Hello Brain Stew and Welcome to the Tech Support Forum!
You may want to print out these instructions for reference, since you will have to restart your computer during the fix.
Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/file...Fixwareout.exe
Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
At the end of the fix, you may need to restart your computer again.
Disable TeaTimer:
Please disable TeaTimer as it may hinder the removal of some entries. You can re-enable it after you're clean.To disable TeaTimer:
- Run Spybot-S&D
- Go to the Mode menu , and make sure "Advanced Mode " is selected
- On the left hand side, choose Tools -> Resident
- Uncheck "Resident TeaTimer " and OK any prompts
- Restart your computer.
After all of the fixes are complete it is very important that you enable TeaTimer again.
Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
- Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
- Click on Tools, General Settings.
- Under Real-time protection options, unselect the Turn on real-time protection check box
- Click Save
After all of the fixes are complete it is very important that you enable Real-time Protection again.
Scan with HijackThis. Place a check against each of the following:
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118
O17 - HKLM\System\CS1\Services\Tcpip\..\{7EFC685D-D97C-44C9-83EC-BFDD9FBB009F}: NameServer = 85.255.115.68,85.255.112.118
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.
Post (reply) with a fresh HijackThis log along with the contents of the logfile C:\fixwareout\report.txt.