Archief - Problemen met popups check log aub

Ik heb problemen met popups en spybot en microsoft antispyware krijgen die niet weg. Kan iemand deze logfile controleren en zeggen wat ik juist moet verwijderen?
Alvast bedankt :applause:

Logfile of HijackThis v1.99.1
Scan saved at 16:16:05, on 1/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Daily Weather Forecast\weather.exe
C:\windows\sp2update00.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Katelijne\Bureaublad\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:2020
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update00.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123277763156
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\fpp4037qe.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2F0ZWxpam5l\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

tenzij gekend
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe


C:\windows\sp2update00.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
O4 - HKLM\..\Run: [sp2update] C:\windows\sp2update00.exe
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\fpp4037qe.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2F0ZWxpam5l\command.exe (file missing)

Ok ik heb alles weggedaan wat je zei maar heb nog steeds last van die popups.
Enige idee hoe ik ze weg krijg?
Hieronder mijn nieuwe logfile

Logfile of HijackThis v1.99.1
Scan saved at 17:58:20, on 1/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Daily Weather Forecast\weather.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Katelijne\Bureaublad\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:2020
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123277763156
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\c400ledm1h0a.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2F0ZWxpam5l\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

Download de trial versie van Spy Sweeper en installeer het via de 'standaard installatie'. (er word gevraagd om je e-mail adres, je kan deze gerust geven )

Er zal u gevraagd worden om de nieuwste definitie's van Spysweeper te installeren. (dit kan enkele minuten duren)

Klik dan op Options > Sweep Options en vink aan: Sweep all Folders on Selected drives. en Local Disc C. onder What to Sweep, vink je alles aan

Klik op Sweep en laat het je systeem volledig scannen.

Wanneer het scannen gedaan is, klik dan op Remove > Select All > Next.

Bij 'Results', ga naar Session Log tabblad. klik dan op Save to File en bewaar de log waar je het gemakkelijk terugvindt

Kopieer en plak dan de log hier als je volgend antwoord met een nieuw hijackthis log

Ik heb nog altijd last van die popups hieronder vind je log van spy sweeper en hijackthis

