Spyware, Viruses, & Security forum

General discussion

heretofind.com

by usmcq1 / October 31, 2004 7:12 PM PST

I am having problems with a virus that is causing havoc. It keeps changing my homepage to "heretofind.com". I have tried to fix it with ad-aware, A squared, cwshredder, and Hijack this. I went to the registry to remove them and they just keep coming back to my registry. When I go to tools--internet options, and then change my homepage to MSN, it changes it back to :@MSITSTORE:C:\spe\start.chm::/start.html# Can someone help me.

Discussion is locked
You are posting a reply to: heretofind.com
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: heretofind.com
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Re: heretofind.com
by Donna Buenaventura / October 31, 2004 7:51 PM PST
In reply to: heretofind.com

Get HijackThis from http://www.spywareinfo.com/~merijn/files/HijackThis.exe or from:
http://www.allsecpros.com/download/HijackThis.zip
http://www.zerosrealm.com/downloads/hjt.zip
http://www.downloads.subratam.org/hijackthis.zip

Where to put and how to use HijackThis:

It is important that you will run HijackThis.exe in its own folder so the backup files that HijackThis file will create will not be accidentally deleted.

Open 'My Computer', then double-click to open C:\ (or the drive letter that your Windows is installed)
In the menu bar, click File-->New-->Folder.
That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ or C:\HijackThis\ folder. Put your HijackThis.exe there, and double click to run it.

Click 'Scan' button. Click 'Save log' button. Save the 'hijackthis.log' in your desktop. Copy and paste the content of 'hijackthis.log' and post it any forums that offers HijackThis analysis. You can find those forums listed in http://www.a-sap.org/

The HJT experts there will help you get rid of it.

Collapse -
Re: heretofind.com
by usmcq1 / November 1, 2004 1:38 AM PST
In reply to: Re: heretofind.com

Donna, I have HJT and made sevaral attempts using that program. I select the items that have to be fixed, I rescan and they appear again and again.

Collapse -
Re: heretofind.com
by roddy32 / November 1, 2004 2:01 AM PST
In reply to: Re: heretofind.com

USMCQ1
Reread Donna's post. She did NOT tell you to click the "fix" button on HJT. Read the bottom portion of her post about the Hijack List log and where to post the log. I'm not trying to interupt here but Donna is in a different part of the world and may be sleeping now. I'm not really sure. LOL

Collapse -
Re: heretofind.com
by swisse / October 31, 2004 8:38 PM PST
In reply to: heretofind.com

Disable System Restore first and foremost, reboot to Safe Mode, then run Adaware, Spybot Search and Destroy, your Antivirus program, and your other tools.

Swisse

Collapse -
Re: heretofind.com
by usmcq1 / November 1, 2004 1:48 AM PST
In reply to: heretofind.com

This is the information on www.heretofind.com: When you type an URL into MSIG's address bar without the prefix (http), it is autoomatically added when you hit enter. This prefix is stored in the registry, together with the default prefixes for FTP, Gopher and a few other products. When a hijacker changes these to the URL of his server, you always get redirected there when you forget to type the prefix. Prolivation uses this hijack.
I have tried to remove each file individually thru the registry and also using Hijackthis, Norton, CWshredder, Adaware, but the bloody thing still remains in my computer. Any suggestions. By the way, how do I disable system restore?

Collapse -
Re: heretofind.com
by glenn30 / November 1, 2004 3:31 AM PST
In reply to: Re: heretofind.com

Several ways to turn off System Restore. One is Start|Programs|Accessories|System Tools|System Restore then on the left of that page select "System Restore Settings". Simply tick the block.

Hope this helps! Be sure to turn System Restore back on after you reboot and finish.

Glenn

Collapse -
Re: heretofind.com
by Marianna Schmudlach / November 29, 2004 6:00 AM PST
In reply to: Re: heretofind.com

You have to go into SAFEMODE to delete these entries you see in HJT!!

Also have a look at the 013 entries -

do they look like these?

O13 - DefaultPrefix: http://www.heretofind.com/show.php?id=15&q=
O13 - WWW Prefix: http://www.heretofind.com/show.php?id=15&q=
O13 - Home Prefix: http://www.heretofind.com/show.php?id=15&q=
O13 - Mosaic Prefix: http://www.heretofind.com/show.php?id=15&q=
O13 - Gopher Prefix: http://www.heretofind.com/show.php?id=15&q=


You have to check them too in HJT to get rid of them.

Still in safemode - you also have to:

delete the contents of your temp folders ....Thats :-

C:\Windows\Temp ... folder ( Do NOT delete the folder itself)

C:\Documents and Settings\Owner(repeat for all users)\Local Settings\Temp ... folder ( Do NOT delete the folder itself)

Empty your Recycle Bin

Reboot.

HTH

Collapse -
Re: heretofind.com
by jawadashin / November 29, 2004 5:49 AM PST
In reply to: heretofind.com

i know this stuff happens to me aswell i dont know much about it but i know that this will... eventually take power of your pc making it go slower and then stuff will come out of nowhere go to aol then spyware itll tell u stuff ant it will scan your pc

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

CNET FORUMS TOP DISCUSSION

Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?