dnsapi.dll hijacked - can't remove

[brunobyof]

I did the clean boot, it booted to the old version of Windows because i could'nt remember the right volume (i think the sfc restored the boot option in the startup, which i had excluded before),  so i restarted again into the right one, formated the old HD with the older version of Windows (now i have only the current one) and excluded the old boot option. The normal boot programs are not started, and the problem didn't show up for now.

Edited August 7, 2017 by brunobyof

[Aura]

Alright. Keep that configuration for a day and see if the problem reappears. If it doesn't, it means that a third-party program, service or driver launched on startup is causing it.

[brunobyof]

Okay, it still didn't show up, i'm guessing that's the case. ANyway, till tomorrow then.

[brunobyof]

Hello, since yesterday my system is working fine. I kept the clean boot for most of the time but today i decided to try something:

-I turned on the startup programs in the msconfig/taskmngr panel, one by one, and restarted my system after turning them on to see if activating one of them would cause the system to present that strange behavior. To my surprise, nothing happened.

-After i tested with each of the programs individually, i cleaned some of them from the startup menu, lefting only the basic stuff to startup: Avast, áudio driver and Windows defender.

-then i selected "normal startup" in the msconfig panel and restarted the system to see if something would happen. So far so good. 

The only thing is that when i cheched this option of normal boot, it suddenly changed my boot options to load 2 versions of Windows even though i had deleted the other one and all of my other partitions/HD's are clean and formatted already, so i don't know why it happened, but then i went again to Msconfig and deleted it again and restarted the system again but this time no more alternative Windows option. It booted safe and sound.But for whatever reason when i go to msconfig, the "normal boot" option is not selected anymore, it changed automatically to selective boot with  "load system services" and "load startup items" both checked. 

I scanned the system with ZHP again and Malwarebytes free, both returned a clean system. I'm not sure if the system is really clean, because it looked like this before but it came back again later. What should i do now? 

Is there any other scanning system to use in order to double check it?

 

 

[Aura]

If you ran ZHP Cleaner, Malwarebytes and FRST (with the logs I reviewed), you should be pretty good.

Quote

it changed automatically to selective boot with  "load system services" and "load startup items" both checked. 

Are they "checked", or are they filled with a black square? Because this is different. If they are checked, it means that every third party services and startup programs will be launched on startup. If they have a black square in them, it means that only some of the third-party services and startup programs will be launched.

[Aura]

Hi brunobyof,

Are you still with me?

[brunobyof]

Hi, i'm still here yes, but apparently my system is working fine since the changes in the startup and msconfig. No more strange behaviors on my browser even though i can't say i cleaned any specific malware/adware. I hope this remains the same. If you have any other instruction to make sure the system is really ok, just say it, otherwise, i think this thread won't go anywhere else.

[Aura]

If you revert the changes you made in msconfig and the Startup tab of the Task Manager, is the issue back? If so, we can start by disabling each program in the Startup list one by one until the issue doesn't show to find the culprit.

[Aura]

Hi bruno,

Are you still with me?

[brunobyof]

Hello, as i said on my prior post, i already did the change on msconfig so that i tested one by one of the programs and then disabled those non-important after checking that none of them was causing the problem to arise. So now i've been using the normal startup, and the problem vanished apparently. 

[Aura]

That's good news

Were there any other issues to address, or was this the last one?

[Aura]

Hi brunobyof,

Are you still with me?

[Aura]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!