BleepingComputer.com: I Am Having Spyware Problems

I am having Spyware problems. Although my NAV stays current, I had no idea until I installed and ran Spybot, Monday evening. I googled for help and found this forum and "boopme's" May 2008 answer to someone else having SPYWARE problems. I just became a new member. While SPYBOT was doing its thing, a dialogue box popped up indicating to check SpywareC.sbi in the “Includes” folder Programs/Spybot. That was not all I found(please see “pasted” logs and text). Should everything be removed ? I am not having any problems, per se, with popups, but I do get a dialogue box(sorry for lack of exact quote) advising me that the webpage I wish to open is having a problem. I “click” OK and so far they have opened. I am running XP Home SP2, NAV, SPYBOT(as of today) and have 512 of RAM and am current on updates. Any thoughts on what to do? Thank you in advance.


--- Report generated: 2008-07-21 19:40 ---

Zango: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{5937CD7F-1C0B-41E1-9075-60EBDF3C7D34}

Zango: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-2785964404-2077986522-2896297567-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56F1D444-11BF-4879-A12B-79CF0177F038}

Hotbar: Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Wallpaper.WallpaperManager

Hotbar: Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Wallpaper.WallpaperManager.1

Hotbar: Class ID (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8109FD3D-D891-4F80-8339-50A4913ACE6F}

Zlob.Downloader.oid: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-2785964404-2077986522-2896297567-1005\Software\Online Add-on

Zlob.Downloader.vdt: User settings (Registry value, nothing done)
HKEY_USERS\S-1-5-21-2785964404-2077986522-2896297567-1005\Software\Online Add-on\Path=...C:\Program Files\Video Add-on...

Zlob.Downloader.vdt: Program directory (Directory, nothing done)
C:\Program Files\Video Add-on\


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-03-06 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-07-31 Tools.dll (2.1.2.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2008-07-15 Includes\Adware.sbi (*)
2008-07-15 Includes\AdwareC.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-06-03 Includes\Dialer.sbi (*)
2008-07-07 Includes\DialerC.sbi (*)
2008-07-11 Includes\HeavyDuty.sbi (*)
2008-07-10 Includes\Hijackers.sbi (*)
2008-07-08 Includes\HijackersC.sbi (*)
2008-07-15 Includes\Keyloggers.sbi (*)
2008-07-15 Includes\KeyloggersC.sbi (*)
2008-07-16 Includes\Malware.sbi (*)
2008-07-16 Includes\MalwareC.sbi (*)
2008-07-15 Includes\PUPS.sbi (*)
2008-07-15 Includes\PUPSC.sbi (*)
2007-11-07 Includes\Revision.sbi (*)
2008-06-18 Includes\Security.sbi (*)
2008-07-08 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-07-11 Includes\Spyware.sbi (*)
2008-07-15 Includes\SpywareC.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-07-15 Includes\Trojans.sbi (*)
2008-07-21 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll

Your Spybot log indicates you are using an outdated version (1.4) of the program. It was updated to v1.5 last year and then again recently updated to v1.6. I suggest you remove that version and update to the current one which can be download from here.

I also recommend you do the following:

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
  
• Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Reagardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Thank you for you help and input. I'm not the brightest bulb in the bunch. I was looking for an email notification but for some reason I didn't get it, soooo it took me a little while to properly navigate and find your reply. I followed all of your instructions. Below is a cut and paste of my log.
Spybot has been updated to v1.6. Was it necessary to uninstall 1.4 then install the current version? Wellll, I didn't. Was that kosher?
Have a good day and any additional input would be greatly appreciated.

Malwarebytes' Anti-Malware 1.22
Database version: 984
Windows 5.1.2600 Service Pack 2

9:32:46 AM 7/23/2008
mbam-log-7-23-2008 (09-32-46).txt

Scan type: Quick Scan
Objects scanned: 42141
Time elapsed: 4 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{85e06077-c824-43d0-a8dc-5efb17bc348a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5937cd7f-1c0b-41e1-9075-60ebdf3c7d34} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Online Add-on (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Video Add-on (Trojan.Zlob) -> Quarantined and deleted successfully.

Files Infected:
(No malicious items detected)

While Spybot can install over an existing version, it is recommended that you first uninstall the old before upgrading to the latest version.

Rescan again with MBAM. Don't forgot to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.

Scanned, rebooted and here is the log. How do things look now? Question, with Spybot installed and mbam, I first run Spybot, then "fix it" if any items show up there, then run mbam? Since I installed v1.6 over v1.4, should I attempt to uninstall it and reinstall it, and are there any precautions I should be aware of if doing so?


Malwarebytes' Anti-Malware 1.22
Database version: 984
Windows 5.1.2600 Service Pack 2

2:17:14 PM 7/23/2008
mbam-log-7-23-2008 (14-17-14).txt

Scan type: Quick Scan
Objects scanned: 41991
Time elapsed: 5 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)


nnnn

Your MBAM log is clean.

If you want to remove Spybot and start fresh, see How to Uninstall Spybot S&D.

If this your my system, I would probably remove it altogether and keep MBAM and SUPERAntiSpyware Free which IMO are both more effective.

Are you having any further issues?

I did not mean to take so long returning a response to you, but got busy on the personal side. Also, followed up on the links you referred me to @ the Spybot site. After reading the about "quarantined files", I got more confused as to their function and if they are to remain although the Spybot itself is deleted(via Add/Delete).

Quote:
(Please note that the Application Data Folder is hidden. So if you cannot find this folder please check your folder properties. For an instruction, please click here.)

Explanation: this folder contains the backup (the quarantined files) that Spybot-S&D creates. If the Uninstall would remove this folder as well, this would mean that those backups would be gone. We saw it a few times that new users uninstalled Spybot-S&D in panic after they have experienced a small problem, thus removing the backup that would have undone any changes
Unquote!

So this new user has held off on deleting Spybot to make sure I will not inadvertently create myself another headache.
You have patiently resolved my original concerns and I thank you so much. I was expecting to have a lot more steps to go through.

After thought: You probably would rather me contact Spybot about my last concern. Hey, the grey matter operates sometimes at substandard speed:). Thanks again.

You're welcome.