[joshuacat]

SpyBlaster - It will protect you from most spy/foistware in it's database by blocking installation of their ActiveX objects and cookie objects. Yes, it will protect you while it is closed. You just have to make sure that you update it periodically to ensure that it will block the latest ActiveX objects and cookie objects related to spy/foistware.

Sorry, here's a better link to use for Sygate.
http://smb.sygate.co...pf_download.htm

Back to your problem...

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Please reply to this post with a new HiJackThis log and the scan log from the Kaspersky online scan.

[Advertisements]

i have a problem. i went to the site "why did i get infected in the first place?" i went through almost all of the steps, downloading the programs with it. i downloaded spyware guard and microsoft antispyware beta. i used the microsoft program and scanned my computer, not knowing of what not to do, i removed all of the files after the scan was finished. i saw the things it was removing, and what i saw were the !killbox files that u created for me. what should i do? should i even have those programs? it seems to me that i am just downloading all of the programs. it seems like there r too many. am i right to feel this way?

[gpsugy]

i have a problem. i went to the site "why did i get infected in the first place?" i went through almost all of the steps, downloading the programs with it. i downloaded spyware guard and microsoft antispyware beta. i used the microsoft program and scanned my computer, not knowing of what not to do, i removed all of the files after the scan was finished. i saw the things it was removing, and what i saw were the !killbox files that u created for me. what should i do? should i even have those programs? it seems to me that i am just downloading all of the programs. it seems like there r too many. am i right to feel this way?

[joshuacat]

A layered approach is the best approach to take. I use the following for Spyware detection/protection: SpyBot, Ad-aware, MS AntiSpyware, Spyware Guard, and Spyware Blaster. For a firewall, I use ZoneAlarm. My antivirus is AVG free edition. You will find that many of the other malware fighters on this site and others use a layered approach.

Of course, you should only use one firewall and one Antivirus program. Running more than one Antivirus/Firewall can cause problems.

Don't worry about the c:\!killbox directory, they were all the BAD files we removed with Killbox.
KillBox creates the backup directory in case we remove something that is valid, and we have something to go back to.

[gpsugy]

sorry, but i have one more question. i double clicked the spf.exe file to install my spyate firewall, but i see no icon appear on my desktop. does this still mean that i have successfully gotten a firewall? how do i know?

[joshuacat]

Did you read and do this? ==> http://smb.sygate.co...spf_install.htm

[gpsugy]

also, i am starting your instructions with kapersky. i have clicked the link, and it brings me to a "kapersky lab" site. i see no activex notification and all of the things u told me to do.

can i get your firewall, zone alarm? i have downloaded spyate, but when it was active, it asked me to do all of these things with programs and such and registering. it was a little too hectic, and i was afraid it was unsafe, so i uninstalled it. i went to zonelabs, but i don't exactly know where to go. sorry for not having the ability to understand things well.

Edited by gpsugy, 16 December 2005 - 09:03 PM.

[joshuacat]

Okay, let's hold off on both the Kaspersky scan and loading the firewall at this time. A firewall can be confusing at first, so I don't want to get into too many issues with it, and stray too far from your issue. I am wondering if the Microsoft Antispyware program cleaned up a little more of the items that you mentioned below:

Advertising.com
Avenue A, Inc.
DoubleClick
FastClick
TargetNet
ValueClick

Could you run a scan again with SpyBot and Ad-aware and let me know if anything is detected.
If so, copy the result back here as you did before. Also, let me know if you have any remaining symptoms of spyware/viruses. Are the Jeefo alerts gone?

Thanks.

[gpsugy]

ok, i have finished the scans. and yes, the jeefo alert is gone. also, only ad-aware found items. these r the items found:

they were all tracking cookies - IECache Entrys

tradedoubler[1].txt
as1.falkag[2].txt
statcounter[1].txt

[joshuacat]

That's great! I did some research on the items you mentioned above, and they were tracking cookies as well.
Some of the protection that you already installed will help prevent these, or they will allow you to delete them if they show up. On my computer, I get a few cookies each time I do a scan.

Do you want me to look at a fresh HiJackThis log before I send you on you way?

If so, post back with a new HiJackThis log.

[gpsugy]

ok, but can u help me with my firewall and everything so that my computer is completely safe?
here is my hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 4:03:31 PM, on 12/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ghang Family\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: RaptisoftGameLoader - http://www.miniclip....tgameloader.cab
O16 - DPF: {00001016-A15C-11D4-97A4-0050BF0FBE67} (NetmarbleStarter16 Class) - http://www.netmarble...NMStarter16.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab30149.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan....r/axscanner.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {85AF9A98-3423-45E4-8BAD-85645F16AC31} (P3 Bugs VoD Loader Class) - http://player.bugs.c.../mv/p3bvset.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://www.spgame.co...game/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.c...l/mv/XTools.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

[joshuacat]

gpsugy:
Before you do anything, I suggest that you read through the following tutorials...

