nympfisher Posted February 28, 2019 ID:1301091 Share Posted February 28, 2019 hi. i have read over a few post related to this issue . i read its best to start a new thread instead of trying to get help piggy backing someone else's post. it appears that its pretty common that this trojan , not sure what the name is . but it pops up pretty often even if the same website is in use. i use to think it was only when you opened a new window . i can save the log files to a text and send them to whomever would like to try and direct me on what i need to do. thanks . carl Link to post Share on other sites More sharing options...
nympfisher Posted February 28, 2019 Author ID:1301126 Share Posted February 28, 2019 one.txt three.txt two.txt Link to post Share on other sites More sharing options...
nasdaq Posted February 28, 2019 ID:1301184 Share Posted February 28, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === If the problem persists IN CHROME and you Sync Chrome with other devices reset the Sync. Read this article and proceed. Chrome Secure Preferences detection always comes backhttps://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ <<<>>> If the problem has not been solved run this program. Download the Farbar Recovery Scan Tool (FRST).Choose the 32 or 64 bit version for your system. and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions Link to post Share on other sites More sharing options...
nympfisher Posted March 3, 2019 Author ID:1301803 Share Posted March 3, 2019 chrome will not let me access the google dashboard to reset sync Addition_03-03-2019 12.03.53.txt FRST_03-03-2019 12.03.53.txt Link to post Share on other sites More sharing options...
SPDIF Posted March 3, 2019 ID:1301805 Share Posted March 3, 2019 There is no popup or any malware ad work here, its just Malwarebytes blocking that domain because they have Malware on their site. MWB is doing its job and protect you from it, that's all. I get the same pop-up from malwarebytes as you in Firefox. Link to post Share on other sites More sharing options...
nympfisher Posted March 3, 2019 Author ID:1301825 Share Posted March 3, 2019 i cannot even find that site , how can i tell what it is ? Link to post Share on other sites More sharing options...
nympfisher Posted March 3, 2019 Author ID:1301827 Share Posted March 3, 2019 can it be blocked without the pop up ? Link to post Share on other sites More sharing options...
nympfisher Posted March 4, 2019 Author ID:1301848 Share Posted March 4, 2019 Domain Name: HANSTRACKR.COMRegistry Domain ID: 2103534459_DOMAIN_COM-VRSNRegistrar WHOIS Server: whois.publicdomainregistry.comRegistrar URL: www.publicdomainregistry.comUpdated Date: 2018-04-14T12:49:16ZCreation Date: 2017-03-09T11:20:56ZRegistrar Registration Expiration Date: 2027-03-09T11:20:56ZRegistrar: PDR Ltd. d/b/a PublicDomainRegistry.comRegistrar IANA ID: 303Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibitedRegistry Registrant ID: Not Available From RegistryRegistrant Name: Hans PeterRegistrant Organization: Hans Peter XYZ Inc.Registrant Street: Wan Chai Rd 158 Registrant City: HonkongRegistrant State/Province: OtherRegistrant Postal Code: Wan ChaiRegistrant Country: HKRegistrant Phone: +852.2528216Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: webmaster@hanstrackr.comRegistry Admin ID: Not Available From RegistryAdmin Name: Hans PeterAdmin Organization: Hans Peter XYZ Inc.Admin Street: Wan Chai Rd 158 Admin City: HonkongAdmin State/Province: OtherAdmin Postal Code: Wan ChaiAdmin Country: HKAdmin Phone: +852.2528216Admin Phone Ext: Admin Fax: Admin Fax Ext: Admin Email: webmaster@hanstrackr.comRegistry Tech ID: Not Available From RegistryTech Name: Hans PeterTech Organization: Hans Peter XYZ Inc.Tech Street: Wan Chai Rd 158 Tech City: HonkongTech State/Province: OtherTech Postal Code: Wan ChaiTech Country: HKTech Phone: +852.2528216Tech Phone Ext: Tech Fax: Tech Fax Ext: Tech Email: webmaster@hanstrackr.comName Server: 1a7ea920.bitcoin-dns.hostingName Server: a8332f3a.bitcoin-dns.hostingName Server: ad636824.bitcoin-dns.hostingName Server: c358ea2d.bitcoin-dns.hostingDNSSEC: UnsignedRegistrar Abuse Contact Email: abuse-contact@publicdomainregistry.comRegistrar Abuse Contact Phone: +1.2013775952URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/>>> Last update of WHOIS database: 2019-03-03T21:43:55Z <<< Link to post Share on other sites More sharing options...
nasdaq Posted March 4, 2019 ID:1301956 Share Posted March 4, 2019 Hi, This fix is for nympfisher only. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please post the Fixlog.txt and let me know what problem persists. p.s. If other uses do not have the right to post in this topic. You most start a your own topic to get help. nasdaq fixlist.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 16, 2019 Root Admin ID:1304021 Share Posted March 16, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts