SpyBot problem med Smitfraud-C

En log fra hijackthis kan måske kaste lys over sagen: http://www.arlet.dk/hjt.exe
Vejledning: http://www.spywarefri.dk/hijackthis.man.htm

Her følger en log.
Håber der er een kyndig der kan se på den ;-)

---

Logfile of HijackThis v1.99.1
Scan saved at 21:47:47, on 27-08-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Ellen\Skrivebord\Hijackprogram\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {86ACB8C1-008E-449E-A4CA-93EC2B4B7124} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {86ACB8C1-008E-449E-A4CA-93EC2B4B7124} - (no file) (HKCU)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v6.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Umiddelbart ser din log pæn ud.
Prøv Dr.Web og Ewido, efter vejledningen i denne artikel:
http://eksperten.dk/artikler/755

Så har jeg været igennem de to scannere. den sidste fandt noget snavs, men har stadig problemer med smitfraud-C i spyBot :-(

Hvor finder Spybot Smitfraud?

Er det dette du efterlyser?

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\www.niger.ru\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\www.6o9.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webpidor.biz\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\visitfriend.net\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\veryeasysearch.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\v-224.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\u48.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\u47.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\u46.cx\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\u45.cx\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\tracking.allposters.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\toprefsys.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\terra.hcworld.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\t34rulit.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\super-spider.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\solongas.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\s2.kav.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\s13.remove.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\rf104.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\new.8ad.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\msnprotection.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\meetyourfriend.biz\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\makechoice.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\love-catalog.net\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\letgohome.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\greg-tut.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ga31.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\fuck-fuck.org\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\fast-look.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ewizard.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\e-finder.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dl.ad-ware.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\datingforlove.org\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\crl.thawte.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\cc20foreva.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bin.wordsx.cc\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adulthell.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\75tz.com\*!=W=4

Smitfraud-C.: User settings (Registreringsdatabaseændring, nothing done)
  HKEY_USERS\S-1-5-21-1957994488-839522115-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\20x2p.com\*!=W=4


--- Spybot - Search && Destroy version: 1.3  ---
2005-04-26 Includes\Cookies.sbi
2005-08-26 Includes\Dialer.sbi
2005-08-26 Includes\Hijackers.sbi
2005-08-16 Includes\Keyloggers.sbi
2004-11-29 Includes\LSP.sbi
2005-08-26 Includes\Malware.sbi
2005-08-12 Includes\PUPS.sbi
2005-04-27 Includes\Revision.sbi
2005-08-25 Includes\Security.sbi
2005-08-16 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-08-26 Includes\Trojans.sbi

Det var det nu ikke, men det giver da anledning til at kunne berolige dig.
HKEY_USERS\...\Internet Settings\ZoneMap\Domains\75tz.com\*!=W=4
Betyder at siden ligger i klassificerede websteder, og *!=W=4 betyder at siden er blokeret.
Har du opdateret Spybot inden du kørte den?
Hvilken version af Spybot bruger du?
Den nyeste hedder 1.4

ja har opdateret inden jeg scannede, men kan se at det er v. 1,3 jeg benytter. Hvordan får jeg den opgraderet til 1,4 hvis ikke gennem "søg efter opdateringer"?

Så bliver du nødt til at afinstallere i Tilføj/fjern programmer, genstarte og hente en ny Spybot her:
http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10122137.html

tak skal du have. tror jeg stopper for i aften så, da det ikke er verdens mest kritiske feljmelding som du siger.
Ser om jeg kan nå det imorgen. tak for hjælpen for nu... :-)