Thank you for your quick response.
Okay so we don't get lost, use the tools that Jacee recommends and post the results she request.
I don't see where she recommended Spyhunter.
If you follow her instruction exactly your odds of fixing this computer will increase by leaps and bounds.
I'm will go back to watching.
I have just tried Spyhunter, not offending Jacee.
Ran in another problem
If I open Google Chrome, you must have a central search-bar and a search-button underneath.
Normally you type into that bar, what you want, after enter or search your search-results pop up in the large list of google.
However, if I only try to type a single character, google immediately jumps to the page with search-results.
I again did a restore from 2 days ago, where it was still al-right, hoping tot get rid of it, but since my accounts are coupled, the same problem showed up on my laptop GRRRRRR. So somewhere on the server or my account putted it in a cookie perhaps to behave odd?
I hope you may have some clou about it?
About the subject tradeadexchange, I think that it is related with Tinypic.
Since I addressed the album to post the image it popped up immediately.
The problem with the searchbar is solved, caused by an extension to customise the background.
No no, Jacee the problem is still there.
I only solved the problem with the searchbar.
Yes and UBlockDo you have AdBlock Super installed?
The problem appeared yet again by clicking on this site.
I made a sheet of it with notepad, maybe you could tell me more about that?
https://drive.google.com/file/d/0B5I...ew?usp=sharing
It lead me this time to a fake site, which looked like a simplified Javaupdate.
With the faked message that my Java was outdated and should be upgraded.
You can't do anything with Chrome when it pops up.
Just shut Chrome down with taskmanager.
The webadress itself was clear enough fake, from a malicious site(with possible fishing intentions).fugdownload126.com
I have also tried without any adblocker or addon, but it didn't cause or solved anything.
I discovered that the website also distributes ABPlus.
So who knows, is that the culprit?
I've read that adblock plus and adblock super are both involved.
First, I'd like you to flush the DNS cache and restore MS's Hosts file:
batch file---> Save it to the desk top Vista and Windows 7 need to run as Administrator
Copy and paste these lines in Note pad.
@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0
Save as flush.bat to your desktop. Right click on the flush.bat file to run it as Administrator. Your computer will reboot itself.
Next, download DDS from one of these links:
DDS.com
DDS.pif
- Disable any script blocking protection
- Double click the dds icon to run the tool.
- When done, DDS will open two (2) logs:
- DDS.txt
- Attach.txt <--- will be minimized in the task tray
- Save both reports to your desktop.
Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.
DDS only shows me what's running .... it doesn't remove or alter any files or programs.
Hoi Jacee
Appreciate your help much, thank you.
Hope I did it correct with the attachments?
I can see that there is no Host file available after this procedure, only a backup.
Will it recreate a new Host file?
Spybot is using that file normally.
DDS only shows me what's running .... it doesn't remove or alter any files or programsI can see that there is no Host file available after this procedure, only a backup.
Will it recreate a new Host file?
C:\Program Files (x86)\WinArchiver\WAService.exe ... see this:
https://www.reasoncoresecurity.com/w...69a42c5b9.aspx
Hello Jacee
I ran the tool
zone alarm gave 2 heuristic infections?
Treated.
The file is still there, C:\Program Files\winarchiver\waservice.exe with the following Hash check
Naam: WAService.exe
CRC-32: f7712cb7
MD4: 76b71ef112bc0eb0a6d5e3d7b0cc94b5
MD5: c089f377deffb78e9e3523fe3289b77a
SHA-1: 0ffb7dbbc039cb3bf943159e268cbbe4770a7581
What shell I do with it?
Spybot's new pre windows 10 version, required an temporary uncheck of the Zone alarm firewall to get excess to the hosts file. but created indeed a new Hosts file.
Don't know what program deleted or at least backed up the older Hosts file?
Had several backups all the same. Perhaps spybot?
Have read on google reports, that the problem with tradeadexchange.com was a DNS hack.
At least that member got rid of the problem.
I've uninstalled winarchiver and Waservice.exe completely and scrambled all of it's registerkeys.
Never used it and wasn't even aware that is was ever installed.
Quote