********
23:42: | Start of Session, dinsdag 1 november 2005 |
23:42: Spy Sweeper started
23:42: Sweep initiated using definitions version 564
23:42: Found Adware: look2me
23:42: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\syncmgr\ || dllname (ID = 129987)
23:42: c400ledm1h0a.dll (ID = 129987)
23:43: Starting Memory Sweep
23:43: Found Adware: icannnews
23:43: Detected running threat: C:\WINDOWS\system32\c400ledm1h0a.dll (ID = 83)
23:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:43: Detected running threat: C:\WINDOWS\system32\ahsldp.dll (ID = 83)
23:44: Memory Sweep Complete, Elapsed Time: 00:01:11
23:44: Starting Registry Sweep
23:44: Found Adware: findthewebsiteyouneed hijacker
23:44: HKU\S-1-5-21-2985638765-4145545088-1072686477-1006\software\microsoft\internet explorer\search\searchassistant explorer\main\ || default_search_url (ID = 555437)
23:44: Registry Sweep Complete, Elapsed Time:00:00:05
23:44: Starting Cookie Sweep
23:44: Found Spy Cookie: 2o7.net cookie
23:44: katelijne@2o7[1].txt (ID = 1957)
23:44: Found Spy Cookie: yieldmanager cookie
23:44: [email protected][2].txt (ID = 3751)
23:44: Found Spy Cookie: adknowledge cookie
23:44: katelijne@adknowledge[1].txt (ID = 2072)
23:44: Found Spy Cookie: ads.tripod.lycos.com cookie
23:44: [email protected][2].txt (ID = 2133)
23:44: Found Spy Cookie: adtech cookie
23:44: katelijne@adtech[2].txt (ID = 2155)
23:44: Found Spy Cookie: falkag cookie
23:44: [email protected][2].txt (ID = 2650)
23:44: [email protected][1].txt (ID = 2650)
23:44: [email protected][2].txt (ID = 2650)
23:44: Found Spy Cookie: atlas dmt cookie
23:44: katelijne@atdmt[2].txt (ID = 2253)
23:44: Found Spy Cookie: belnk cookie
23:44: [email protected][1].txt (ID = 2293)
23:44: Found Spy Cookie: azjmp cookie
23:44: katelijne@azjmp[2].txt (ID = 2270)
23:44: katelijne@belnk[2].txt (ID = 2292)
23:44: Found Spy Cookie: bluestreak cookie
23:44: katelijne@bluestreak[2].txt (ID = 2314)
23:44: Found Spy Cookie: bravenet cookie
23:44: katelijne@bravenet[2].txt (ID = 2322)
23:44: Found Spy Cookie: burstnet cookie
23:44: katelijne@burstnet[1].txt (ID = 2336)
23:44: Found Spy Cookie: wtlive.com cookie
23:44: [email protected][2].txt (ID = 3700)
23:44: [email protected][1].txt (ID = 2293)
23:44: Found Spy Cookie: fastclick cookie
23:44: katelijne@fastclick[2].txt (ID = 2651)
23:44: Found Spy Cookie: fe.lea.lycos.com cookie
23:44: [email protected][2].txt (ID = 2660)
23:44: Found Spy Cookie: fortunecity cookie
23:44: katelijne@fortunecity[2].txt (ID = 2686)
23:44: Found Spy Cookie: maxserving cookie
23:44: katelijne@maxserving[1].txt (ID = 2966)
23:44: Found Spy Cookie: metriweb.be cookie
23:44: katelijne@metriweb[1].txt (ID = 2992)
23:44: [email protected][1].txt (ID = 1958)
23:44: Found Spy Cookie: paypopup cookie
23:44: katelijne@paypopup[1].txt (ID = 3119)
23:44: [email protected][2].txt (ID = 3120)
23:44: Found Spy Cookie: realmedia cookie
23:44: katelijne@realmedia[1].txt (ID = 3235)
23:44: [email protected][1].txt (ID = 2650)
23:44: Found Spy Cookie: servlet cookie
23:44: katelijne@servlet[1].txt (ID = 3345)
23:44: Found Spy Cookie: spylog cookie
23:44: katelijne@spylog[2].txt (ID = 3415)
23:44: Found Spy Cookie: onestat.com cookie
23:44: [email protected][2].txt (ID = 3098)
23:44: Found Spy Cookie: reliablestats cookie
23:44: [email protected][1].txt (ID = 3254)
23:44: Found Spy Cookie: realtracker cookie
23:44: [email protected][2].txt (ID = 3242)
23:44: Found Spy Cookie: tradedoubler cookie
23:44: katelijne@tradedoubler[2].txt (ID = 3575)
23:44: Found Spy Cookie: tribalfusion cookie
23:44: katelijne@tribalfusion[2].txt (ID = 3589)
23:44: Found Spy Cookie: webads cookie
23:44: katelijne@webads[2].txt (ID = 3650)
23:44: Found Spy Cookie: yadro cookie
23:44: katelijne@yadro[1].txt (ID = 3743)
23:44: Found Spy Cookie: adserver cookie
23:44: [email protected][1].txt (ID = 2142)
23:44: Found Spy Cookie: zedo cookie
23:44: katelijne@zedo[2].txt (ID = 3762)
23:44: Cookie Sweep Complete, Elapsed Time: 00:00:00
23:44: Starting File Sweep
23:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:46: Found Adware: sp2ms
23:46: drsmartload[1].exe (ID = 178567)
23:46: installer[1].exe (ID = 168558)
23:46: sp2update00[1].exe (ID = 148759)
23:46: sp2update00.exe (ID = 148759)
23:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:47: Found Adware: isearch desktop search
23:47: fe69d461-c874-4613-bf13-a75ec8 (ID = 144946)
23:47: hbd.dll (ID = 163672)
23:47: Found Adware: isearch toolbar
23:47: cmdinst.exe (ID = 154747)
23:48: installer[1].exe (ID = 154747)
23:48: Found Adware: apropos
23:48: atmtd.dll (ID = 166754)
23:48: atmtd.dll._ (ID = 166754)
23:48: Warning: Invalid Stream
23:48: Warning: Invalid Stream
23:48: Warning: Invalid Stream
23:48: Warning: Invalid Stream
23:48: Warning: Invalid Stream
23:48: Warning: Invalid Stream
23:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
23:48: File Sweep Complete, Elapsed Time: 00:04:13
23:48: Full Sweep has completed. Elapsed time 00:05:33
23:48: Traces Found: 53
23:49: Removal process initiated
23:49: Quarantining All Traces: look2me
23:49: look2me is in use. It will be removed on reboot.
23:49: c400ledm1h0a.dll is in use. It will be removed on reboot.
23:49: Quarantining All Traces: apropos
23:49: Quarantining All Traces: findthewebsiteyouneed hijacker
23:49: Quarantining All Traces: icannnews
23:49: icannnews is in use. It will be removed on reboot.
23:49: C:\WINDOWS\system32\c400ledm1h0a.dll is in use. It will be removed on reboot.
23:49: C:\WINDOWS\system32\ahsldp.dll is in use. It will be removed on reboot.
23:49: Quarantining All Traces: isearch desktop search
23:49: Quarantining All Traces: isearch toolbar
23:49: Quarantining All Traces: sp2ms
23:49: Quarantining All Traces: 2o7.net cookie
23:49: Quarantining All Traces: adknowledge cookie
23:49: Quarantining All Traces: ads.tripod.lycos.com cookie
23:49: Quarantining All Traces: adserver cookie
23:49: Quarantining All Traces: adtech cookie
23:49: Quarantining All Traces: atlas dmt cookie
23:49: Quarantining All Traces: azjmp cookie
23:49: Quarantining All Traces: belnk cookie
23:49: Quarantining All Traces: bluestreak cookie
23:49: Quarantining All Traces: bravenet cookie
23:49: Quarantining All Traces: burstnet cookie
23:49: Quarantining All Traces: falkag cookie
23:49: Quarantining All Traces: fastclick cookie
23:49: Quarantining All Traces: fe.lea.lycos.com cookie
23:49: Quarantining All Traces: fortunecity cookie
23:49: Quarantining All Traces: maxserving cookie
23:49: Quarantining All Traces: metriweb.be cookie
23:49: Quarantining All Traces: onestat.com cookie
23:49: Quarantining All Traces: paypopup cookie
23:49: Quarantining All Traces: realmedia cookie
23:49: Quarantining All Traces: realtracker cookie
23:49: Quarantining All Traces: reliablestats cookie
23:49: Quarantining All Traces: servlet cookie
23:49: Quarantining All Traces: spylog cookie
23:49: Quarantining All Traces: tradedoubler cookie
23:49: Quarantining All Traces: tribalfusion cookie
23:49: Quarantining All Traces: webads cookie
23:49: Quarantining All Traces: wtlive.com cookie
23:49: Quarantining All Traces: yadro cookie
23:49: Quarantining All Traces: yieldmanager cookie
23:49: Quarantining All Traces: zedo cookie
23:49: Preparing to restart your computer. Please wait...
23:49: Removal process completed. Elapsed time 00:00:47
********
23:41: | Start of Session, dinsdag 1 november 2005 |
23:41: Spy Sweeper started
23:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
23:42: Your spyware definitions have been updated.
23:42: | End of Session, dinsdag 1 november 2005 |

