[Persistent Pop-up]

Okay, thanks again man.

[Persistent Pop-up]

Well buddy so far it seems completely fixed. Thanks a lot!

P.S. it would be good if this thread isn't locked (assuming threads are locked after solutions), because in the event it comes back, I can then just post here.

Thanks again!

[Persistent Pop-up]

Well thus far they seem great. I'll try one risky move - disable MB and run for a day or two to just make sure it's gone completely and MB isn't blocking it. Though no notification comes up nor any logs show that the ad came up and was blocked.

[Persistent Pop-up]

So far so good but as before, need to wait a few more days to confirm

[Persistent Pop-up]

Well whaddya know, got an opportunity so soon

ComboFix.txt

[Persistent Pop-up]

Hey Jeff. As aforementioned in my first post, it's Firefox only. I suspect that's only because it's my default browser.

Also, today, the ad didn't come and everything seems fine. Thought every now and then MalwareBytes says it blocked an outgoing ip address and the program name (the exe it refers to) is avast. Is that related to the ad or is it the updates of avast that are being blocked?

Anyway, I shall post the results by tomorrow or day after, whenever I am able.

[Persistent Pop-up]

Well, the stupid pop-up is back.

All scans are clear. MBytes did not pick anything up.

The ESET online scan only picked up really old stuff I've had, mostly tools to edit windows themes and trainers for games. They're very old and I haven't used them for more than a year.

ESET:

C:\Users\Ammaar\Desktop\Others\DriverSweeper_3.2.0.exe    Win32/OpenCandy application
C:\Users\Ammaar\Desktop\Others\DTLite4453-0297.exe    Win32/OpenCandy application
C:\Users\Ammaar\Desktop\Others\Setup-MsgPlus-510.exe    a variant of Win32/MessengerPlus.A application
C:\Users\Ammaar\Desktop\Others\Setup-MsgPlus-511.exe    a variant of Win32/MessengerPlus.A application
C:\Users\Ammaar\Desktop\Others\SoftonicDownloader_for_open-freely.exe    Win32/SoftonicDownloader.D application
D:\Documents and Settings\Ammaar-117\Application Data\OpenCandy\OpenCandy_B48E56AA55A74842B96A05CCB7C830AA\RegistryReviverSetup.exe    a variant of Win32/SlowPCfighter application
D:\Documents and Settings\Ammaar-117\Local Settings\Temp\OpenCandy\OCSetupHlp.dll    Win32/OpenCandy application
D:\Documents and Settings\Ammaar-117\Local Settings\TempDIR\BetterInstaller.exe    a variant of Win32/Somoto.A application
D:\WINDOWS\CameraFixer.exe    probably a variant of Win32/KillProc.A application
E:\Programs\winamp563_full_emusic-7plus_all.exe    Win32/OpenCandy application
H:\Ammaar's\Downloads\DriverSweeper_2.7.5.exe    Win32/OpenCandy application
H:\Ammaar's\Downloads\DriverSweeper_3.1.0.exe    Win32/OpenCandy application
H:\Ammaar's\Downloads\MsgPlusLive-490.exe    a variant of Win32/MessengerPlus application
H:\Ammaar's\Downloads\Setup-MsgPlus-502.exe    a variant of Win32/MessengerPlus.A application
H:\Ammaar's\Downloads\Setup-MsgPlus-511.exe    a variant of Win32/MessengerPlus.A application
H:\Ammaar's\Downloads\SUPERsetup.exe    Win32/OpenCandy application
H:\Ammaar's\Downloads\VistaGlazzSetup.exe    Win32/OpenCandy application

[Persistent Pop-up]

It actually works perfect now! Can you let me know what it was?

Though I am waiting a bit longer to be 100% that it's fine now. But thus far, no sign of the pop-up! So thanks a lot!

[Persistent Pop-up]

Hey man, sorry I had work and yesterday and this week was really hectic, been out of the house for nearly 12 hours a day, so didn't get a proper chance to deal with this. However, weekend's here so I ran this first thing.

Here you are.

AdwCleanerS1.txt

ComboFix.txt

[Persistent Pop-up]

Hey Jeff, thanks for the welcome and help!

As requested, the files are attached.

attach.txt

AdwCleanerR1.txt

[Persistent Pop-up]

Whoops, forgot to attach the DDS file.

dds.txt

[Persistent Pop-up]

Hi guys

I've been having this strange pop-up for nearly a week now.

I'm very security conscious and I have a good idea of how viruses and whatnot work, being a programmer and I have mostly manually removed viruses from my system before. This is probably the second time in nearly 6 years that I've got spyware, but this is the first time no tool has found it.

So, it started as a single, random pop-up that would open every 15 or so minutes in a new tab in Firefox (my default browser).

After a few days and its current behaviour, is it opening ONLY ONCE. It only opens when I start Firefox and only opens when the system starts up. But I must manually start Firefox for it to open (thus far). It does not immediately open, but after about 10 or so minutes after Firefox has started.

It goes to this link: http://aff.ringtonepartner.com/geo/preset/1706/4/?subid=1793

and this link re-directs very quickly to some "mozzi" URL that contains an IQ-test. It also has logos of my local telecommunication companies at the bottom of the page.

I have tried numerous programs, including Malware Bytes, SpyBot S&D, Windows Security Essentials, Avast! (my primary AV), SUPERAntiSpyware, but none of them have caught whatever it is that is causing this SEEMINGLY benign thing.