Får hele tiden pop-ups?

Nu kan jeg se du har Counter-strike installeret, er det kun når du bruger det?
For jeg har samme problem men det er kun i CS.

Nej, jeg får bare ligepludslig sådan pop-ups, men det er imens jeg er inde i cs jeg har fået pop-ups, indtil videre.

Ja men det er også det jeg siger at der pludseligt er kommet et pop-up mens du er inde i CS.
Mine kommer så frem når jeg skifter server eller reconnercter ect.

Okay, tror du det er virus? Eller bare et eller andet andet shit?

Prøv at afinstallere Messenger+, hvis du har det installeret.

Hent så NoLop.exe og gem den på skrivebordet:
http://www.spywareedge.net/nolop/NoLop.exe

Kør programmet. Tryk på "Search and Destroy"-knappen. Hvis den finder noget, bliver du bedt om at trykke på Reboot-knappen. Dette skal du så gøre.

Efter genstarten har NoLop.exe lavet en log-fil, der ligger her: C:\NoLop.txt
Kopiér indholdet af denne fil herind sammen med en ny log fra Hijackthis.

NoLop LOGGEN:

NoLop! Log by Skate_Punk_21

Fix running from: C:\Documents and Settings\Christian.CHRILLE\Skrivebord
[06-12-2006]
[21:34:07]

---Infection Files Found/Removed---
NO INFECTION FILES FOUND - Cleaning Aborted.

---Listing AppData sub directories---

C:\Documents and Settings\Administrator\Application Data\Identities
C:\Documents and Settings\Administrator\Application Data\Microsoft
C:\Documents and Settings\Administrator\Application Data\Symantec
C:\Documents and Settings\Administrator.chrille\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Adobe Systems
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Macromedia
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Msn Search Toolbar
C:\Documents and Settings\All Users\Application Data\Skype  -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users.windows.002\Application Data\Adobe
C:\Documents and Settings\All Users.windows.002\Application Data\Apple Computer
C:\Documents and Settings\All Users.windows.002\Application Data\Avanquest Software
C:\Documents and Settings\All Users.windows.002\Application Data\Avg7
C:\Documents and Settings\All Users.windows.002\Application Data\Bvrp Software
C:\Documents and Settings\All Users.windows.002\Application Data\Comodo
C:\Documents and Settings\All Users.windows.002\Application Data\Google
C:\Documents and Settings\All Users.windows.002\Application Data\Grisoft
C:\Documents and Settings\All Users.windows.002\Application Data\Microsoft
C:\Documents and Settings\All Users.windows.002\Application Data\Nview_profiles  -- EMPTY Directory
C:\Documents and Settings\All Users.windows.002\Application Data\Smart Technologies Inc
C:\Documents and Settings\All Users.windows.002\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users.windows.002\Application Data\Symantec
C:\Documents and Settings\All Users.windows.002\Application Data\Windows Genuine Advantage
C:\Documents and Settings\Christian.chrille\Application Data\Adobe
C:\Documents and Settings\Christian.chrille\Application Data\Apple Computer
C:\Documents and Settings\Christian.chrille\Application Data\Arcsoft
C:\Documents and Settings\Christian.chrille\Application Data\Avg7  -- EMPTY Directory
C:\Documents and Settings\Christian.chrille\Application Data\Bsplayer
C:\Documents and Settings\Christian.chrille\Application Data\Comodo
C:\Documents and Settings\Christian.chrille\Application Data\Google
C:\Documents and Settings\Christian.chrille\Application Data\Help  -- EMPTY Directory
C:\Documents and Settings\Christian.chrille\Application Data\Identities
C:\Documents and Settings\Christian.chrille\Application Data\Jasc
C:\Documents and Settings\Christian.chrille\Application Data\Lavasoft
C:\Documents and Settings\Christian.chrille\Application Data\Limewire
C:\Documents and Settings\Christian.chrille\Application Data\Macromedia
C:\Documents and Settings\Christian.chrille\Application Data\Microsoft
C:\Documents and Settings\Christian.chrille\Application Data\Mozilla
C:\Documents and Settings\Christian.chrille\Application Data\Skype
C:\Documents and Settings\Christian.chrille\Application Data\Slickrun
C:\Documents and Settings\Christian.chrille\Application Data\Smart Technologies Inc
C:\Documents and Settings\Christian.chrille\Application Data\Sun
C:\Documents and Settings\Christian.chrille\Application Data\Superantispyware.com
C:\Documents and Settings\Christian.chrille\Application Data\Symantec  -- EMPTY Directory
C:\Documents and Settings\Christian.chrille\Application Data\Teamspeak2
C:\Documents and Settings\Christian.chrille\Application Data\Trojanhunter
C:\Documents and Settings\Christian.chrille\Application Data\Ventrilo
C:\Documents and Settings\Christian.chrille\Application Data\Vlc
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Default User.windows.002\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Localservice.nt Authority\Application Data\Avg7  -- EMPTY Directory
C:\Documents and Settings\Localservice.nt Authority\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Symantec
C:\Documents and Settings\Networkservice.nt Authority\Application Data\Microsoft

