OK the closer I look the more I see.
Open HijackThis and select
Do a system scan only Vista users right click on HijackThis and select Run as Administrator. (you will receive a UAC prompt, please allow it)
Place a check mark next to the following entries: (if there)
- R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
- O17 - HKLM\System\CCS\Services\Tcpip\..\{24D0BB08-ADAB-4478-9CEE-E851636C4E6C}: NameServer = 213.174.139.72,255.255.255.255
- O17 - HKLM\System\CCS\Services\Tcpip\..\{73D61A23-51AE-4624-9E4E-85C08CC05DAD}: NameServer = 213.174.139.72,255.255.255.255
- O17 - HKLM\System\CCS\Services\Tcpip\..\{9CCB85F9-FDB5-4297-AE4B-DEB724299F87}: NameServer = 213.174.139.72,255.255.255.255
- O17 - HKLM\System\CCS\Services\Tcpip\..\{A2991645-2ED9-4FA9-9EE4-9F106D99FEB5}: NameServer = 213.174.139.72,255.255.255.255
- O17 - HKLM\System\CCS\Services\Tcpip\..\{CEA1D602-64CF-43B6-B1A7-DE28EBA1C8BE}: NameServer = 213.174.139.72,255.255.255.255
- O17 - HKLM\System\CS1\Services\Tcpip\..\{24D0BB08-ADAB-4478-9CEE-E851636C4E6C}: NameServer = 213.174.139.72,255.255.255.255
- O17 - HKLM\System\CS2\Services\Tcpip\..\{24D0BB08-ADAB-4478-9CEE-E851636C4E6C}: NameServer = 213.174.139.72,255.255.255.255
Important: Close all open windows except for HijackThis and then click
Fix checked.
Once completed, exit HijackThis.
----------
If you already have Malwarebytes be sure to update it before running the scan!
Download
Malwarebytes' Anti-Malware (MBAM) Alternate MBAM download link - Double-click mbam-setup.exe and follow the prompts to install the program.
- At the end, be sure a checkmark is placed next to the following:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
- Then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform quick scan, then click Scan.
- When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy and Paste the entire report in your next reply.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.