Do you have any idea on this:

G:\Windows\Xriroa.exe

If don't, please close all active applications including browsers, and the re-run HJT again. Post the new log here.

How to relate MBR infection with host file?

And we can see user's host file since the beginning if you know how HJT works.

Final word from me, do not spam old thread. I was actually still waiting for his reply and it's useless we give more speech to TS since he is gone for months.