Heretofind and Start.chm

Hello,

I've been reading the threads on your site and found some similar problems. I read the READ ME FIRST sticky and performed every step. I updated Microsoft Windows. I also ran: Norton AntiVirus, McAvee Stinger, CCleaner, AdAware SE 6, SpyBot S&D, CWShredder, Kill2Me, AboutBuster, and finally SpywareBlaster. I ran all of these in Safe Mode.

AdAware removed: Registry keys pertaining to my Start Page, Search Page, and URL/Prefixes, all with www.heretofind.com and mkmsitstore:c:\spe\start.chm::start.html.

SpyBot fixed "Spex". I ignored SearchForIt.

A folder at "C:\Spe" is never found as a problem with these tools. The folder contains "Start.chm", which hijacks my start page browser to a porn/casino link. All registry items are changed to www.heretofind so that when I type a website it is rerouted.

After I run everything it seems to be ok for anywhere between a few minutes and a few hours. But without fail, a Heretofind toolbar is added to the bottom of my Internet Explorer browser. In addition, a pop up of a system scan using the name of the current website (in one case, MajorGeeks), asks me to download a threat eliminator, which is actually a link to a porn site. Shortly thereafter the "Spe" folder is back and it all starts over again. Today I even had something new when "inst.exe", "124430.exe" and "hooks.dll" were added while I was on the internet. I noticed the change and immediately ran Ad Aware again, which caught and deleted them.

I am so frustrated with this hijacker and I want to smash my computer, kind of like the fax machine in office space. Please help if you can. I have downloaded HijackThis and run a scan and saved the log in case this is the next step. I really appreciate your help. Thanks! MM

 

Hey chaslang,

I do have AdAware 1.04, sorry for the confusion. I downloaded it from this site. I also downloaded HJT from MajorGeeks, so I have 1.98.2. I am posting my log file. Since I've run all of the programs as instructed it has reset my Start Page and Search Page to www.google and I've left it there for now. Hopefully you can find something within the log to find this hijacker. It seems to come back everyday after I start my machine.

I look forward to your response. Thanks!

 

Ok I followed all instructions, fixed all items below, deleted that file and ran AD-aware and SpyBot, each after rebooting. I am attaching a new HJK log, which I ran prior to reconnecting to the internet. So far I haven't had the browser problems, but I haven't gone further than this page thus far. I will keep monitoring it to see if I encounter any more problems. I am keeping my fingers crossed, thanks for your help thus far.

In a separate question, after downloading SpywareBlaster, should I expect to see a long list of domain names in the following registry paths:

HKCU/Software/Microsoft/Internet Explorer/P3P/History/...
HKCU/Software/Microsoft/Internet Explorer/Zone Map/Domains/...

And is this number of Ranges normal?
HKCU/Software/Microsoft/Internet Explorer/Zones/Ranges/...Range 1 through 18

Thanks again, I really appreciate it.

 

Hey Chaslang,

Thanks for the information and especially for your help! I haven't had any problems or reoccurrences of "Heretofind" or the "SPE" folder. Hopefully now that I've protected my computer more, I won't get caught with something like that again. THANK YOU SO MUCH. My computer is normal again. Anyone that reads this post, listen to the people helping on this site and make sure you follow ALL of their instructions. They know what they're talking about!

-MM