12 malicious Web page phenomena and preventive measures

When a user browses a webpage, the registry is modified. By default, IE connects the homepage, title bar, and right-click IE menu to the address when browsing the webpage (mostly advertising information ), what's more, when the browser's computer is started, a prompt window is displayed to display its own advertisement, which is becoming increasingly popular. What should we do in this situation?

1. Reasons for registry modification and solutions

In fact, this malicious webpage is an ActiveX webpage file containing harmful code. The advertisement information is generated because the browser's registry is maliciously changed.

1. The default Internet Explorer homepage is modified.

The title bar at the top of IE browser is changed to "welcome to visit ...... Website "style, which is the most common means of tampering, with a large number of victims.

The modified registry project is:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet assumermainstart Page

HKEY_CURRENT_USERSoftwareMicrosoftInternet assumermainstart Page

Modify the key value of "Start Page" to modify the default homepage connection of browser IE, for example, browsing "Wan Hua Gu" will change your IE default connection home page to "http://on888.home.chinaren.com", even out of their own home page for advertising purposes, it seems too domineering, this is also the reason for this kind of webpage dislike.

Solution:

① After Windows is started, click the "start"> "run" menu item, type regedit in the "open" column, and press the "OK" key;

② Expand the registry

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet assumermain

Under, double-click the string value "Start Page" in the right pane and change the key value of Start Page to "about: blank;

③ Similarly, expand the registry

HKEY_CURRENT_USERSoftwareMicrosoftInternet assumermain

In the right half window, find the string value "Start Page" and process it as described in section ②.

④ Exit the registry editor and restart the computer. Everything is OK!

Special example: when the start page of IE is changed to some Web sites, even if you have modified it through the option settings, it will become their Web site again after restart, which is very difficult. In fact, they added a self-running program to your machine, which will set your IE start page as their website at system startup.

Solution: run the registration table editor regedit.exe and expand

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrent VersionRun

The primary key, then delete the registry.exe sub-key, then delete the self-running Program c: Program Filesregistry.exe, and then reset the start page from the IE option.

2. Tampered with IE's ghost page

After some IE is changed to the start page, even if the "use history page" is set, it is still invalid because the history page of the IE start page is also tampered. Specifically, the following Registry key is modified:

HKEY_LOCAL_MACHINESoftwareMicrosoftInternet Explorer

MainDefault_Page_URL

The key value of the subkey "Default_Page_URL" is the homepage page of the start page.

Solution:

Run the registry editor, expand the sub-keys, and change the modified URLs in the Default_Page_UR sub-keys, or set them to the default values of IE.

3. Modify the default homepage of IE browser and lock the settings to prevent users from returning.

The following key values set by ie in the registry are modified (optional when the DWORD value is 1 ):

[HKEY_CURRENT_USERSoftwarePoliciesMicrosoftInternet assumercontrol Panel]

"Settings" = dword: 1

[HKEY_CURRENT_USERSoftwarePoliciesMicrosoftInternet assumercontrol Panel]

"Links" = dword: 1

[HKEY_CURRENT_USERSoftwarePoliciesMicrosoftInternet assumercontrol Panel]

"SecAddSites" = dword: 1

Solution:

Change the preceding DWORD value to "0" to restore the function.