PDA

View Full Version : Reports of Spybot Search & Destroy 2.2 are clean and no virus?


Spybot_10
2013-10-24, 15:23
Search results from Spybot - Search & Destroy

22/10/2013 16:06:00
Scan took 00:34:01.
21 items found.

Badoo: [SBI $8E73A7FB] Bookmark (Firefox: Florenci (default)) (Browser: Bookmark, nothing done)


Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\User Agent

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\Mos tRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\Mo stRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Direct3D\MostRecentApplica tion\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplicati on\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\M ostRecentApplication\Name

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $99432203] Open with list - .CFG extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\FileExts\.CFG\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\RecentDocs

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

WinRAR: [SBI $B84F9965] Last used directory (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\WinRAR\General\LastFolder

Cookie: [SBI $49804B54] Browser: Cookie (1) (Browser: Cookie, nothing done)


Cache: [SBI $49804B54] Browser: Cache (5) (Browser: Cache, nothing done)


History: [SBI $49804B54] Browser: History (1) (Browser: History, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (65) (Browser: Cookie, nothing done)



--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---

2013-09-20 blindman.exe (2.2.18.151)
2013-09-20 explorer.exe (2.2.18.177)
2013-09-20 SDBootCD.exe (2.2.18.109)
2013-09-20 SDCleaner.exe (2.2.18.110)
2013-09-20 SDDelFile.exe (2.2.18.94)
2013-06-18 SDDisableProxy.exe
2013-09-20 SDFiles.exe (2.2.18.135)
2013-09-20 SDFileScanHelper.exe (2.2.16.1)
2013-10-15 SDFSSvc.exe (2.2.25.211)
2013-10-10 SDHookHelper.exe (2.3.30.2)
2013-10-10 SDHookInst32.exe (2.3.30.2)
2013-10-10 SDHookInst64.exe (2.3.30.2)
2013-09-20 SDImmunize.exe (2.2.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-10-14 SDOnAccess.exe (2.2.25.4)
2013-09-20 SDPESetup.exe (2.2.18.3)
2013-09-20 SDPEStart.exe (2.2.18.86)
2013-09-20 SDPhoneScan.exe (2.2.18.28)
2013-09-20 SDPRE.exe (2.2.18.22)
2013-09-20 SDPrepPos.exe (2.2.18.10)
2013-09-20 SDQuarantine.exe (2.2.18.103)
2013-09-20 SDRootAlyzer.exe (2.2.18.116)
2013-09-20 SDSBIEdit.exe (2.2.18.39)
2013-09-20 SDScan.exe (2.2.18.177)
2013-09-20 SDScript.exe (2.2.18.53)
2013-10-15 SDSettings.exe (2.2.25.138)
2013-09-20 SDShell.exe (2.2.18.2)
2013-09-20 SDShred.exe (2.2.18.107)
2013-09-20 SDSysRepair.exe (2.2.18.101)
2013-09-20 SDTools.exe (2.2.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-09-20 SDUpdate.exe (2.2.18.91)
2013-09-20 SDUpdSvc.exe (2.2.18.76)
2013-09-20 SDWelcome.exe (2.2.21.129)
2013-09-13 SDWSCSvc.exe (2.2.22.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-10-22 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-10-14 SDFileScanLibrary.dll (2.2.25.14)
2013-10-10 SDHook32.dll (2.3.30.2)
2013-10-10 SDHook64.dll (2.3.30.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2012-12-18 Includes\Adware.sbi (*)
2013-10-08 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-10-16 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-10-01 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-10-08 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-10-01 Includes\TrojansC-03.sbi (*)
2013-10-16 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)

___________________________________________

// info: Rootkit removal help file
// copyright: (c) 2008-2013 Safer-Networking Ltd. All rights reserved.

:: RootAlyzer Results
File:"Unknown ADS","C:\Users\Florenci\Documents\Scanned Documents\Digitalización de bienvenida.jpg:3or4kl4x13tuuug3Byamue2s4b:$DATA"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlS et\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlS et\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlS et\services\DPS\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\s ervices\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\s ervices\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\s ervices\DPS\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\s ervices\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\s ervices\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\s ervices\DPS\","Security"


PD: I have Spybot Search and Destroy 2.2, what action I have to do to eliminate these "threats"?
Spybot_10
2013-10-24, 17:46
anyone help?
tashi
2013-10-25, 03:23
Hello Spybot_10,

Not seeing anything remiss there.


