The IE browser homepage is tampered with after the game is played

According to user feedback recently, the IE homepage is always changed. This phenomenon is generally a change made after the user actively or passively runs some applications without knowing it. It can be started with the system startup, it can also be started with a third-party application, or even some simple spoofing.

This article aims to introduce a common method of deception.

In this case, we first find that a navigation page still opens after setting the homepage as a blank page in Internet properties.

This problem occurs in this case due to a registry key value definition. For more information, see: http://security.ccidnet.com/art/1099/20090513/1766611_1.html

After manual cleaning of the registry or using Papa tools, you can normally open the blank IE homepage, but every time you run the game on the desktop, it is changed back.

After entering the game directory, the following two files caught our attention:

After you change the name of the d3dx10.dllfile and run heroe.exe, the following error is reported, and the download link is displayed unconditionally:

After seeing this phenomenon, the basic cause is clear. The following is a simple analysis:

1. Create a game operator to indicate the hypothetical game main program heroe.exe;

2. In fact, d3dx10. dll is a real game main program;

Break;

4.in hero.exenormal, heroe.exewill change hero.exe back to d3dx10. dll after the normal exit operation is performed by the user in the game;

5.If you cannot find the real game main program d3dx10.dllor hero.exe after heroe.exeis run, the pop-up window requires you to visit and click the game download website hxxp: // www.newyx.net

Solution:

1. Remove the hidden region d3dx10.dlland rename it hero.exe;

2. Change the file directed by the table game formula to hero.exe;

3. Use only the methods described earlier in Papa to solve the problem of modifying the IE homepage. For more information, see http://security.ccidnet.com/art/1099/20090513/1766611_1.html.

Note: Based on security considerations, some network links "http" are replaced with "hxxp .]

1. Website navigation scammers shield similar websites from tampering with IE browsers
2. Questions about IE tampering and Automatic Webpage jump
3. Homepage tampering and Correction Methods
4. Solutions to common faults in Internet Explorer