Windows 7: mrcleanpc.com hijacker?

I searched the forums and cannot find anyone having this specific issue.

I am relatively new to Windows 7 and a novice by all means. I have recently acquired a browser 'hijacker' that tries to send me to [URL="http://www.mrcleanpc.com"]www.mrcleanpc.com[/URL] rather than my intended destination. It never makes it to that site it just keeps shuttering. I can go back a page and try other sites from google and sometimes I go right there sometimes mrcleanpc tries to load.

I have updated and run Spy-Bot S&D, Malwarebytes and AVG. I tried the MS malicious removal tool too. I updated to IE9 and installed Google chrome (to try a different browser). And it is still there. I did a search for mrcleanpc and did not find any files on my laptop with that name.

Can someone please tell me where to look and how to get there and what i should look for?LOL.

I like 7 but it seems more difficult to get in deep to the file structure. I really don't want to mess anything up! I am dangerous that way. I was hoping to be able to get to the temporary internet files folder and see if there was something that i could clean out but I cannot find that either (help here too).

Basically any advice is appreciated. As for system restore????? That will bring me back to a non-issue time but will the hijacker not still be residing somewhere?

Thanks in advance for all your assistance.

Callmemr.V
in SC

I would reboot into safemode and run MalwareBytes.
If this does not work, I would Suggest ComboFix. (Disclaimer - Have a good backup of your material because while it is a great tool it risks damaging your OS since it does attempt to correct some system files. + I do not claim and liability for damages done, this is meerly a suggestion.)

1. Download HijackThis *executable (no installer)*
2. Create a restore point, close any open programs, Explorer, etc, and then run the executable
3. Click Scan at bottom-left, and wait
4. Check down the list for the item you want to remove and check the box next to it (you may have to do a little research here if the name is not obvious)
5. Click "Fix Checked" and follow the prompts

Hopefully it can help you with this?

Seeing how HijackThis is basically a way to remove certain unwanted entries from the registry in a convenient way, make sure you have a good backup before you simply check everything and click on fix it. you could always run the log file through here and see what the experts say...or with some caution and common sense use an automated log file analyzer for that:
HijackThis Logfileauswertung
HiJackThis! Log auto analyzer V2

Good additional points SledgeDG, for which I couldn't agree more.

Norton has a tool called power eraser
Norton Rescue Tools
In the past it has gotten rid of fake antivirus programs, and browser redirect issues. Again, a backup before running it is in order. Also read the instructions with the tool. A system restore might also solve the issue, if you can remember when your PC started doing this, just restore to a point before then, and to answer your question; No, if you do a system restore the browser redirect bug shouldn't be residing on your PC any longer, assuming you restored to the proper point.

I could not get into safe mode! There was an F2 option but I could not find safe mode anywhere in there. It had a F12 boot option but that did not have a safe mode either. I realize that no one has the same set up so F-buttons are different....Is there a way to find safe mode? I would like to try that first.

THANK YOU EVERYONE FOR YOUR IDEAS SO FAR, HOPEFULLY ONE WILL WORK SOON.

Try pressing F8 instead of F2 & F12, you should then get the option to boot into safe mode.

Regards,
JDobbsy1987

Just a little more coaching...........Your bios screens will roll by and then when they are all done windows begins a boot. You may have to observe this boot to get the exact timing. When the bios is done at that instant you want to begin tapping F8. Like I say you may have to do multiple trys to get the correct timing. I miss it sometimes.

this is from the aspire 5336 handbook: http://support.acer.com/acerpanam/Ma...6_20100811.pdf