6. Removing the threats found

Before you start to remove the found threats you should distinguish between usage tracks, cookies and real spyware/malware. The shown ‘Threat Level’ and ‘Type’ should help you here. If you choose to not fix a found item you just need to disable the checkbox in front of it. To finally fix the found threats please click on ‘Fix selected’.http://www.safer-networking.org/support/first-steps-tutorial/

Also, in general all items found by the RootAlyzer are not necessarily malicious. The RootAlyzer shows items which it believes to be out of the ordinary and is an analyst tool, not a scan and fix tool like the System or File Scan. :)

Best regards.
Spybot_10
2013-10-25, 11:12
Hi, thanks for answering!

I have not looked if they are threats or not ... what I have done is to give the option Fix Selected, whenever I do an analysis with spybot search and destroy and I found threats or are not is to Fix Selected option, I have done well? Habre deleted something from my computer or the registry?

no virus or something wrong with the reports I put in the post?, if they are like that I do not know and get back out on an analysis?
Spybot_10
2013-10-25, 15:23
For serving the option in System Scan, Tracking Cookies?
tashi
2013-10-25, 18:47
Hello,

For serving the option in System Scan, Tracking Cookies?
I'm not sure what you mean. :) How is the computer running in general, have you noticed any issues?

Best regards.
Spybot_10
2013-10-25, 19:06
I mean the option Tracking Cookies must be enabled or disabled? and I can reply to the message before
Spybot_10
2013-10-25, 19:09
answer me this:


Hi, thanks for answering!

I have not looked if they are threats or not ... what I have done is to give the option Fix Selected, whenever I do an analysis with spybot search and destroy and I found threats or are not is to Fix Selected option, I have done well? Habre deleted something from my computer or the registry?

no virus or something wrong with the reports I put in the post?, if they are like that I do not know and get back out on an analysis?
tashi
2013-10-25, 20:11
Hello,


answer me this:


Not seeing anything remiss there.



I mean the option Tracking Cookies must be enabled or disabled?

That is user choice, myself I prefer to control cookies within the browser as cookies will return when one visits a site. Which browser do you use? :)



How is the computer running in general, have you noticed any issues?


Best regards.
Spybot_10
2013-10-25, 20:24
Still no answer to the answer #4 or if you've done do not understand
tashi
2013-10-25, 20:51
Hi there,

Still no answer to the answer #4 or if you've done do not understand



no virus or something wrong with the reports I put in the post?,



Not seeing anything remiss there.

There does not appear to be an infection.


http://forums.spybot.info/images/misc/quote_icon.png Originally Posted by tashi http://forums.spybot.info/images/buttons/viewpost-right.png (http://forums.spybot.info/showthread.php?p=446317#post446317)
How is the computer running in general, have you noticed any issues?


Best regards.
Spybot_10
2013-10-25, 20:57
but to give the Fix Selected option to "threats" found, there will not removed anything from the computer?
Zenobia
2013-10-26, 13:55
Hi,Spybot_10. :)
Can you tell me what is happening after you press "Fix Selected"?For example,does it look like none of the items found are being fixed?
Or are the same items listed returning when you do another scan with Spybot?
Spybot_10
2013-10-26, 14:28
The first time I did an analysis and found 22 threats to Fix Selected gave him to do an analysis came back again and I found 9 threats and gave Fix Selected and went back to do another analysis and I found 4 threats, not if they are threats or not....
Zenobia
2013-10-26, 17:30
When Spybot scans,it finds threats,and it also finds Usage Tracks.This link explains what usage tracks are:
http://www.safer-networking.org/faq/usage-tracks/
If you go to the link I posted,in the upper right corner there are four flags.Clicking on each one shows the page in English,Deutch,French and Italian.
The logfile you showed above appears to mainly show usage tracks.Usage tracks aren't any harm.Usage tracks return as you use your computer,so some usage tracks will show up in later scans,depending on how much you use your computer between scans.

