After cleaning some sites get weird string added to URL

%20 is a way of representing the space character in a URL. It looks like some sort of failed attempt to modify the URL, which makes me think spyware. I'd guess it's some sort of redirection thing that has gotten screwed up.  

But it's also possible this could be caused by a legitimate BHO that has gotten damaged or corrupted. Try disabling all BHOs, regardless of what they are for.  You can use Hijack This to do that.

You might also want to look at which web sites this happens with, and see if there's a pattern.

And to scan for spyware and malware:

First of all, download NOW this Winsock fix (FREE):
http://downloads.subratam.org/WinsockFix.zip
If you lose internet access after the cleanup, run this tool.

After that, download the fully functional trial version of Spy Sweeper:
http://www.webroot.com/downloads/?WRSID=595f27d74dd2795a56af83b763c321e1
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once ('in use').

Download Ad-Aware (FREE) from here:
http://lavasoft.element5.com/support/download/
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once ('in use').

Also excellent is SpyBot Search & Destroy (FREE) available here:
http://www.spychecker.com/download/download_spybot.html
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once ('in use').
You should also apply the 'immunize' function, since it blocks roughly 1900 known 'bad' runs/apis/apps.

Even if Ad-Aware and SpyBot S&D are similar, they do clean different things. You should have both of them and use REGULARLY.

You can also install 'preventive' software that will help you control these nasties:

SpywareBlaster (FREE):
http://www.javacoolsoftware.com/spywareblaster.html
Prevents the installation of Active-X based spyware, malware, dialers, etc
Currently protects you against 3500+ nasties.
Advantage: no system resources used!!!
Just download, install and UPDATE.

All of them extremely useful but you must keep them UPDATED.

Suggestion: Make sure you can see all files and folders and run Ad-aware and Spybot S&D in Safe Mode.

Zee

blue_zee, the asker already specified having scanned with Ad-Aware and Spybot, as well as Hijack This.

As billmercer already sayd, %?20 is just a character. I had it to several times, Even with trusted sites like altavista. If i type www.altavista a.com the browser makes that http:///www.altavista%20a.com. The question mark is probally a redirect.

How to fix it? well... most probally its a website problem, and not a problem on his PC. Try cleaning the internet cache and try it again then. If it keeps failing, See if you can contact the owner, and tell him about this.

Have had the same once...
A simple update at update.microsoft.com solved it.

if you add the http prefix yourself it doesn't occur.. if you type www.whatever.tlc it does right?

Thanks everyone, I'll be able to contact my client and run your answers through the paces :)

As a reminder, yes we've run said scans and he has spy sweeper too... the success of these scans seems to have led to this new issue.
... and it's not a web site problem ("does NOT happen with all sites, only some particular sites (which show up fine for me and for clients other computer")

"does NOT happen with all sites, only some particular sites (which show up fine for me and for clients other computer"

ups, i translater the "site" to "website" and not to place or whereabouts. translation error i guess ^^

Thanks for everything. I was not able to get back to my client... he deserted ;) so the most helpful answer is the reg patch which I will add to my arsenal. Cheers.

Oh well...

Happy you found it useful.
;-)

Thanks,

Zee