There is also a brief tutorial put out by ZoneAlarm, please read through it before you do the installation.
ZoneAlarm Tutorial

There is another excellent tutorial that you can read here about Firewalls. Understanding and Using Firewalls

To download ZoneAlarm, please go to the link below:
ZoneAlarm Download

It will take a little while before ZoneAlarm learns what programs on your computer are to be trusted.
Everytime you open a program that connects to the internet, it will ask you if you want to trust the program to connect to the internet. The first time you use Internet Explorer, Firefox, it will prompt you for acceptance of those programs . It will prompt you for acceptance the first time you run updates with - SpyBot, Ad-Aware, Microsoft Anti-Spyware, and Spyware Blaster. If you open Windows Media Player, Real Player, Aim, E-mail, or ANY other program that connects to the internet, it will ask you if the program can be trusted.

The point is, it will take ZoneAlarm a few days before it recognizes all the programs that can be trusted on your computer. After that, for the most part, you will not even notice that it exists. So take your take your time and read any alerts that pop up, and deal with them accordingly. After using it for a few days, you will get used to it, and your computer will be more secure.

Anyways, from your HiJackThis log, and everything else that I have seen in the last few posts, you original problem appears to be resolved.
I have learned a lot from helping you through your problem.

Here's a different version of the article I linked you to earlier - How did I get infected in the first place?

Take care.

Edited by joshuacat, 17 December 2005 - 06:19 PM.

[gpsugy]

hi. i have just downloaded zone alarm. i have a few questions. should i make my internet locked (Ctrl+L)? i have just updated the program to zonealarm pro 6.1.737.000, is that good? also, when i first installed the program, i got an error message saying something like this: "some parts could not be configured. please switch to the administrator and start installation again." i only have one user account, which is this one. should i worry about that? also, in the zonealarm window, the slot with programs in it has icons of some running processes such as antivir. for some reason, the antivir icon is blinking. what does that mean? i checked in the "anti-virus monitoring" section on the left, and it says it doesn't detect a anti-virus software, but i see antivir guard on the bottom-right hand corner of my screen. should i ignore it? despite all of these things, everything seems to be OK, but then again i'm not familiar with this program. also, should i download IE-SPYAD even though i use firefox mostly? is it necessary or recommended?

zonealarm has just detected suspicious behavior from SL7.tmp. is it safe or should i deny it? i searched google for it, but i could not get anything of whether or not it is safe. it says it is trying to launch C:\WINDOWS\system32\msiexec.exe. if it safe, how do i exactly allow it again? sorry for all of these questions. i just want to leave safely.

Edited by gpsugy, 17 December 2005 - 08:13 PM.

[joshuacat]

gpsugy:

should i make my internet locked?

Using the Internet block will stop all communication with the internet. Nothing will go in/out of your internet connection. Only use it if you want to stop ALL internet traffic, good and bad.

i have just updated the program to zonealarm pro 6.1.737.000, is that good?

This is the 15 trial version. It has more features than the regular free verion. After 15 days it will automatically drop back down to the Zone Alarm free version. I am using the regular free version now. I also tried the pro version for 15 days.

also, when i first installed the program, i got an error message saying something like this: "some parts could not be configured. please switch to the administrator and start installation again." i only have one user account, which is this one. should i worry about that?

Not sure about that. Almost sounds like the installation failed. Although you are using the program and everything sounds normal to me.

the slot with programs in it has icons of some running processes such as antivir. for some reason, the antivir icon is blinking. what does that mean?

Those are the programs that are currently open, or active.

everything seems to be OK, but then again i'm not familiar with this program.

Like I mentioned above, it will take some time to get used to the program. After a few days, you will not even notice it.

i checked in the "anti-virus monitoring" section on the left, and it says it doesn't detect a anti-virus software, but i see antivir guard on the bottom-right hand corner of my screen. should i ignore it?

I loaded Zonealarm and AntiVir on my virtual computer, and it did the same thing as yours. From what I can gather, Zonealarm does not recognize AntiVir. Nothing to worry about.

should i download IE-SPYAD even though i use firefox mostly?

It's great if you use Internet Explorer. I would consider it a must have if IE is your primary browser, but since it is not, I will leave the choice up to you.

zonealarm has just detected suspicious behavior from SL7.tmp. is it safe or should i deny it?

I would deny it. If it is something that can be trusted, you can change it back to allow it later. Can you do a search for that file on your computer? Before you do, you may need to set your computer to view hidden files. It could be nothing to worry about, but I want to make sure.

If you do find it, write down the exact location and post it in your reply.

Let's do a another scan...

Download and Save Blacklight to your desktop:

Double-click blbeta.exe then accept the agreement, leave [X]scan through Windows Explorer checked, click > scan then > next

You'll see a list of all items found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).

