none
Homepage is changed to"www.2345.com/?kk840812" in all broswers includding IE RRS feed

  • 问题

  • Hey men,

    I don't know what happend to my broswers? when i open broswers including IE each time, it will start with 2345 homepage. i am sure i did't do anything.

    Anyway, i have check the settings in IE settings, even change the homepage in gp. But nothing changed. Don't tell me process this issue with such software, process monitor. I have no idea how to check any settings in register? BTW, I have make a full scan in safe mode and nothing found. 

    So, HOW TO TOUBLESHOOT THIS PROBLEM???

    Add: Homepage in IE is changed into hao123, but i will still open with 2345 page!

    2014年12月9日 5:00

答案

  • Hi nepia nei,

    I tried some tests on my machine but could not reappear this binding issue again. Because “www.2345.com” itself is not a browser hijacker site, which is promoted via other free downloads, and once installed it will change your browser homepage and set the default search engine to 2345.com. though, it will also append the argument http://2345.com/ to random Windows shortcuts on your desktop and Windows Start Menu.

    According to your description, this issue happened on your browsers (not just Internet Explorer), changing Group Policy, register and safe mode scan did not work. Process monitor could not catch that  Which means there is no fixed Process running all the time. So it might be an auto running scripts runs regularly then shut down and we sometimes ignore it. I suggest you using Microsoft WMI Administrative Tools and give it a try.

    For more details about WMI Administrative Tools:

    http://www.microsoft.com/en-us/download/confirmation.aspx?id=24045

    You could browsing and edit WMI scripts by doing following steps.

    1. Download and install WMI      Administrative Tools
    2. Open wbemeventviewer.exe      in C:\Program Files (x86)\WMI Tools or C:\Program Files \WMI Tools      with Administrator  permission
    3. Click “register for      events” in the in the upper left corner.
    4. Enter “root\subscription”      in and press “Enter

     

    1. Select “EventFilter:Name="unown_filter”      left side then right click “ActiveScriptEventConsumer Name="unown"”right side      and select view instant properties
    1. Then check the contents      in Script Text

    1. Copy Script Text code      and see if it is associated to your browser and 2345.com.
    1. If it is please delete “EventFilter:Name="unown_filter"”  in      step4 with Administrator permission
    1. Don’t forget to remove      the http://2345.com argument in the      Shortcut tab and Target field

    Regards


    Alex Zhao
    TechNet Community Support

    2014年12月18日 1:56
    版主