Link to home
Start Free TrialLog in
Avatar of sexygeek
sexygeek

asked on

Startup error won't go away after spyware removal

We removed several spyware infections from a laptop running XP Home.  Now Malwarebytes, AVG, and Kaspersky give us an "all clear".  We are still getting an error on startup:

          Windows Internet Explorer
          Cannot find 'file:///". Make sure the path or Internet address is correct.

Here's what we've tried:
  1. Windows repair install
  2. Windows Update
  3. Internet Explorer upgrade: first 7 then 8
  4. Internet Explorer reset
  5. Set MSCONFIG to "Disable" all startups and all non-Windows services
  6. Remove any temp files

Any ideas?  We hope not to have to wipe this installation because the customer has a lot of programs he'll have difficulty replacing.

Thanks!
 
   
Avatar of sexygeek
sexygeek

ASKER

Here's a print screen of the error.
error.JPG
ASKER CERTIFIED SOLUTION
Avatar of Kerem ERSOY
Kerem ERSOY

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Run autoruns.
In Autoruns:
Hit options and check "verify code signatures" and rescan (F5 key)
Don't make any other changes...

Within Autoruns,select the file tab and select save(Ctrl+S) and save as AutoRuns Data (*.arn) -Output file is a few megs in sizeOnce saved then right click autoruns.arn and rename to autoruns.txt to upload

Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Optoma,

Where do I upload the .txt file to?
It should be a few megs in size.
You can use the "file" button below to upload here
Did You try HiJAckThis that I've suggested? In fact all us experts trying to convince to to do the basically same thing. Access your Browser Helpers (plugins to your browsers) and startup programs. But it seesm that you don't follow our suggestions. Please respond to comments timely.

Have you checked your schedule tasks list? might be loaded there!
Try running regedit backup reg FIRST
scan for runonce. once you have found this there should be a folder Dir above it called    RUN this is were most of the tsr programs hide. Look in the run folder if you don't see it there then press F3 to move on to the next runonce Dir and then look at the run folder that is above it again and keep checking all the run folders, If you don't find it this way then try searching for the " file:/// " by its self to see if it is in the registry file once you find it you should be able to delete the entry.
exit the registry editor and then reboot to see if it is fixed.