-09 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-01-27 Includes\Cookies.sbi (*)
2006-01-27 Includes\Dialer.sbi (*)
2006-01-27 Includes\Hijackers.sbi (*)
2006-01-27 Includes\Keyloggers.sbi (*)
2006-01-27 Includes\Malware.sbi (*)
2006-01-27 Includes\PUPS.sbi (*)
2006-01-27 Includes\Revision.sbi (*)
2006-01-27 Includes\Security.sbi (*)
2006-01-27 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-01-27 Includes\Trojans.sbi (*)

[md usa spybot fan]

I was able to reproduce the problem by making an improper entry into the following registry key:

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1]
That is one of the keys used by Spybot to add sites to the restricted zone by IP Address during immunization.

I don't understand why my entry in Range1 of the HKEY_USERS\.DEFAULT registry hive caused errors in multiple registry hives for Range3, Range6 and Range8 but it did, getting exactly the same results that you received.

Assuming that you use Spybot's immunization, go into Spybot > Immunize > click on the Immunize button at the top of the screen (big green plus sign).

Run another scan to check if the problem is fixed.

[OldRebel]

Thanks for the tips. I think I resolved the problem. I undid Spybot's immunizations and cut off shield from Webroot Spysweeper and Microsoft Antispyware. Then I used Funky Toad to delete all remaining entries in safe and restricted zones. They were a few I had added, and many more that were probably left behind by SiteAdvisor Toolbar (now uninstalled) or perhaps by Spywareblaster. Then I slowly reapplied individual shields from Webroot and MSAS, running Spybot scan after each addition. I though there might have been a conflict with one of these shields. There was NO conflict. The last step was to re-immunize with Spybot and run a scan. When I did, the Zonemap.ranges issue finally popped up again. I let Spybot fix it, rebooted, and redid the immunization. The last time Spybot scanned, this issue was NOT found.

I must assume that Spybot was detecting an issue with its own immunizations. Perhaps something had become corrupted? I don't know, but it seems to be fixed now.

BTW: I then reinstalled Spywareblaster and enabled all protections. Spybot scan did not find any new problems afterwards.

Thanks again for the help and information.

[Coolfriend]

I had the same problem but solved it differently. Spybot could have become corrupted. I solved the problem by downloading a copy of Spybot then reinstalling it. After I rebooted my computer. I scanned again. It did not find anything.

[bitman]

Actually, the problem was in the January 27th, 2005 detections. It was fixed in the February 3rd detections update, so your reinstall simply installed the updates containing the fix.

I had seen the same three entries in differing quantities on both Windows 2000 and XP. Research showed that the scan/fix removed only the :Range entry containing the IP address being added as a Restricted Site. This also made the entry invisible to the Spybot Immunize, though the rest of the entry remained in the registry. Thus, when you reimmunized, the three 'bad' entries remained and three additional entries were added containing the correct :Range IP data values.

Here's a link to the post by Yodama in the German forum where he mentions the fix.
http://forums.spybot.info/showthread...0925#post10925

[OldRebel]

Actually, the problem was in the January 27th, 2005 detections. It was fixed in the February 3rd detections update, so your reinstall simply installed the updates containing the fix.

I had seen the same three entries in differing quantities on both Windows 2000 and XP. Research showed that the scan/fix removed only the :Range entry containing the IP address being added as a Restricted Site. This also made the entry invisible to the Spybot Immunize, though the rest of the entry remained in the registry. Thus, when you reimmunized, the three 'bad' entries remained and three additional entries were added containing the correct :Range IP data values.

Here's a link to the post by Yodama in the German forum where he mentions the fix.
http://forums.spybot.info/showthread...0925#post10925

Thanks for the info on the rest of the entry remaining in the registry "invisible" to Spybot. I assumed that it was invisible to Zoned Out also. I decided to rremove all immunizations and then use Zoned Out to remove everything visible that was left. Then I used DellDomains trying to remove any "invisible" entires that might linger. I have now reapplied all immunizations and everthing seems to be in good working order. BTW - the new version of Zoned Out lets you import the immunizations into the Local Machine registry instead of just the Current User registry.