Results 1 to 4 of 4

Thread: FP only within Spybot

  1. #1
    Junior Member
    Join Date
    Oct 2014
    Posts
    2

    Default FP only within Spybot

    Hello!

    Spybot found on a total scan of my computer two
    trojans (see attached hardcopy), which I checked
    with other tools and my local virus-scanner (G Data
    Internet Security) without any detections.
    These detections started with the upgrade to
    version 2.x (from 1.6.x) of Spybot.

    My PC:
    Win 7 x64
    IE 11.0.9600.17358, FF 31.0.1 (default browser,
    with NoScript), Chrome in the most recent version
    (automatic updates on startup of that browser.
    Only usee, when Flash is required or with 'difficult'
    webpages like the registration form for this forum
    that don't tell users what is necessary to be able
    to use it, e. g. google.com has to be allowed to
    run javascript for the captcha).

    Spybot informations:

    Search results from Spybot - Search & Destroy

    2014-10-27 04:59:38
    Scan took 05:33:35.
    126 items found.

    Exploit.Anifile: [SBI $4E2AF2AC] Downloaded program file (File, nothing done)
    H:\Downloads\_SYNC\_Grafik_Webgallerie\ExifTool\Image-ExifTool-8.16.tar\Image-ExifTool-8.16\Image-ExifTool-8.16\t\images\ExtendedXMP.jpg
    Properties.size=1380
    Properties.md5=C69833A58DD0E4A761025D8298B6B328
    Properties.filedate=1224693443
    Properties.filedatetext=2008-10-22 17:37:23

    Win32.Runouce.sal: [SBI $4E2AF2AC] Downloaded program file (File, nothing done)
    H:\Downloads\_SYNC\_shared\_Tools\_Sicherheit\Anti-Rootkit\antivir_rootkit\setup.exe
    Properties.size=107512
    Properties.md5=5B2065FA6F2EC63FE28BE26FDB7B0480
    Properties.filedate=1038846780
    Properties.filedatetext=2002-12-02 17:33:00



