About: blank is changed, that is, blank page content is modified, actual improvement method

xiaoxiao2021-03-06  48

The day before yesterday, I accidentally opened a foreign XXX page, and the contents of About: Blank was modified, very angry. After opening, although the address shown in the address bar is still About: Blank, but the content is an interface of a search engine. In order to return my system's innocence, I did the following things:

1, suspect the virus ghost! Try to use a domestic genuine anti-virus anti-virus - can't solve the problem, and then solve the problem after upgrading to the latest virus store. A virus did not find it, it seems not a virus!

2, suspect that there is a turbulence running. Open MSConfig, there is no suspicious stuff.

3, suspect that IE setting or registry is here! Try using the IE repair tools provided by 3721, Baidu, and Super Rabbit. 3721 and Baidu's tools seem to have nothing wrong - it is true. After the super bunny repairs, wow! Actually normal! ~~ Open IE again and have an original problem.

4, modify the registry directly. View the source file of the web page, found that there is code

I entered the regedit search "HTTP" http : //oz.msie.tv "- No results. Then, the effect is the same as the super rabbit, and the first time I opened IE in the first time, the second time I opened the original problem.

5, Internet rescue, to Baidu search: "About: blank is modified", "About: blank is changed", "blank page is modified", "blank page is changed"

what! It is search for dozens of related information. After opening, I found that 50% of the information is to call me to download what IE repair tool (I have tried it in front), 40% of the information called me to modify the registry (Try also If you don't want to say anything, then you will not say it. Some is the rescue information sent by me. Others are praised this is a kind of hacking technology - I am dizzy!

6. Suspense is to boot the DLL with malicious code (as a programmer, it is impossible to do not want this problem). Take the UltraEdit with Dongdong, search for all the files below (you want to select a full match and include subdirectories), find "http://oz.msie.tv" is not found. I am a web programmer, I know the source code for the webpage, I found that the submission button of that search interface is a file called GO.GIF, I find the entire hard drive, and the DLL file on the entire C: / I didn't find the existence of GO.GIF! What's going on here? Why is you got out with an evening? I returned to the source file and found that there is such a:

Haha, I finally found me! Just is really careful, how can I ignore such an important information? RES is resource is meaning, and a string of characters behind it is the location of the resource file! I tried to enter "Res: //% 43% 3A% 5C% 57% 49% 4E% 44% 4F% 57% 53% 5C% 53% 79% 73% 74% 65% 6D% 33% 32% 5C% 64% 6E% 6F% 6E% 2E% 64% 6C% 6C / gO.gif ", Sure successfully opened the picture as a submit button! The next step is to translate "% 43% 3A% 5C% 57% 49% 4E% 44% 4F% 57% 53% 5C% 53% 79% 73% 74% 65% 6D% 33% 32% 5C% 64% 6E% 6F% 6E% 2e% 64% 6C% 6C "meaning, I have no good way, with a very stupid magist! With Flashget, a similar code has appeared when using Flaseget from FTP. "Res: //% 43% 3A% 5C% 57% 49% 4E% 44% 4F% 57% 53% 5C% 53% 79% 73% 74% 65% 6D% 33% 32% 5C% 64% 6E % 6F% 6E% 2E% 64% 6C% 6C / GO.GIF "as a download URL Add - an error! Say it is an illegal URL! Shift clothes and try again, use "http: //% 43% 3A% 5C% 57% 49% 4E% 44% 4F% 57% 53% 5C% 53% 79% 73% 74% 65% 6D% 33% 32 % 5C% 64% 6E% 6F% 6e% 2e% 64% 6C% 6C / gof "is URL, there is no error! It's just that the file cannot be downloaded, the reason is: fri mar 05 21:01:43 2004 is connected C: /Windows/system32/dnon.dll: 80fri mar 05 21:01:44 2004 Unable to resolve domain name fri mar 05 21:01:44 2004 has a mistake!

Haha, I finally found it! The culprit is Dnon.dll. Hurry to delete! (I have estimated that it has been in memory, you need to use CopyLock to be deleted, I didn't expect to solve it easily, huh, huh ~~~)

Then, enter regedit, search DNON.dll, and there are several! Full delete!

Everything is calm! The system is finally peaceful! (There may be something residual, but I don't know).

============================================================================================================================================================================================================= ====================== Originally has already been included, and later I still want to describe the symptoms of this stuff, and it is convenient for people to search.

1.About: Blank blank page, is changed, modified. The content is a search engine page. The search page of IE is also modified. 2. A web page called sp.htm in c: / documents and settings /../ local settings / temp, which opens IE each time it will be automatically generated after deleting. 3. Each time I open IE, I will automatically reset several key values ​​in the ... / Software / Microsoft / Internet Explorer / Main, so that the modifications of the tools such as the super rabbit are changed back! 4.About: The submission address of the search page in Blank is http://oz.msie.tv/search.php Maybe there are several versions, if the symptoms described are exactly the same as what I said, you can follow my Method is done. If not exactly, you can refer to my method to perform the corresponding processing. If, completely different! So! - This article you have seen it in white!

(Finish)

转载请注明原文地址:https://www.9cbs.com/read-80842.html

New Post(0)