Download the Hoster.
Run it and press "Restore Original Hosts" and press "OK". Exit Program.
Note that if you have a custom host file, this will remove it.
====
Can you please do the following.
===============
Can you disable Windows Defender as it may interfere with the removal process. Please leave it disabled until your PC has been given the all clear.Open Windows Defender
Click Tools
Click General Settings
Scroll down to Real Time Protection Options
Uncheck Turn on Real Time Protection (recommended)
After you uncheck this, click on the Save button
Close Windows Defender
===============
Scan with HijackThis and then place a check next to all the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://b0O.net/cat
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://b0O.net/searchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://b0O.net/cat
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://b0O.net/cat
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://b0O.net/cat
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://b0O.net/cat
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://b0O.net/searchasst.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://b0O.net/cat
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://b0O.net/cat
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://b0O.net/searchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://b0O.net/searchasst.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://b0O.net/searchasst.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://b0O.net/searchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://b0O.net/cat
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://b0O.net/cat
R3 - URLSearchHook: Universal Searchbar - {5F7AB1DB-A899-46c1-8345-B72B4567EE86} - C:\PROGRA~1\Utility\utility.dll (file missing)
O3 - Toolbar: Universal Searchbar - {5F7AB1DB-A899-46c1-8345-B72B4567EE86} - C:\PROGRA~1\Utility\utility.dll (file missing)
O4 - Global Startup: Microsoft Office.hta
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
...(Unless you've set these with an anti-spyware program like SpyBot's Immunize feature, have HiJackThis fix this.)
O8 - Extra context menu item: &Web Search - res://C:\PROGRA~1\Utility\utility.dll/GoSrch.dll.htm
O9 - Extra button: Microsoft AntiSpyware helper - {3CF932B1-F57B-4D4F-B24D-7BADB16778B1} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3CF932B1-F57B-4D4F-B24D-7BADB16778B1} - (no file) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
===============
Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:
folders...
C:\PROGRA~1\Utility
-
Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following: Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear.
Select the first option to run Windows in Safe Mode hit enter.
-
Reboot.
===============
After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