    --- Spybot - Search & Destroy version: 2.4.40.131 DLL (build: 20140425) ---

    2014-06-24 blindman.exe (2.4.40.151)
    2014-06-24 explorer.exe (2.4.40.181)
    2014-06-24 SDBootCD.exe (2.4.40.109)
    2014-06-24 SDCleaner.exe (2.4.40.110)
    2014-06-24 SDDelFile.exe (2.4.40.94)
    2013-06-18 SDDisableProxy.exe
    2014-06-24 SDFiles.exe (2.4.40.135)
    2014-06-24 SDFileScanHelper.exe (2.4.40.1)
    2014-06-24 SDFSSvc.exe (2.4.40.217)
    2014-06-24 SDHelp.exe (2.4.40.1)
    2014-04-25 SDHookHelper.exe (2.3.39.2)
    2014-04-25 SDHookInst32.exe (2.3.39.2)
    2014-04-25 SDHookInst64.exe (2.3.39.2)
    2014-06-24 SDImmunize.exe (2.4.40.130)
    2014-06-24 SDLogReport.exe (2.4.40.107)
    2014-06-24 SDOnAccess.exe (2.4.40.11)
    2014-06-24 SDPESetup.exe (2.4.40.3)
    2014-06-24 SDPEStart.exe (2.4.40.86)
    2014-06-24 SDPhoneScan.exe (2.4.40.28)
    2014-06-24 SDPRE.exe (2.4.40.22)
    2014-06-24 SDPrepPos.exe (2.4.40.15)
    2014-06-24 SDQuarantine.exe (2.4.40.103)
    2014-06-24 SDRootAlyzer.exe (2.4.40.116)
    2014-06-24 SDSBIEdit.exe (2.4.40.39)
    2014-06-24 SDScan.exe (2.4.40.181)
    2014-06-24 SDScript.exe (2.4.40.54)
    2014-06-24 SDSettings.exe (2.4.40.139)
    2014-06-24 SDShell.exe (2.4.40.2)
    2014-06-24 SDShred.exe (2.4.40.108)
    2014-06-24 SDSysRepair.exe (2.4.40.102)
    2014-06-24 SDTools.exe (2.4.40.157)
    2014-06-24 SDTray.exe (2.4.40.129)
    2014-06-27 SDUpdate.exe (2.4.40.94)
    2014-06-27 SDUpdSvc.exe (2.4.40.77)
    2014-06-24 SDWelcome.exe (2.4.40.130)
    2014-04-25 SDWSCSvc.exe (2.3.39.2)
    2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)
    2014-07-31 spybotsd2-translation-esx.exe
    2013-06-19 spybotsd2-translation-frx.exe
    2014-08-25 spybotsd2-translation-hux2.exe
    2014-09-09 spybotsd2-translation-nlx.exe
    2014-10-01 spybotsd2-translation-nlx2.exe
    2014-09-29 unins000.exe (51.1052.0.0)
    1999-12-02 xcacls.exe
    2012-08-23 borlndmm.dll (10.0.2288.42451)
    2012-09-05 DelZip190.dll (1.9.0.107)
    2012-09-10 libeay32.dll (1.0.0.4)
    2012-09-10 libssl32.dll (1.0.0.4)
    2014-04-25 NotificationSpreader.dll
    2014-06-24 SDAdvancedCheckLibrary.dll (2.4.40.98)
    2014-04-25 SDAV.dll
    2014-06-24 SDECon32.dll (2.4.40.114)
    2014-06-24 SDECon64.dll (2.3.39.113)
    2014-06-24 SDEvents.dll (2.4.40.2)
    2014-06-24 SDFileScanLibrary.dll (2.4.40.14)
    2014-04-25 SDHook32.dll (2.3.39.2)
    2014-04-25 SDHook64.dll (2.3.39.2)
    2014-06-24 SDImmunizeLibrary.dll (2.4.40.2)
    2014-06-24 SDLicense.dll (2.4.40.0)
    2014-06-24 SDLists.dll (2.4.40.4)
    2014-06-24 SDResources.dll (2.4.40.7)
    2014-06-24 SDScanLibrary.dll (2.4.40.131)
    2014-06-24 SDTasks.dll (2.4.40.15)
    2014-06-24 SDWinLogon.dll (2.4.40.0)
    2012-08-23 sqlite3.dll
    2012-09-10 ssleay32.dll (1.0.0.4)
    2014-06-24 Tools.dll (2.4.40.36)
    2014-03-05 Includes\Adware-000.sbi (*)
    2014-01-08 Includes\Adware-001.sbi (*)
    2014-10-22 Includes\Adware-C.sbi (*)
    2014-01-13 Includes\Adware.sbi (*)
    2014-01-13 Includes\AdwareC.sbi (*)
    2010-08-13 Includes\Cookies.sbi (*)
    2014-01-08 Includes\Dialer-000.sbi (*)
    2014-01-08 Includes\Dialer-001.sbi (*)
    2014-01-08 Includes\Dialer-C.sbi (*)
    2014-01-13 Includes\Dialer.sbi (*)
    2014-01-13 Includes\DialerC.sbi (*)
    2014-01-09 Includes\Fraud-000.sbi (*)
    2014-01-09 Includes\Fraud-001.sbi (*)
    2014-03-31 Includes\Fraud-002.sbi (*)
    2014-01-09 Includes\Fraud-003.sbi (*)
    2012-11-14 Includes\HeavyDuty.sbi (*)
    2014-01-08 Includes\Hijackers-000.sbi (*)
    2014-01-08 Includes\Hijackers-001.sbi (*)
    2014-01-08 Includes\Hijackers-C.sbi (*)
    2014-01-13 Includes\Hijackers.sbi (*)
    2014-01-13 Includes\HijackersC.sbi (*)
    2014-01-08 Includes\iPhone-000.sbi (*)
    2014-01-08 Includes\iPhone.sbi (*)
    2014-01-08 Includes\Keyloggers-000.sbi (*)
    2014-09-24 Includes\Keyloggers-C.sbi (*)
    2014-01-13 Includes\Keyloggers.sbi (*)
    2014-01-13 Includes\KeyloggersC.sbi (*)
    2014-10-07 Includes\Malware-000.sbi (*)
    2014-01-09 Includes\Malware-001.sbi (*)
    2014-01-09 Includes\Malware-002.sbi (*)
    2014-02-05 Includes\Malware-003.sbi (*)
    2014-01-28 Includes\Malware-004.sbi (*)
    2014-04-15 Includes\Malware-005.sbi (*)
    2014-02-26 Includes\Malware-006.sbi (*)
    2014-01-09 Includes\Malware-007.sbi (*)
    2014-10-14 Includes\Malware-C.sbi (*)
    2014-01-13 Includes\Malware.sbi (*)
    2013-12-23 Includes\MalwareC.sbi (*)
    2014-01-15 Includes\PUPS-000.sbi (*)
    2014-01-15 Includes\PUPS-001.sbi (*)
    2014-01-15 Includes\PUPS-002.sbi (*)
    2014-10-22 Includes\PUPS-C.sbi (*)
    2012-11-14 Includes\PUPS.sbi (*)
    2014-01-07 Includes\PUPSC.sbi (*)
    2014-01-08 Includes\Security-000.sbi (*)
    2014-01-08 Includes\Security-C.sbi (*)
    2014-01-21 Includes\Security.sbi (*)
    2014-01-21 Includes\SecurityC.sbi (*)
    2014-01-08 Includes\Spyware-000.sbi (*)
    2014-01-08 Includes\Spyware-001.sbi (*)
    2014-01-08 Includes\Spyware-C.sbi (*)
    2014-01-21 Includes\Spyware.sbi (*)
    2014-01-21 Includes\SpywareC.sbi (*)
    2011-06-07 Includes\Tracks.sbi (*)
    2012-11-19 Includes\Tracks.uti (*)
    2014-01-15 Includes\Trojans-000.sbi (*)
    2014-01-15 Includes\Trojans-001.sbi (*)
    2014-01-15 Includes\Trojans-002.sbi (*)
    2014-01-15 Includes\Trojans-003.sbi (*)
    2014-01-15 Includes\Trojans-004.sbi (*)
    2014-03-19 Includes\Trojans-005.sbi (*)
    2014-07-09 Includes\Trojans-006.sbi (*)
    2014-01-15 Includes\Trojans-007.sbi (*)
    2014-07-09 Includes\Trojans-008.sbi (*)
    2014-07-09 Includes\Trojans-009.sbi (*)
    2014-10-22 Includes\Trojans-C.sbi (*)
    2014-01-15 Includes\Trojans-OG-000.sbi (*)
    2014-01-15 Includes\Trojans-TD-000.sbi (*)
    2014-01-15 Includes\Trojans-VM-000.sbi (*)
    2014-01-15 Includes\Trojans-VM-001.sbi (*)
    2014-01-15 Includes\Trojans-VM-002.sbi (*)
    2014-01-15 Includes\Trojans-VM-003.sbi (*)
    2014-01-15 Includes\Trojans-VM-004.sbi (*)
    2014-01-15 Includes\Trojans-VM-005.sbi (*)
    2014-01-15 Includes\Trojans-VM-006.sbi (*)
    2014-01-15 Includes\Trojans-VM-007.sbi (*)
    2014-01-15 Includes\Trojans-VM-008.sbi (*)
    2014-01-15 Includes\Trojans-VM-009.sbi (*)
    2014-01-15 Includes\Trojans-VM-010.sbi (*)
    2014-01-15 Includes\Trojans-VM-011.sbi (*)
    2014-01-15 Includes\Trojans-VM-012.sbi (*)
    2014-01-15 Includes\Trojans-VM-013.sbi (*)
    2014-01-15 Includes\Trojans-VM-014.sbi (*)
    2014-01-15 Includes\Trojans-VM-015.sbi (*)
    2014-01-15 Includes\Trojans-VM-016.sbi (*)
    2014-01-15 Includes\Trojans-VM-017.sbi (*)
    2014-01-15 Includes\Trojans-VM-018.sbi (*)
    2014-01-15 Includes\Trojans-VM-019.sbi (*)
    2014-01-15 Includes\Trojans-VM-020.sbi (*)
    2014-01-15 Includes\Trojans-VM-021.sbi (*)
    2014-01-15 Includes\Trojans-VM-022.sbi (*)
    2014-01-15 Includes\Trojans-VM-023.sbi (*)
    2014-01-15 Includes\Trojans-VM-024.sbi (*)
    2014-01-15 Includes\Trojans-ZB-000.sbi (*)
    2014-01-15 Includes\Trojans-ZL-000.sbi (*)
    2014-01-09 Includes\Trojans.sbi (*)
    2014-01-16 Includes\TrojansC-01.sbi (*)
    2014-01-16 Includes\TrojansC-02.sbi (*)
    2014-01-16 Includes\TrojansC-03.sbi (*)
    2014-01-16 Includes\TrojansC-04.sbi (*)
    2014-01-16 Includes\TrojansC-05.sbi (*)
    2014-01-09 Includes\TrojansC.sbi (*)