It's also a good idea to run the Spybot scan as administrator.When you open Spybot,you'd just rightclick System Scan and choose Run As Administrator.There is a page about that here. :)
http://www.safer-networking.org/faq/how-can-i-get-administrator-rights-under-windows-vista7/
Spybot_10
2013-10-26, 18:10
but what we are threats or not the reports I put in the post? I have done well to give on Fix selected? Habre deleted something from my computer?
Zenobia
2013-10-26, 19:23
In the main Spybot scan you reported,all of it is usage tracks,and the only thing I see that would be considered a minor threat is the badoo bookmark.
I did not look at your rootkit scan,but tashi gave you info about rootkit scans in general above. :)

Also, in general all items found by the RootAlyzer are not necessarily malicious. The RootAlyzer shows items which it believes to be out of the ordinary and is an analyst tool, not a scan and fix tool like the System or File Scan.

Yes,it was okay for you to press the Fix Selected button.

The usage tracks and bookmark would have been removed,but nothing important should have been deleted from your computer when you pressed Fix Selected.

If you would prefer to disable scanning for usage tracks,please Run Spybot Start Center as Admin,checkmark Advanced User Mode,go to Settings,open the Categories tab,rightclick within the Categories window,and select Spyware Scan Only.
Spybot_10
2013-10-26, 21:07
I have done an analysis and now I find this, here the reports:

Search results from Spybot - Search & Destroy

26/10/2013 20:27:18
Scan took 00:37:14.
14 items found.

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

Windows Explorer: [SBI $7308A845] Run history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

WinRAR: [SBI $B84F9965] Last used directory (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\WinRAR\General\LastFolder

Cookie: [SBI $49804B54] Browser: Cookie (12) (Browser: Cookie, nothing done)


Cache: [SBI $49804B54] Browser: Cache (80) (Browser: Cache, nothing done)


History: [SBI $49804B54] Browser: History (18) (Browser: History, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (60) (Browser: Cookie, nothing done)



--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---

2013-09-20 blindman.exe (2.2.18.151)
2013-09-20 explorer.exe (2.2.18.177)
2013-09-20 SDBootCD.exe (2.2.18.109)
2013-09-20 SDCleaner.exe (2.2.18.110)
2013-09-20 SDDelFile.exe (2.2.18.94)
2013-06-18 SDDisableProxy.exe
2013-09-20 SDFiles.exe (2.2.18.135)
2013-09-20 SDFileScanHelper.exe (2.2.16.1)
2013-10-15 SDFSSvc.exe (2.2.25.211)
2013-10-10 SDHookHelper.exe (2.3.30.2)
2013-10-10 SDHookInst32.exe (2.3.30.2)
2013-10-10 SDHookInst64.exe (2.3.30.2)
2013-09-20 SDImmunize.exe (2.2.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-10-14 SDOnAccess.exe (2.2.25.4)
2013-09-20 SDPESetup.exe (2.2.18.3)
2013-09-20 SDPEStart.exe (2.2.18.86)
2013-09-20 SDPhoneScan.exe (2.2.18.28)
2013-09-20 SDPRE.exe (2.2.18.22)
2013-09-20 SDPrepPos.exe (2.2.18.10)
2013-09-20 SDQuarantine.exe (2.2.18.103)
2013-09-20 SDRootAlyzer.exe (2.2.18.116)
2013-09-20 SDSBIEdit.exe (2.2.18.39)
2013-09-20 SDScan.exe (2.2.18.177)
2013-09-20 SDScript.exe (2.2.18.53)
2013-10-15 SDSettings.exe (2.2.25.138)
2013-09-20 SDShell.exe (2.2.18.2)
2013-09-20 SDShred.exe (2.2.18.107)
2013-09-20 SDSysRepair.exe (2.2.18.101)
2013-09-20 SDTools.exe (2.2.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-09-20 SDUpdate.exe (2.2.18.91)
2013-09-20 SDUpdSvc.exe (2.2.18.76)
2013-09-20 SDWelcome.exe (2.2.21.129)
2013-09-13 SDWSCSvc.exe (2.2.22.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-10-22 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-10-14 SDFileScanLibrary.dll (2.2.25.14)
2013-10-10 SDHook32.dll (2.3.30.2)
2013-10-10 SDHook64.dll (2.3.30.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2012-12-18 Includes\Adware.sbi (*)
2013-10-22 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-10-16 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-10-22 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-10-22 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-10-01 Includes\TrojansC-03.sbi (*)
2013-10-22 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)

________________________________________________________________


// info: Rootkit removal help file
// copyright: (c) 2008-2013 Safer-Networking Ltd. All rights reserved.

