Re: "Pass this on" white homepage for sypware removal

From: Mike Burgess (winhelp2002_at_spamthis.com)
Date: 12/11/03 

Date: Thu, 11 Dec 2003 13:10:39 -0500

Kelly,
This type hijack indicates an unpatched machine, once you
get cleaned up please visit Windows Update ......... 

--
Go to: http://www.tomcoyote.org/hjt/
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip
Unzip, double-click "HijackThis.exe" and Press "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")
Next, go to the below location:
http://www.spywareinfo.com/forums/
Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.
____________________________________________________________
Mike Burgess  [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08-03]
Please post replies to this Newsgroup, email address is invalid
--
"Kelly" <anonymous@discussions.microsoft.com> wrote in message
news:3406ED3C-1C0E-4B67-9DB0-BDAC7AD9B07A@microsoft.com...
> If anyone can help....this morning when I boot up, my hompage default has
changed to http://default-homepage-network.com/start.cgi?hkcu. I can
manually change it back, but it reverts to this everytime I change. I can
see something loading when I first start up called "emcraft1.cab. When I get
in, I get a large white page that hides all toolbars that says it's a
message from an "Internet Service Provider consultant" that tries to get me
to download a "spyware removal" software. The properties on this page show
an address for http://object.passthison.com/aff/delayed. I can get around
this, but I can't seem to get rid of it. I have a firewall and have run
Spybot several times.
>
> Any help please?
Loading