The IE browser homepage is tampered with after the game is played

Source: Internet
Author: User
Tags blank page

According to user feedback recently, the IE homepage is always changed. This phenomenon is generally a change made after the user actively or passively runs some applications without knowing it. It can be started with the system startup, it can also be started with a third-party application, or even some simple spoofing.

This article aims to introduce a common method of deception.

In this case, we first find that a navigation page still opens after setting the homepage as a blank page in Internet properties.

 

This problem occurs in this case due to a registry key value definition. For more information, see: http://security.ccidnet.com/art/1099/20090513/1766611_1.html

After manual cleaning of the registry or using Papa tools, you can normally open the blank IE homepage, but every time you run the game on the desktop, it is changed back.

 

After entering the game directory, the following two files caught our attention:

 

After you change the name of the d3dx10.dllfile and run heroe.exe, the following error is reported, and the download link is displayed unconditionally:

 

After seeing this phenomenon, the basic cause is clear. The following is a simple analysis:

1. Create a game operator to indicate the hypothetical game main program heroe.exe;

2. In fact, d3dx10. dll is a real game main program;

Break;

4.in hero.exenormal, heroe.exewill change hero.exe back to d3dx10. dll after the normal exit operation is performed by the user in the game;

5.If you cannot find the real game main program d3dx10.dllor hero.exe after heroe.exeis run, the pop-up window requires you to visit and click the game download website hxxp: // www.newyx.net

Solution:

1. Remove the hidden region d3dx10.dlland rename it hero.exe;

2. Change the file directed by the table game formula to hero.exe;

3. Use only the methods described earlier in Papa to solve the problem of modifying the IE homepage. For more information, see http://security.ccidnet.com/art/1099/20090513/1766611_1.html.

Note: Based on security considerations, some network links "http" are replaced with "hxxp .]

  1. Website navigation scammers shield similar websites from tampering with IE browsers
  2. Questions about IE tampering and Automatic Webpage jump
  3. Homepage tampering and Correction Methods
  4. Solutions to common faults in Internet Explorer

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.