Mao117

Okay, thanks again man.

Well buddy so far it seems completely fixed. Thanks a lot! P.S. it would be good if this thread isn't locked (assuming threads are locked after solutions), because in the event it comes back, I can then just post here. Thanks again!

Well thus far they seem great. I'll try one risky move - disable MB and run for a day or two to just make sure it's gone completely and MB isn't blocking it. Though no notification comes up nor any logs show that the ad came up and was blocked.

So far so good but as before, need to wait a few more days to confirm

Well whaddya know, got an opportunity so soon ComboFix.txt

Hey Jeff. As aforementioned in my first post, it's Firefox only. I suspect that's only because it's my default browser. Also, today, the ad didn't come and everything seems fine. Thought every now and then MalwareBytes says it blocked an outgoing ip address and the program name (the exe it refers to) is avast. Is that related to the ad or is it the updates of avast that are being blocked? Anyway, I shall post the results by tomorrow or day after, whenever I am able.

Well, the stupid pop-up is back. All scans are clear. MBytes did not pick anything up. The ESET online scan only picked up really old stuff I've had, mostly tools to edit windows themes and trainers for games. They're very old and I haven't used them for more than a year. ESET: C:\Users\Ammaar\Desktop\Others\DriverSweeper_3.2.0.exe Win32/OpenCandy application C:\Users\Ammaar\Desktop\Others\DTLite4453-0297.exe Win32/OpenCandy application C:\Users\Ammaar\Desktop\Others\Setup-MsgPlus-510.exe a variant of Win32/MessengerPlus.A application C:\Users\Ammaar\Desktop\Others\Setup-MsgPlus-511.exe a variant of Win32/MessengerPlus.A application C:\Users\Ammaar\Desktop\Others\SoftonicDownloader_for_open-freely.exe Win32/SoftonicDownloader.D application D:\Documents and Settings\Ammaar-117\Application Data\OpenCandy\OpenCandy_B48E56AA55A74842B96A05CCB7C830AA\RegistryReviverSetup.exe a variant of Win32/SlowPCfighter application D:\Documents and Settings\Ammaar-117\Local Settings\Temp\OpenCandy\OCSetupHlp.dll Win32/OpenCandy application D:\Documents and Settings\Ammaar-117\Local Settings\TempDIR\BetterInstaller.exe a variant of Win32/Somoto.A application D:\WINDOWS\CameraFixer.exe probably a variant of Win32/KillProc.A application E:\Programs\winamp563_full_emusic-7plus_all.exe Win32/OpenCandy application H:\Ammaar's\Downloads\DriverSweeper_2.7.5.exe Win32/OpenCandy application H:\Ammaar's\Downloads\DriverSweeper_3.1.0.exe Win32/OpenCandy application H:\Ammaar's\Downloads\MsgPlusLive-490.exe a variant of Win32/MessengerPlus application H:\Ammaar's\Downloads\Setup-MsgPlus-502.exe a variant of Win32/MessengerPlus.A application H:\Ammaar's\Downloads\Setup-MsgPlus-511.exe a variant of Win32/MessengerPlus.A application H:\Ammaar's\Downloads\SUPERsetup.exe Win32/OpenCandy application H:\Ammaar's\Downloads\VistaGlazzSetup.exe Win32/OpenCandy application

It actually works perfect now! Can you let me know what it was? Though I am waiting a bit longer to be 100% that it's fine now. But thus far, no sign of the pop-up! So thanks a lot!

Hey man, sorry I had work and yesterday and this week was really hectic, been out of the house for nearly 12 hours a day, so didn't get a proper chance to deal with this. However, weekend's here so I ran this first thing. Here you are. AdwCleanerS1.txt ComboFix.txt

Hey Jeff, thanks for the welcome and help! As requested, the files are attached. attach.txt AdwCleanerR1.txt

Whoops, forgot to attach the DDS file. dds.txt

Hi guys I've been having this strange pop-up for nearly a week now. I'm very security conscious and I have a good idea of how viruses and whatnot work, being a programmer and I have mostly manually removed viruses from my system before. This is probably the second time in nearly 6 years that I've got spyware, but this is the first time no tool has found it. So, it started as a single, random pop-up that would open every 15 or so minutes in a new tab in Firefox (my default browser). After a few days and its current behaviour, is it opening ONLY ONCE. It only opens when I start Firefox and only opens when the system starts up. But I must manually start Firefox for it to open (thus far). It does not immediately open, but after about 10 or so minutes after Firefox has started. It goes to this link: http://aff.ringtonepartner.com/geo/preset/1706/4/?subid=1793 and this link re-directs very quickly to some "mozzi" URL that contains an IQ-test. It also has logos of my local telecommunication companies at the bottom of the page. I have tried numerous programs, including Malware Bytes, SpyBot S&D, Windows Security Essentials, Avast! (my primary AV), SUPERAntiSpyware, but none of them have caught whatever it is that is causing this SEEMINGLY benign thing.