Cannot browse

[James Wood]

When internet explorer starts it wants to open a "file
C:\documents%20and%20settings/Jo%20Smith/local%
20settings/temp/dupestart%20cdrom.htm?220=xxxxxxxxxxxxxx

When a different address is placed in the address it
comes right back to this address and says the page cannot
be displayed. This does not exist in the C: drive.

I have looked at msconfig and do not see anything jumping
out at me regarding this. I have looked at regedit in
HIKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
Explorer\Main, and it looks good. Start Page shows the
above as the start page. I modify this
to "http://www.msn.com" or anything else and exit. Go
back to regedit and the change is there. When I start
the Internet Explorer it attempts to start at the file
page and you return to regedit and it is back to pre-
modification.

I have ran "spy subtract" norton antivirus scans and they
do not indicate there is a problem.

All cookies and temporary files have been deleted.

Anyone with any ideas?

James Wood
(e-mail address removed)
3209 Glenoaks Dr
Midwest City, OK 73110
405 737-1519

 

[H Leboeuf]

Looks like you have a new variant of a parasite.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html