okies! got the info!
VBS:Malware [Script]
C:\Windows\Temp\sp.html
C:\Windows\Temp\hp.html

also memory is infected…the .dll changes each time…this time it showed as:
Win32:Startpage-006[Trj]
C:\Windows\System\nhb.dll

VPSversion 0432-1,08/03/2004