HJT LOGGEN:

Logfile of HijackThis v1.99.1
Scan saved at 21:36:13, on 06-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.002\System32\smss.exe
C:\WINDOWS.002\system32\winlogon.exe
C:\WINDOWS.002\system32\services.exe
C:\WINDOWS.002\system32\lsass.exe
C:\WINDOWS.002\system32\svchost.exe
C:\WINDOWS.002\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS.002\system32\spoolsv.exe
C:\WINDOWS.002\ATKKBService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS.002\system32\nvsvc32.exe
C:\WINDOWS.002\system32\svchost.exe
C:\WINDOWS.002\Explorer.EXE
C:\WINDOWS.002\system32\WgaTray.exe
C:\WINDOWS.002\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS.002\vsnpstd3.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Messenger\msmsgs.exe
C:\programmer\valve\steam\steam.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500USB.exe
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\WINDOWS.002\system32\wuauclt.exe
C:\WINDOWS.002\system32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Christian.CHRILLE\Skrivebord\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS.002\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS.002\vsnpstd3.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.002\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS.002\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\CHRIST~1.CHR\LOKALE~1\Temp\MsgPlusUninstall.exe" /Cleanup
O4 - HKCU\..\Run: [Steam] "c:\programmer\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: RaConfig2500USB.lnk = C:\Programmer\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500USB.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted Zone: *.www.n.dk
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.002\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS.002\ATKKBService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.002\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe

- Håber det var fint ejvindh :-)

- Du får pointene når du har lagt et svar/kommentar til det det log tingeling :P

Jeps, loggen er ren. Det hjalp at afinstallere Messenger+, der kommer med spyware, hvis man ikke husker at sige nej tak til sponsor-programmet.

For at gøre arbejdet helt færdig:
Det kan være en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.
Og så kan det også være en god ide at skjule dine systemfiler og -mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Det kan også være en god ide at få renset ud i dine midlertidige filer. Det kan gøres på en hurtig og nem måde med denne fil
www.spywareinfo.dk/download/cleantempxp2k.bat
---------------------------

For at forhindre gentagelser, vil jeg anbefale dig at lægge nogle små programmer ind, som forhindrer spyware i at komme ind i første omgang. Du finder links og gode råd her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Jeg vil også foreslå, at du læser disse artikler om hvordan du kan undgå at blive inficeret i fremtiden:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://www.ejvindh.net/viewtopic.php?t=37

ejvind> gider du kigge på min også, jeg har nemlig samme problem?

^^ http://www.eksperten.dk/spm/749356

RIGTIG MANGE TAK :-)

www.spywareinfo.dk/download/cleantempxp2k.bat - det link virker ikke :/?

- jo på ie gør det sq :D

Du er velkommen :-)

Den der .bat fil, der kommer bare hurtigt sådan et vindue der lige cmd, og så går den væk igen, er det normalt :D?

Det er som det skal være :-)

Okay :-), hvilke mapper er det den ryder op i?

Dine midlertidige mapper.

Altså, dokumenter, mapper i C:\ osv?

Hvis du åbner filen med Notepad, kan du se hvilke mapper det er den sletter:

RD /s /q "%temp%"
MD "%temp%"
RD /s /q "%tmp%"
MD "%tmp%"
RD /s /q "%windir%\Temp"
MD "%windir%\Temp"
RD /s /q "%userprofile%\Local Settings\Temp"
MD "%userprofile%\Local Settings\Temp"
RD /s /q "%userprofile%\Lokale indstillinger\Temp"
MD "%userprofile%\Lokale indstillinger\Temp"
del %windir%\prefetch\*.* /f /q
del c:\*.tmp /f /q

Den præcise placering på variablerne (angivet med %%) kan du få ved ude i et dosprompt, at skrive set (efterfulgt af return).