Hulp gevraagd met removen spyware

[Verwijderd]

Ik heb sinds vandaag een zeer irritante soort van spyware op mijn pc.
Hij laadt om de 3 min. een pop-up pagina.
Een voorbeeld is deze : http://www.health-yshopping.com/tau.html
http://www.mediapurchases.com/tau.html
Verder komt er soms een kleine pop-up die telkens op de voorgrond zit en niet weg kunt klikken. De ene keer is het nieuws de andere keer over een job vinden, en er staat telkens click here.

Verder is mijn norton virusscanner automatisch uitgeschakeld en kan ik hem niet meer ineschakelen.
Ik heb met add aware en spybot alle gedetecteerde bestanden verwijderd.
ook in configuratiescherm --> software, opgeschoond.

Er is nog iets merwaardigs: met Hijack verwijder ik telkens het bestand C:/Windows/system32/DfsIq4.exe , maar het komt telkens terug
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\NxhId09.exe
C:\WINDOWS\System32\Suh8.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jan\Mijn documenten\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.standbyservice.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.standbyservice.nl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [5@72ZH82JG88MJ] C:\WINDOWS\system32\DfsIq4.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\k4080edueh080.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


Kan iemand me helpen[/img][/img][/img]

[SpamLame]

Kijk hier eens naar O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\k4080edueh080.dll

http://www.google.nl/sear...rg.mozilla:en-US:official


En DfsIq4.exe

http://www.google.nl/sear...rg.mozilla:en-US:official

[ Voor 27% gewijzigd door SpamLame op 19-04-2006 16:45 ]

[wizzzzzz]

Dit lijkt op spyaxe spyware. Zoek eens op het tooltje Smitrem, draai dit eens in veilige modus.

[Verwijderd]

de pop up die je niet weg krijgt en telkens op de voorgrond blijft heeft de url :
http://www.ad-w-a-r-e.com...ting01.swf&keyword=dating

[SpamLame]

Verwijderd schreef op woensdag 19 april 2006 @ 17:30:
de pop up die je niet weg krijgt en telkens op de voorgrond blijft heeft de url :
http://www.ad-w-a-r-e.com...ting01.swf&keyword=dating

Ja en....wat wil je daarmee bereiken.
Ben veel meer geintresseerd in wat je met hetgeen wat wizzzzz zei en mijn aanwijzingen mbt tot de programma's (welke) gedaan hebt.

[Verwijderd]

smitRem lost het probleem niet op

[Ramzzz]

En Hitman Pro? Wellicht zal dat draaien helpen? Of is dat niet de vraag, los het op?

http://www.hitmanpro.nl/

[ Voor 40% gewijzigd door Ramzzz op 22-04-2006 22:16 ]

[usgaap]

Er hebben hier op GoT verschillende topics gestaan over deze infectie, de zgn Look2Me, kijk hier eens.

Probeer iig in veilige modus met systeemherstel uit alle bijgewerkte anti-virusscanners erop los te laten.

Anders hier en hier

[ Voor 22% gewijzigd door usgaap op 22-04-2006 22:21 . Reden: 2 url's toegevoegd ]

[Martijnc]

Hallo,

Je zit inderdaad met een look2me infectie. voer onderstaande stappen uit:

Download Look2Me-Destroyer.exe naar je bureaublad.

• Sluit alle open vensters.
• Dubbelklik Look2Me-Destroyer.exe om het te starten.
• Zet een vinkje naast Run this program as a task.
• Je zal een melding krijgen met: 'Look2Me-Destroyer will close and re-open in approximately 1 minute'. Klik OK
• Wanneer Look2Me-Remover opnieuw opent, Klik de Scan for L2M knop.
• Je bureaublad icoontjes en taakbalk zullen verdwijnen, dit is normaal.
• Eénmaal gedaan met scannen, klik de Remove L2M knop.
• Je zal de boodschap Done Scanning krijgen, klik OK.
• Nadien zal je volgende melding krijgen: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klik OK.
• Je computer zal dan afsluiten.
• Start je computer opnieuw op.
• Post de inhoud van C:\Look2Me-Destroyer.txt samen met een nieuw volledig hijackthislogje(inclusief headers).

Indien je een alert krijgt van je firewall dat dit programma probeert toegang te krijgen met het internet, sta het toe en blokkeer het niet!

Indien je een runtime error '339' krijgt, download MSWINSCK.OCX via onderstaande link en plaats het in je C:\Windows\System32 map.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

[ Voor 4% gewijzigd door Martijnc op 23-04-2006 20:14 ]

[Verwijderd]

Die llok2me destroyer heeft waarschijnlijk geholpen, weet het niet zeker:

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 25-4-2006 11:20:35

Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000317.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000335.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000352.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000357.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000361.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000373.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000382.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000387.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000398.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000408.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000425.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000434.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000435.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000436.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000441.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000442.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000443.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007848.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007849.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007850.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007851.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007852.dll
Infected! C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007853.dll

Attempting to delete infected files...

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000317.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000317.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000335.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000335.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000352.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000352.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000357.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000357.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000361.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000361.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000373.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000373.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000382.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000382.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000387.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000387.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000398.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000398.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000408.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000408.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000425.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000425.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000434.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000434.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000435.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000435.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000436.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000436.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000441.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000441.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000442.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000442.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000443.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP2\A0000443.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007848.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007848.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007849.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007849.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007850.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007850.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007851.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007851.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007852.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007852.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007853.dll
C:\System Volume Information\_restore{260515A9-3E33-412C-BF0D-2A5F49AC88C2}\RP3\A0007853.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Management

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{1260C669-2395-47C9-B49B-D3833C20337F}"
HKCR\Clsid\{1260C669-2395-47C9-B49B-D3833C20337F}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BC4E9C0A-9D20-4D39-BDF0-275B6EA8A86E}"
HKCR\Clsid\{BC4E9C0A-9D20-4D39-BDF0-275B6EA8A86E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{924DC986-37F7-465F-8DCF-D82B86B53724}"
HKCR\Clsid\{924DC986-37F7-465F-8DCF-D82B86B53724}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3AD6258F-3BE1-44B7-BEB6-3165A72155A9}"
HKCR\Clsid\{3AD6258F-3BE1-44B7-BEB6-3165A72155A9}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{1413009A-A41B-4249-82E3-85BD0AF848B9}"
HKCR\Clsid\{1413009A-A41B-4249-82E3-85BD0AF848B9}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded


HIjack loG:


Logfile of HijackThis v1.99.1
Scan saved at 16:09:20, on 25-4-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jan\Mijn documenten\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.standbyservice.nl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

[Martijnc]

Hallo,

Je logje ziet er goed uit nu

[Verwijderd]

Hartstikke bedankt!

[Verwijderd]

Ook hier bedankt voor je aanwijzing en uitleg voor die Look2Me Destroyer.

[Verwijderd]

Hallo, ook ik zit met dit probleem, maar de Look2Me-Destroyer loopt bij mij vast, doet helemaal niks wanneer ik op run heb gedrukt verschijnt er inderdaad een nieuw scherm van de destroyer maar die reageert vervolgens niet. Iemand enig idee wat hier de oorzaak van kan zijn?

[Martijnc]

Probeer eens met l2mfix

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe