Tradeexchange.com blocked but not detected

[Bartor]

I'm hoping someone can help. A couple of days ago I noticed by browser redirecting and unwanted pop-ups occurring.  Following advice on the web, I installed ADWcleaner, JKtoolkit, Malwarebytes and Hitman pro.  I have run them all,  there were some detections for run_Dregol which were quarantined.  I have also reset both internet explorer and chrome.

 

However when I started IE this morning, malwarebytes advised me it was blocking Tradeexchange.com and some websites get greyed out with a fake virus warning overlaying them, so it would appear something is still hiding there.

Thanks in anticipation

[TwinHeadedEagle]

Hello and

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button. button.

  

• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  

• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[Bartor]

Hi Eagle,

thanks for getting back so prompt, it's been a busy day at work so I've only just been able to get back on the pc.

Here are the FRST and Addition text files requested.

 

Addition.txt

FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

fixlist.txt

[Bartor]

Thanks again,

I shall do that as soon as I get home tonight.

[Bartor]

I have run FRST as directed and attached the fixit log.

Fixlog.txt

[Bartor]

just as an update, went online using Microsoft Edge after running FRST and unwanted tabs kept popping up. worse than before!

[TwinHeadedEagle]

Do you have home modem/router?

[Bartor]

Yes, I have a TP Link W8951ND wireless ADSL2+ modem router.

Do you think the problem may be in there.

[TwinHeadedEagle]

Can you reset this router to factory settings?

 

[Bartor]

I have not been able to access the router settings via a browser.  I tried last night and I kept getting a message saying it couldn't connect to the page.

I do remember before that, when I did get to the logon page for the router it wouldn't accept my password.  I thought it was a simple error with the router.

There is a pin-hole on the back of the router that enables a manual factory reset that I could press.

[TwinHeadedEagle]

Yes, you can do it that way. Press and hold that button for 10 second and then release it.

[Bartor]

That seems to have done it.  I've have done a bit of surfing and no pop-ups yet.

Is there anything else I can do to make sure I'm not reinfected?

 

[TwinHeadedEagle]

Nope, your PC seems clean, it had to be an infected router.

[Bartor]

thanks for all your time and help, a donation is on its way.

[Bartor]

Just an update on the situation, I still have no pop-ups or fake warnings occurring anymore, but I did notice this morning that Malwarebytes blocked tradeexchange.com twice.

 

[TwinHeadedEagle]

Please re-run Malwarebytes' Anti-Malware.
 

 

 

• Name report somehow and Save it to your Desktop.
• Attach it in your next reply for my review.
  

[Bartor]

Here is the protection log for Saturday 23rd April when I had the two warnings.

I have had no warnings or anything since and looking at the protection logs since that time show nothing.

protection log 23rd april.txt

[TwinHeadedEagle]

Is everything okay now?

[Bartor]

it appears to be. since Saturday morning there have been no warnings from malwarebytes. I did do a scan with it which picked up nothing and since resetting the router I have had no fake warnings or pop-ups or anything like that.

Thanks

[TwinHeadedEagle]

Yes, I am pretty sure the issue was router's hijacked DNS re-routing your traffic to tradeexchange. MalwareBytes showed some warnings, but it is probably some cached data in Edge browser.

This video can help you clean cache from Edge:

 

[Bartor]

thanks for your help, hopefully you received my donation as a  sign of my appreciation.

[TwinHeadedEagle]

Yes, I received it, thank you

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!