:: RootAlyzer Results
File:"Unknown ADS","C:\Users\Florenci\Documents\Scanned Documents\Digitalización de bienvenida.jpg:3or4kl4x13tuuug3Byamue2s4b:$DATA"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlSet\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlSet\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlSet\services\DPS\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\services\DPS\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\services\DPS\","Security"


Is everything okay? no virus? I've said that clicking on Fix selected not I delete anything important on my computer right?
Zenobia
2013-10-27, 01:02
Yes,everything looks to be okay.You aren't having any problems with your computer? :)
No,when you hit Fixed Selected,nothing important should have been deleted from your computer.
Spybot_10
2013-11-08, 23:17
Search results from Spybot - Search & Destroy

08/11/2013 22:06:53
Scan took 00:36:03.
9 items found.

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

Windows Explorer: [SBI $7308A845] Run history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-453603945-2037550232-2177108121-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Cookie: [SBI $49804B54] Browser: Cookie (1) (Browser: Cookie, nothing done)


Cache: [SBI $49804B54] Browser: Cache (5) (Browser: Cache, nothing done)


History: [SBI $49804B54] Browser: History (1) (Browser: History, nothing done)



--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---

2013-09-20 blindman.exe (2.2.18.151)
2013-09-20 explorer.exe (2.2.18.177)
2013-09-20 SDBootCD.exe (2.2.18.109)
2013-09-20 SDCleaner.exe (2.2.18.110)
2013-09-20 SDDelFile.exe (2.2.18.94)
2013-06-18 SDDisableProxy.exe
2013-09-20 SDFiles.exe (2.2.18.135)
2013-09-20 SDFileScanHelper.exe (2.2.16.1)
2013-10-15 SDFSSvc.exe (2.2.25.211)
2013-10-10 SDHookHelper.exe (2.3.30.2)
2013-10-10 SDHookInst32.exe (2.3.30.2)
2013-10-10 SDHookInst64.exe (2.3.30.2)
2013-09-20 SDImmunize.exe (2.2.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-10-14 SDOnAccess.exe (2.2.25.4)
2013-09-20 SDPESetup.exe (2.2.18.3)
2013-09-20 SDPEStart.exe (2.2.18.86)
2013-09-20 SDPhoneScan.exe (2.2.18.28)
2013-09-20 SDPRE.exe (2.2.18.22)
2013-09-20 SDPrepPos.exe (2.2.18.10)
2013-09-20 SDQuarantine.exe (2.2.18.103)
2013-09-20 SDRootAlyzer.exe (2.2.18.116)
2013-09-20 SDSBIEdit.exe (2.2.18.39)
2013-09-20 SDScan.exe (2.2.18.177)
2013-09-20 SDScript.exe (2.2.18.53)
2013-10-15 SDSettings.exe (2.2.25.138)
2013-09-20 SDShell.exe (2.2.18.2)
2013-09-20 SDShred.exe (2.2.18.107)
2013-09-20 SDSysRepair.exe (2.2.18.101)
2013-09-20 SDTools.exe (2.2.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-09-20 SDUpdate.exe (2.2.18.91)
2013-09-20 SDUpdSvc.exe (2.2.18.76)
2013-09-20 SDWelcome.exe (2.2.21.129)
2013-09-13 SDWSCSvc.exe (2.2.22.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-11-05 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-10-14 SDFileScanLibrary.dll (2.2.25.14)
2013-10-10 SDHook32.dll (2.3.30.2)
2013-10-10 SDHook64.dll (2.3.30.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2013-11-06 Includes\Adware.sbi (*)
2013-11-06 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-10-16 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2013-10-29 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-11-06 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-10-22 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2013-10-29 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-11-06 Includes\TrojansC-03.sbi (*)
2013-10-22 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)

____________________________________________________________


RootAlyzer Quick Scan Results

Files in Windows folder
----------------------------------------
111 files tested.
No hidden files detected.
========================================

Files in System folder
----------------------------------------
2322 files tested.
No hidden files detected.
========================================

Global run entries
----------------------------------------
3 values tested.
No hidden entries detected.
========================================

Winlogon entries
----------------------------------------
No keys or values tested.
No hidden entries detected.
========================================

Invisible processes (from handles)
----------------------------------------
No handle process IDs tested.
No hidden processes detected.
========================================

Invisible processes (from threads)
----------------------------------------
70 processes tested.
No hidden processes detected.
========================================

_________________________________________________________


// info: Rootkit removal help file
// copyright: (c) 2008-2013 Safer-Networking Ltd. All rights reserved.

