Startup error won't go away after spyware removal

We removed several spyware infections from a laptop running XP Home.  Now Malwarebytes, AVG, and Kaspersky give us an "all clear".  We are still getting an error on startup:

          Windows Internet Explorer
          Cannot find 'file:///". Make sure the path or Internet address is correct.

Here's what we've tried:
  1. Windows repair install
  2. Windows Update
  3. Internet Explorer upgrade: first 7 then 8
  4. Internet Explorer reset
  5. Set MSCONFIG to "Disable" all startups and all non-Windows services
  6. Remove any temp files

Any ideas?  We hope not to have to wipe this installation because the customer has a lot of programs he'll have difficulty replacing.

Thanks!
 
   
sexygeekAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sexygeekAuthor Commented:
Here's a print screen of the error.
error.JPG
0
Kerem ERSOYPresidentCommented:
Hi,

It seems that one of your Trojans were removed from your system but your homepage still points to it. Try to visit a common site such as www.google.com and then launch:

Tools >> internet Options >> Home Page  and click Use Current or try "use default". This should solve your problem if this is just a homepage issue. But sometimes this  might be because of a half removed helper application (an application launched from buttons and menus over the browser). In this case I'll suggest you to use a program called:

HiJAckThis it is a small but poerful application. IT is free an d you can download it from the Trend Micro site. Once launched it will display all your drivers and aif tere are some helpers with out a supporting file etc then you can delete them.

You can find it here : http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

I guess using one or two of the above methods will help you solve your problem.

Cheers,
K.
.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
optomaCommented:
Run autoruns.
In Autoruns:
Hit options and check "verify code signatures" and rescan (F5 key)
Don't make any other changes...

Within Autoruns,select the file tab and select save(Ctrl+S) and save as AutoRuns Data (*.arn) -Output file is a few megs in sizeOnce saved then right click autoruns.arn and rename to autoruns.txt to upload

Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

irocwebsCommented:
0
sexygeekAuthor Commented:
Optoma,

Where do I upload the .txt file to?
0
optomaCommented:
It should be a few megs in size.
You can use the "file" button below to upload here
0
TrustWiseCommented:
0
Kerem ERSOYPresidentCommented:
Did You try HiJAckThis that I've suggested? In fact all us experts trying to convince to to do the basically same thing. Access your Browser Helpers (plugins to your browsers) and startup programs. But it seesm that you don't follow our suggestions. Please respond to comments timely.

0
Mohammed HamadaSenior IT ConsultantCommented:
Have you checked your schedule tasks list? might be loaded there!
0
wizzard0zCommented:
Try running regedit backup reg FIRST
scan for runonce. once you have found this there should be a folder Dir above it called    RUN this is were most of the tsr programs hide. Look in the run folder if you don't see it there then press F3 to move on to the next runonce Dir and then look at the run folder that is above it again and keep checking all the run folders, If you don't find it this way then try searching for the " file:/// " by its self to see if it is in the registry file once you find it you should be able to delete the entry.
exit the registry editor and then reboot to see if it is fixed.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.