Solution for changing the homepage to Union123 and quick search

[Editor's note: "http" is temporarily changed to "hxxp" for security reasons. Please note !]

When surfing the internet, we will find that our browser homepage is changed to "hxxp: // hao123.union123. * **/index.htm ". What's more strange is that when IE is opened, it will automatically switch to the quick search homepage (" hxxp: // ** .kuaiso.com /"). It seems that the domain name is probably hijacked by malware.

After careful check, we will find that two links, "download ringtones" and "Entertainment interaction Portal", are added to the favorites folder of the system. Their addresses are "hxxp: // u.7town. * **/Pub/mms/7/index.html? Uid = 19612 "and" hxxp: // *** .eqibbs.com /".

After scanning with System Repair Engineer, we found some clues:

[Jsefusf/jsefusf] [Stopped/Auto Start]
<C: windowssystem32jsefusf.exe-service> <Microsoft Corporation> is also running Microsoft!
[PID: 700] [? C: WINDOWSsystem32winlogon.exe] [Microsoft Corporation, 5.1.2600.2180
Xpsp_sp2_rtm.040803-2158]
[C: windowssystem32jsefusf. dll] [Microsoft Corporation, N/A]
 

After the malware runs, it automatically deletes it and copies the copy to the % SYSTEM % directory,

%System=jsefusf.exe
 

 

At the same time, the batch files of the malware % SYSTEM % killme. bat will be copied to % SYSTEM % and automatically deleted,

% SYSTEM % jsefusf. dll
 

In the registry, a service item is created:

HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesjsefusf
 

Files created in the system:

%System=jsefusf.exe
 

 

After the system kernel jsefusf.dllis released, the winlogon.exe process is inserted.

After learning about its mechanism, the cleanup method is roughly displayed.

First, delete the service items in the registry, Select Start> RUN> input> regedit, and expand HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservices to delete jsefusf. Change the homepage in the "properties" option of IE browser.

Then, restart the computer. After entering the system, find and delete the following two files

%System=jsefusf.exe
% SYSTEM % jsefusf. dll
 

 

Here, "% SYSTEM %" refers to the directory where your SYSTEM folder is located. You can also search for it directly and find it and delete it.