:: RootAlyzer Results
File:"Unknown ADS","C:\Users\Florenci\Documents\Scanned Documents\Digitalización de bienvenida.jpg:3or4kl4x13tuuug3Byamue2s4b:$DATA"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlSet\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlSet\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\CurrentControlSet\services\DPS\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet002\services\DPS\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\services\WdiSystemHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\services\WdiServiceHost\","Security"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SYSTEM\ControlSet001\services\DPS\","Security"
Zenobia
2013-11-09, 01:39
The Spybot scan looks to just be tracks. :)

For the rootkit scan,please see here:
http://www.safer-networking.org/faq/are-the-found-items-really-rootkits/
If you have any questions about anything found,you can ask about them here:
http://forums.spybot.info/forumdisplay.php?46-RootAlyzer
Spybot_10
2013-11-09, 11:15
When I chose the option System Scan and I found all these "threats" or whatever you call it, will given the option Fix Selected, I have done well? ME WILL NOT DELETE ANYTHING COMPUTER? ALL IMPORTANT?

http://forums.spybot.info/showthread.php?69652-The-report-of-Spybot-Search-amp-Destroy-are-clean&p=446766#post446766
Zenobia
2013-11-09, 20:15
The things found in your Spybot scan appear to be usage tracks,which are not a threat:
http://www.safer-networking.org/faq/usage-tracks/
When you pressed Fix Selected,the things removed by Spybot should not have caused harm to your computer.
Spybot also backs up what it fixes into quarantine,just in case anything goes wrong,and can be recovered.

You seem worried about what Spybot found and a little hesitant about pressing Fix Selected.Plus I think we're having a bit of a communication problem,yes? :)
You could set Spybot not to scan for usage tracks if you would prefer.There would be less things found after a scan,and that would be less stressful for you,I think.
If you'd like to try that,please open Spybot-S&D Start Center,check mark Advanced Mode.
Click Settings.If you get a prompt from UAC,click Yes.
Click the Categories tab.
Somewhere in the white window shown there,please right click with you mouse,and select "Spyware scan only."
Please click the Apply button,and then the Ok button.That will close the Settings window,and you can exit Spybot.
Spybot_10
2013-11-09, 23:50
So I have not deleted anything important on your computer? anything at all?
Zenobia
2013-11-09, 23:55
Nope,not from the looks of things.
Spybot_10
2013-11-10, 17:36
I have uninstalled and reinstalled Spybot Search & Destroy and deleted everything I had found when you place an analysis on System scan that was in the cuerentana, I have not thought before the quarantine had when I uninstalled the program and look ... there will not erase anything on your computer? something important?
Zenobia
2013-11-11, 05:25
The quarantine folder isn't removed when you uninstall Spybot unless you remove it yourself.
translated(Sorry,I know translate tools don't always work the best.):
La carpeta de cuarentena no es eliminada cuando se desinstala Spybot a menos que se elimine usted mismo.
Spybot_10
2013-11-11, 12:12
But I deleted all traces of files that had spybot on my computer even the quarantine folder. But answer me something happens for eliminating the quarantine folder? Habre erased some of the computer? something important?
Zenobia
2013-11-11, 18:44
If you deleted the quarantine folder,any backups made by Spybot were deleted along with it.
If Spybot had removed something before by mistake(a false positive),then it is possible something that belongs on your computer would be removed.But that doesn't happen often.
But if Spybot only removed tracks and spyware and placed them as backups into your quarantine folder,then only those would be removed from your computer when you removed the quarantine folder,so there should be no harm.

Usage tracks (http://translate.google.com/translate?sl=auto&tl=es&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.safer-networking.org%2Ffaq%2Fusage-tracks%2F&act=url)