removing highjack heretofind

Re: hjt log as per request

You should have stayed in your original thread. I merge you back into that thread.

 

Re: hjt log as per request

You need to update your Windows OS and Internet Explorer. You are seriously out of date.

Run this: Try running this: http://tools.zerosrealm.com/startchmfix.exe

Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofind.com/show.php?id=15&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = mkMSITStore:C:\spe\start.chm::/start.html#
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofind.com/show.php?id=15&q=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mkMSITStore:C:\spe\start.chm::/start.html#
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file)
O9 - Extra button: Corel Network monitor worker - {2409C914-5F35-4379-A3EA-C92EBD34F987} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {2409C914-5F35-4379-A3EA-C92EBD34F987} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file) (HKCU)
O9 - Extra button: Corel Network monitor worker - {2409C914-5F35-4379-A3EA-C92EBD34F987} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {2409C914-5F35-4379-A3EA-C92EBD34F987} - (no file) (HKCU)
O13 - DefaultPrefix: http://www.heretofind.com/show.php?id=15&q=
O13 - WWW Prefix: http://www.heretofind.com/show.php?id=15&q=
O13 - Home Prefix: http://www.heretofind.com/show.php?id=15&q=
O13 - Mosaic Prefix: http://www.heretofind.com/show.php?id=15&q=
O13 - Gopher Prefix: http://www.heretofind.com/show.php?id=15&q=

Boot into safe mode and use Windows Explorer to delete (if found):
C:\spe

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go
back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files
and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel),
Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like
www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You're welcome. Your log is clean now. For info on updating your OS and protecting yourself see my thread titled: How to Protect yourself from malware!

What kind of fish will be named after me?

 

You're welcome. We aim to please. Send your friends here.

Hmmm! Black moor...isn't that one of those chubby little goldfish? Bug eyes probably suits me. After all I get bug eyed looking at all the problems and logs here.

 

You forgot the attachment, you dingbat!

Yeah and now you need to edit the post to put it in!!!!!

 

Yeah, yeah! Talk is cheap! I guess we have to expect as much from a Philly Fan!!!!!!