Recently, netizens often encounter something offensive when surfing the Internet. After browsing some websites, they mostly have personal homepages. The title bar of the IE browser has been tampered with words such as "Welcome to visit... Website". The IE start page and home page default page have also been set to the website URL of those websites. Some even add the names of those websites to the visitors' IE right-click menu. This is caused by those websites in order to promote their website by embedding JavaScript script language in web pages to modify the corresponding key values in the browser's registry, which makes us "networms" very annoyed. So how do we restore the "original appearance" of IE? Let's "break it down one by one".
Tamper with IE title bar
Symptoms: The title bar above the IE browser has been changed to the style of "Welcome to... Website", which is the most common method of tampering with many victims.
Subkeys involved:
HKEY_CURRENT_USER＼Software＼Microsoft＼Internet Explorer＼Main＼Window Title
HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Internet Explorer＼Main＼Window Title
Note: The key values of these two "Window Title" subkeys are the titles in the IE title bar.
Fix: Run the Registry Editor, expand the above two subkeys, and change the key values of these two subkeys to "Microsoft Internet Explorer" (IE default value), or you can also change the key values to a title that reflects personality like "My Dedicated Browser". Re-run IE to see the effect. How about it? Do you feel very kind?
Tamper with IE start page
Symptom: The IE start page mentioned here is a web page that will automatically open as soon as IE is run, which means that the start page has been changed to the website address of the tampered with.
Subkeys involved:
HKEY_CURRENT_USER＼Software＼Microsoft＼Internet Explorer＼Main＼Start Page
Note: The key value of this subkey is the URL of the IE start page.
Fix method: Run the registry editor, expand the above subkey, and modify the key value of the "Start Page" subkey to a certain URL. If you don't want to automatically open a web page as soon as you run IE, you can set the IE start page to a blank page, that is, change the key value of the "Start Page" subkey to "about?blank", and re-run IE to see the effect. In fact, you can also change the IE start page through the IE option settings. Setting method: Click "Tools/Internet Options" and enter the start page in "Homepage".
Special example: When the IE start page becomes some URL, even if you modify it through the option settings, it will become their URL after restarting, which is very difficult. In fact, they added a self-running program to your machine, which will set your IE start page to their website when the system starts.
Fix method: Run the Registry Editor, then expand the HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Windows＼Current Version＼Run primary key, then delete the subkey under it, then delete the self-running program c:＼Program Files＼, and finally reset the start page from the IE options.
Tamper with the default page of the IE start page
Symptom: After some IEs have been changed to the start page, even if "Use Default Page" is set, it still has no effect. This is because the default page of the IE start page has also been tampered with.
Subkeys involved:
HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Internet Explorer＼Main＼Default_Page_URL
Description: The key value of this subkey is the default page of the start page.
Fix: Run the registry editor, then expand the above subkeys, and change the URLs of the tampered websites in the key values of the "Default_Page_UR" subkey, or set them to the default values of IE.
Tamper with IE's default search engine
Symptom: There is a search engine tool button in the toolbar of IE browser, which can realize online search. After being tampered, just click the search tool button and will link to the tampered website.
Subkeys involved:
HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Internet Explorer＼Search＼CustomizeSearch
HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Internet Explorer＼Search＼SearchAssistant
Fix: Run the registry editor, expand the above subkeys in turn, and change the key values of "CustomizeSearch" and "SearchAssistant" to the URL of a certain search engine.
Tamper with the IE right-click menu
Symptoms: What will happen to you when you right-click the mouse when you browse the web page and have a "Welcome to... Website" in the pop-up menu? Is it a feeling of being plagued by demons?
Subkeys involved:
HKEY_CURRENT_USER＼Software＼Microsoft＼Internet Explorer＼MenuExt＼Welcome to...Website
Note: The "MenuExt" primary key is the control primary key of the IE extension menu item. If you have Internet Express or Internet Ant installed in your machine, you can see a subkey like "Use Internet Express Download" under this subkey.
Fix method: Run the registry editor and open the above primary key. Under the "MenuExt" primary key, there will be a primary key with similar contents of "Welcome to... Website" under the primary key of "Welcome to... Website" and delete it. However, before deleting, you can expand this primary key to take a look. There is a link here to open a subkey of the HTML file, look at the file path, and then delete the file according to the path (note that the HTML file has a hidden attribute, select "View/Folder Options/View Page/Show All Files" from the menu to see it!). This way, it is completely clear and clean. Doesn’t it feel like relief? hehe!
A dialog box pops up when the system starts
Symptom: When the computer is turned on, a window with the recommended website "Welcome to www..." style will pop up. After entering the system, the IE browser will be automatically opened, and the default homepage www will be automatically accessed... and cannot be changed.
Subkeys involved:
HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Windows＼CurrentVersion＼
Winlogon＼LegalNoticeCaption
HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Windows＼CurrentVersion＼
Winlogon＼LegalNoticeText
Note: In fact, this primary key is not related to IE, but is a control item of the Windows login prompt dialog box.
Fix: Run the registry editor, then expand the above primary keys in turn, delete the "LegalNoticeCaption" and "LegalNoticeText" primary keys and everything will be fine.
summary
The above introduces the subkeys and recovery methods involved in several tampering methods, but the subkeys involved in some tampering websites and the paths to place self-start programs will be different or there are new tampering "technology" appear. What should I do? It doesn’t matter, we have another trick to adapt to changes in the same way. When you are not sure which subkey they have modified the registry, you can "see the essence through the phenomenon", enter the registry editor, and press the "F3" key to open "Find". The search content is the website name or URL that tampers with the website. After finding it, you can delete or modify the corresponding key value, and then press the "F3" key to "Find the next one", and then stop until they are cleaned up. For situations where a self-running program is set or a file link is set, you must follow the clues and try to kill it according to the file path.