Buffer Overrun

[Broni]

Also, make sure, under right click>Properties, hosts file is NOT set to "read only".

[woodworks]

Yes I'm the administrator.

[woodworks]

Ok, when I tried to cancel out, it said text in folder has changed, do I want to save it? 

What do I do?

[Broni]

Save it, open it again, and see how it looks.

[Broni]

Are you in Safe, or Normal Mode?
Did you check Properties?

[woodworks]

I'm in normal mode
I didnot check property, I don't know where you want me to right click.
I checked and nothing is in there execpt the 127.0.0.1

[Broni]

So, it looks like this:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

[woodworks]

No

It has this

127.0.0.1      local host

And that's it, nothing else.

[Broni]

Perfect!
We did it:)

Restart computer, and give me final HJT log.

[woodworks]

Ok, here it is.

[recovering space - attachment deleted by admin]

[Broni]

I can't believe this.
The hosts file is back to where it was before.
It must have something to do with Spysweeper, because it's running again.
Uninstall Spysweeper totally.
Restart computer, and try to edit hosts file again.
I'll be up for another 15-20 minutes.

[Broni]

Also, right click hosts file, then Properties, and make sure, there is no checkmark next to "read only".

[woodworks]

I just looked and there is nothing in the host file.  You are talking about notepad, right?

I'm not comfortable with uninstalling spy sweeper.  I didn't have it shut down when I did the last HJT.  Maybe that had something to do with it.  

[Broni]

Wait, then.

[woodworks]

It is marked archive