Copy and paste this log in your next reply. Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"

Thanks,

[gpsugy]

ok, i've finished your instructions, and i found the SL files. another alert also came up about SL39.tmp, and i have that too. these are the locations, but i found two SL7's and two SL39's, and i'm not sure which one of them is the one we're looking for, so i will just leave that to u:

SL7.TMP-2808A6E6.pf
C:\WINDOWS\Prefetch
PF File

SL7.tmp.4c6165b3.ini
C:\Documents and Settings\Ghang Family\Local Settings\Application Data\ApplicationHistory
Configuration Settings

SL39.tmp.eb3ef1c.ini
C:\Documents and Settings\Ghang Family\Local Settings\Application Data\ApplicationHistory
Configuration settings

SL39.TMP-08FCD0D6.pf
C:\WINDOWS\Prefetch
PF File

but i do believe the ones we r looking for r the configuration settings, but i am not entirely sure. by the way, if they are not dangerous, can u tell me how to allow them on my firewall because i denied them.

here is the blacklight log (it did not find any infected items):

12/20/05 15:46:53 [Info]: BlackLight Engine 1.0.30 initialized
12/20/05 15:46:53 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/20/05 15:46:56 [Note]: 7019 4
12/20/05 15:46:56 [Note]: 7005 0
12/20/05 15:47:22 [Note]: 7006 0
12/20/05 15:47:22 [Note]: 7011 2576
12/20/05 15:47:24 [Note]: FSRAW library version 1.7.1014
12/20/05 15:54:26 [Note]: 7007 0

Edited by gpsugy, 20 December 2005 - 03:00 PM.

[joshuacat]

For the public record, here's the contents of one of the files that you e-mailed to me.
(Edit: From file - SL7.tmp.4c6165b3.ini)

[PolicyResolutionHistory]
ExecutablePath=C:\DOCUME~1\GHANGF~1\LOCALS~1\Temp\SL7.tmp
ApplicationName=SL7.tmp
NumResolutions=1
ActivationSnapShot_1=29754189.3835367056
[29754189.3835367056]
RuntimeVersion=v1.1.4322
System/b77a5c561934e089/NULL/1.0.5000.0=29754189.3835367056/System/b77a5c561934e089/NULL/1.0.5000.0
System.Drawing/b03f5f7f11d50a3a/NULL/1.0.5000.0=29754189.3835367056/System.Drawing/b03f5f7f11d50a3a/NULL/1.0.5000.0
System.DirectoryServices/b03f5f7f11d50a3a/NULL/1.0.5000.0=29754189.3835367056/System.DirectoryServices/b03f5f7f11d50a3a/NULL/1.0.5000.0
System.Messaging/b03f5f7f11d50a3a/NULL/1.0.5000.0=29754189.3835367056/System.Messaging/b03f5f7f11d50a3a/NULL/1.0.5000.0
System.ServiceProcess/b03f5f7f11d50a3a/NULL/1.0.5000.0=29754189.3835367056/System.ServiceProcess/b03f5f7f11d50a3a/NULL/1.0.5000.0
System.Data/b77a5c561934e089/NULL/1.0.5000.0=29754189.3835367056/System.Data/b77a5c561934e089/NULL/1.0.5000.0
System.Windows.Forms/b77a5c561934e089/NULL/1.0.3300.0=29754189.3835367056/System.Windows.Forms/b77a5c561934e089/NULL/1.0.3300.0
System/b77a5c561934e089/NULL/1.0.3300.0=29754189.3835367056/System/b77a5c561934e089/NULL/1.0.3300.0
[29754189.3835367056/System/b77a5c561934e089/NULL/1.0.5000.0]
VerReference=1.0.5000.0
VerAppCfg=1.0.5000.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System.Drawing/b03f5f7f11d50a3a/NULL/1.0.5000.0]
VerReference=1.0.5000.0
VerAppCfg=1.0.5000.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System.DirectoryServices/b03f5f7f11d50a3a/NULL/1.0.5000.0]
VerReference=1.0.5000.0
VerAppCfg=1.0.5000.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System.Messaging/b03f5f7f11d50a3a/NULL/1.0.5000.0]
VerReference=1.0.5000.0
VerAppCfg=1.0.5000.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System.ServiceProcess/b03f5f7f11d50a3a/NULL/1.0.5000.0]
VerReference=1.0.5000.0
VerAppCfg=1.0.5000.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System.Data/b77a5c561934e089/NULL/1.0.5000.0]
VerReference=1.0.5000.0
VerAppCfg=1.0.5000.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System.Windows.Forms/b77a5c561934e089/NULL/1.0.3300.0]
VerReference=1.0.3300.0
VerAppCfg=1.0.3300.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0
[29754189.3835367056/System/b77a5c561934e089/NULL/1.0.3300.0]
VerReference=1.0.3300.0
VerAppCfg=1.0.3300.0
VerPublisherCfg=1.0.5000.0
VerAdminCfg=1.0.5000.0

Do you remember doing anything before this happened? Did you install something just prior to getting the message? Were you registering something? Or, did this just come up at random?

Are you getting daily messages similiar to the one you described above? Or, did this stop when you blocked it with Zonealarm?

Edited by joshuacat, 22 December 2005 - 12:10 PM.