----------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 0:01:26, on 2/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Daily Weather Forecast\weather.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Katelijne\Bureaublad\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:2020
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123277763156
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\irrol5931.dll
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2F0ZWxpam5l\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

ik zit met hetzelfde probleem , ook altijd die popups , heb ieder programma al geprobeerd ma ik krijg ze niet weg heel irritand als ik wil gamen ....

Heb je de pc opnieuw opgestart na de scan met spysweeper?

ik heb het zelfde probleem gehad , vijftal progs geprobeert
uiteindelijk opgegeven en geformat !

had een crack gedownd van een spel en vanaf toen had'k et

@ jownz ik heb hem inderdaad later heropstarten

van mij is het ook van een crack te downen voor een kaartspel voor mijn ouders en is dus op mijn ouders pc.

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\irrol5931.dll
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2F0ZWxpam5l\command.exe (file missing)

en die weather eens uninstallen, fixen in veilige mode!

1. Systeemherstel.
2. Is de nieuwste versie van look2me. De maker zelf heeft een uninstaller ter beschikking gesteld op http://www.ad-w-a-r-e.com/cgi-bin/UnInstaller , maar ik heb nog niemand gevonden die bevestigt dat het ook werkt. (N.B. Schrijf die code van de downloadpagina op, want je mag maar 2x per dag naar die website gaan).
3. Manuele verwijdering met VX2finder/andere programma's: http://www.pchell.com/support/look2me.shtml

N.B. Dit programma updatet zichzelf, herschrijft de hosts-file en het register, installeert steeds nieuwere versies van zichzelf, blokkeert anti-spyware,...

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll is een onderdeel van spybot, en mag blijven staan.

Die uninstaler heeft zijn werk goed gedaan bij mij. Heb er geen last meer van

Als de ontwerpers van spy/adware uninstallers aanbieden lijkt het me niet echt te vertrouwen. Mogelijk wordt er nog een hoop andere brol op de PC geplaatst.

Klopt. Alleen bevestigt de Zuid-Koreaanse maker boven zijn EULA (heb ze nu kunnen lezen :ironic: ) zwart op wit dat er geen spy- of adware wordt toegevoegd door zijn uninstaller, en bestaat zijn programma al sinds 2003. Hij neemt dan wel een groot risico als het toch spyware zou toevoegen.
Nu ja, het proberen zal wel beter zijn dan een format

Normaalgezien zou de laatste versie van Spy Sweeper de infectie verwijderen. Kan je even nakijken welke versie je gedownload hebt?
Je kan ook eens spysweeper in veilige mode laten scannen.

Doe ook nog even het volgende:

Download L2mfix op een van deze links:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Bewaar het bestand op het bureablad en dubbelklik l2mfix.exe. Klik op de Install knop en volg de instructies. Open de l2mfix map die nu op het bureaublad staat. Dubbelklik l2mfix.bat en selecteer optie #1 voor Run Find Log (typ 1 en vervolgens enter) De PC wordt gescand. Na ongeveer 2 minuten zal er een kladblokbestand openen. Kopieer de inhoud van dit logje en post het hier.

BELANGRIJK: Selecteer optie 2 NIET zolang dit niet gevraagd wordt !!!!

Heb die uninstaller toch maar geprobeerd en heb voorlopig geen problemen meer met popups dus blijkt wel goe te werken.

Mag ik dan nog een nieuw Hjt logje zien aub. Ben eens benieuwd of er nieuwe dingen zijn toegevoegd

en aan de rest die ook problemen heeft met pop-ups en zo, start uw eigen thread met een hijackthis logje of anders word dit onoverzichtelijk