Analysis and Handling of browser homepage tampering after game playing

According to user feedback recently, the IE homepage is always changed. This phenomenon is generally a change made after the user actively or passively runs some applications without knowing it. It can be started with the system startup, it can also be started with a third-party application, or even some simple spoofing.
This article aims to introduce a common method of deception.

In this case, we first find that a navigation page still opens after setting the homepage as a blank page in Internet properties.

 

This problem occurs in this case because of a registry key value definition. For more information, see

/Article/200905/38171 .html

After manual cleaning of the registry or using Papa tools, you can normally open the blank IE homepage, but every time you run the game on the desktop, it is changed back.

After entering the game directory, the following two files caught our attention:

After you change the name of the d3dx10.dllfile and run heroe.exe, the following error is reported, and the download link is displayed unconditionally:

 

After seeing this phenomenon, the basic cause is clear. The following is a simple analysis:

1. Create a game operator to indicate the hypothetical game main program heroe.exe;

2. In fact, d3dx10. dll is a real game main program;

Break;

4.in hero.exenormal, heroe.exewill change hero.exe back to d3dx10. dll after the normal exit operation is performed by the user in the game;

5.If you cannot find the real game main program d3dx10.dllor hero.exe after heroe.exeis run, the pop-up window requires you to visit and click the game download website hxxp: // www.newyx.net

Solution:

1. Remove the hidden region d3dx10.dlland rename it hero.exe;

2. Change the file directed by the table game formula to hero.exe;

3. Use only the methods described earlier in Papa to solve the problem of modifying the IE homepage. For details, see html. ">/Article/200905/38171 .html

[Note: based on security considerations, some network links "http" in this article are replaced with "hxxp .]

[Source: Kingsoft drug overlord community. Papa is now a Jinshan customer service engineer .]