Startup error won't go away after spyware removal

We removed several spyware infections from a laptop running XP Home.  Now Malwarebytes, AVG, and Kaspersky give us an "all clear".  We are still getting an error on startup:

          Windows Internet Explorer
          Cannot find 'file:///". Make sure the path or Internet address is correct.

Here's what we've tried:
  1. Windows repair install
  2. Windows Update
  3. Internet Explorer upgrade: first 7 then 8
  4. Internet Explorer reset
  5. Set MSCONFIG to "Disable" all startups and all non-Windows services
  6. Remove any temp files

Any ideas?  We hope not to have to wipe this installation because the customer has a lot of programs he'll have difficulty replacing.

Thanks!
 
   
sexygeekAsked:
Who is Participating?
 
Kerem ERSOYConnect With a Mentor PresidentCommented:
Hi,

It seems that one of your Trojans were removed from your system but your homepage still points to it. Try to visit a common site such as www.google.com and then launch:

Tools >> internet Options >> Home Page  and click Use Current or try "use default". This should solve your problem if this is just a homepage issue. But sometimes this  might be because of a half removed helper application (an application launched from buttons and menus over the browser). In this case I'll suggest you to use a program called:

HiJAckThis it is a small but poerful application. IT is free an d you can download it from the Trend Micro site. Once launched it will display all your drivers and aif tere are some helpers with out a supporting file etc then you can delete them.

You can find it here : http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

I guess using one or two of the above methods will help you solve your problem.

Cheers,
K.
.
0
 
sexygeekAuthor Commented:
Here's a print screen of the error.
error.JPG
0
 
optomaCommented:
Run autoruns.
In Autoruns:
Hit options and check "verify code signatures" and rescan (F5 key)
Don't make any other changes...

Within Autoruns,select the file tab and select save(Ctrl+S) and save as AutoRuns Data (*.arn) -Output file is a few megs in sizeOnce saved then right click autoruns.arn and rename to autoruns.txt to upload

Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
irocwebsCommented:
0
 
sexygeekAuthor Commented:
Optoma,

Where do I upload the .txt file to?
0
 
optomaCommented:
It should be a few megs in size.
You can use the "file" button below to upload here
0
 
TrustWiseCommented:
0
 
Kerem ERSOYPresidentCommented:
Did You try HiJAckThis that I've suggested? In fact all us experts trying to convince to to do the basically same thing. Access your Browser Helpers (plugins to your browsers) and startup programs. But it seesm that you don't follow our suggestions. Please respond to comments timely.

0
 
Mohammed HamadaSenior IT ConsultantCommented:
Have you checked your schedule tasks list? might be loaded there!
0
 
wizzard0zCommented:
Try running regedit backup reg FIRST
scan for runonce. once you have found this there should be a folder Dir above it called    RUN this is were most of the tsr programs hide. Look in the run folder if you don't see it there then press F3 to move on to the next runonce Dir and then look at the run folder that is above it again and keep checking all the run folders, If you don't find it this way then try searching for the " file:/// " by its self to see if it is in the registry file once you find it you should be able to delete the entry.
exit the registry editor and then reboot to see if it is fixed.
0
All Courses

From novice to tech pro — start learning today.