When internet explorer starts it wants to open a "file
C:\documents%20and%20settings/Jo%20Smith/local%
20settings/temp/dupestart%20cdrom.htm?220=xxxxxxxxxxxxxx

When a different address is placed in the address it
comes right back to this address and says the page cannot
be displayed. This does not exist in the C: drive.

I have looked at msconfig and do not see anything jumping
out at me regarding this. I have looked at regedit in
HIKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Main, and it looks good. Start Page shows the
above as the start page. I modify this
to "http://www.msn.com" or anything else and exit. Go
back to regedit and the change is there. When I start
the Internet Explorer it attempts to start at the file
page and you return to regedit and it is back to pre-
modification.

I have ran "spy subtract" norton antivirus scans and they
do not indicate there is a problem.

All cookies and temporary files have been deleted.

Anyone with any ideas?

James Wood
(E-Mail Removed)
3209 Glenoaks Dr
Midwest City, OK 73110
405 737-1519

Looks like you have a new variant of a parasite.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo....hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===
"James Wood" <(E-Mail Removed)> wrote in message
news:11bba01c44217$10ce8ef0$(E-Mail Removed)...
> When internet explorer starts it wants to open a "file
> C:\documents%20and%20settings/Jo%20Smith/local%
> 20settings/temp/dupestart%20cdrom.htm?220=xxxxxxxxxxxxxx
>
> When a different address is placed in the address it
> comes right back to this address and says the page cannot
> be displayed. This does not exist in the C: drive.
>
> I have looked at msconfig and do not see anything jumping
> out at me regarding this. I have looked at regedit in
> HIKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
> Explorer\Main, and it looks good. Start Page shows the
> above as the start page. I modify this
> to "http://www.msn.com" or anything else and exit. Go
> back to regedit and the change is there. When I start
> the Internet Explorer it attempts to start at the file
> page and you return to regedit and it is back to pre-
> modification.
>
> I have ran "spy subtract" norton antivirus scans and they
> do not indicate there is a problem.
>
> All cookies and temporary files have been deleted.
>
> Anyone with any ideas?
>
> James Wood
> (E-Mail Removed)
> 3209 Glenoaks Dr
> Midwest City, OK 73110
> 405 737-1519
>