Horrid pop ups!

[jamiekate]

Loony,

I uninstalled zonealarm over a week ago and i have been trying to install it again.I tried to do this part :TRUE VECTOR service" Hilight it rightclick > properties and choose stop"

but the true vector wasnt in the list.

thanks

piper

 

[LonnyRJones]

Are you comfortable with the instructions in this za forum post ?
http://forum.zonelabs.org/zonelabs/board/message?board.id=Off-Topic&message.id=9420
Please be extremly carefull if you edit the registry

 

[jamiekate]

I dont know what to do.what do you think??

piper

 

[LonnyRJones]

If thats a bit much we can go about it another way, what do you think ?

 

[jamiekate]

Yes, please lets try something alittle less risky.

jamie

 

[LonnyRJones]

Copy the contents of the code box below into a new notepad document (not wordpad). Click file> save as...> call it check.bat > file types *all files*> and save it to desktop.

(
sc delete VSMON
sc delete VSDATANT
sc delete srescan
sc query VSMON
sc query VSDATANT
sc query srescan
)>>logit.txt 2>&1

Dont run it yet
Reboot into safe mode Click here if needed For instructions.

now run check.bat
Next
DELETE these files and folders
1) C:\Documents and Settings\All Users\Start Menu\Programs\Zone Labs
2) C:\Program Files\Zone Labs
3) C:\WINDOWS\Internet Logs (Empty Contents)
4) C:\WINDOWS\Profiles\All Users\Start Menu\Programs\Zone Labs
5) C:\WINDOWS\Profiles\All Users\Start Menu\Programs\Startup\zonealarm (pro)
6) C:\WINDOWS\System32\vsdata.dll
7) C:\WINDOWS\System32\vsdatant.sys
8) C:\WINDOWS\System32\vsmonapi.dll
9) C:\WINDOWS\System32\vsnetutils.dll
10) C:\WINDOWS\System32\vspubapi.dll
11) C:\WINDOWS\System32\vsutil.dll
12) C:\WINDOWS\System32\Zone Labs
13) C:\WINDOWS\Temp < (Empty Contents)
14) c:\WINDOWS\system32\ZoneLabs

Reboot back to a normal windows session (none safe mode)
and re-download Zon alarm then install it, if it says upgrade or compete install choose complete install.
http://www.zonelabs.com/store/conte...st_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za
Any problems this time ?
post the logit.txt that should be on the desktop and delete check.bat and logit.txt

 

[jamiekate]

I am headed out the door for work but i wanted to let you know i still am going to do this, i will post as soon as i can.

thanks
jamiekate

 

[jamiekate]

ok here is my logit.txt.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.


[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.


[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.



most of the files you asked me to delete werent even there but zonealarm did install!!

jamie

 

[LonnyRJones]

Thats odd, but good to hear ZA was able to be installed.

Any other questions or are we finished ?

 

[jamiekate]

I guess so.I am still getting 18-25 hits on my ad-aware but other than that no big deal.

thanks for going through all that for me

jamiekate

 

[LonnyRJones]

Cookies and tracts probaly

Let us know if SpyBot finds anything new (besides cookies and tracts)

Think Prevention: Put in place a good hosts file
http://www.mvps.org/winhelp2002/hosts.htm
How To Download and Extract the HOSTS file:
http://www.mvps.org/winhelp2002/hosts2.htm
Repeat that proccess about once or twice a month

To help avoid reinfection see "So how did I get infected in the first place?"
http://forums.spybot.info/showthread.php?t=279

 

[jamiekate]

So far I'm good...thanks!

jamiekate

 

[LonnyRJones]

Im Glad we could help
Since the problems are solved Im going to close the topic now, this keeps others with similar problems from posting there logs/question here, they should start a new topic.

If you should need to post another log for the same PC let one of us know via a PM (personal message).