    No detections found here:
    1) 0 out of 20 scanners:
    http://virusscan.jotti.org/de/scanre...9a8c591fb15ad7

    2) 0 out of 20 scanners:
    http://virusscan.jotti.org/de/scanre...e62ec6f76a0965

    3) 0 out of 53 scanners:
    https://www.virustotal.com/de/file/4...is/1414403113/

    4) 0 out of 54 scanners:
    https://www.virustotal.com/de/file/e...is/1414403204/

    Both files are attached as zip-files (using 7-zip),
    encrypted with this password:
    false

    Regards

    Bernd Leutenecker
    Attached Images Attached Images
    Attached Files Attached Files
    Last edited by berndleutenecker; 2014-10-27 at 12:28.

  2. #2
    Member of Team Spybot micha's Avatar
    Join Date
    Oct 2005
    Posts
    31

    Default

    Your log shows that both files are triggered by the same rule (4E2AF2AC) which is not part of the Exploit.Anifile and Win32.Runonce.sal signatures.
    We recommend to download the new SB-version and install it again. Please update and try a rescan. Maybe this is some kind of bug.

  3. #3
    Junior Member
    Join Date
    Oct 2014
    Posts
    2

    Default

    Quote Originally Posted by micha View Post
    Your log shows that both files are triggered by the same rule (4E2AF2AC) which is not part of the Exploit.Anifile and Win32.Runonce.sal signatures.
    We recommend to download the new SB-version and install it again. Please update and try a rescan. Maybe this is some kind of bug.
    Hi Micha,

    Well, I will do as recommended but back in September I had downloaded
    and installed the same version 2.4 and used the update-option several times
    every day I used that computer?!

    Regards

    Bernd Leutenecker
    Last edited by berndleutenecker; 2014-10-29 at 18:50.

  4. #4
    Member of Team Spybot micha's Avatar
    Join Date
    Oct 2005
    Posts
    31

    Default

    Hello Bernd,
    We need more information.
    please send us a scaner-log und SB-log fiiles (or complete report) to fp@spybot.info. Thanks in advance!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •