Who hijacked URL?

problem description

Chrome and Edge browsers under the Win10 system visit a certain east website, and then enter the URL directly and then jump to a link with a lot of parameters, which can be judged to be the parameters of the promotion website: 

https://www.jd.com/?cu=true&utm_source=hao.wabudian.com&utm_medium=tuiguang&utm_campaign=t_53287198_&utm_term=d9d7165b5aa645029a6805f8f1466ddb

it also happened once before. At that time, it was found that a plug-in JSONView in Chrome was installed as a copycat version, and then the system was reinstalled. Now there is a problem not only with Chrome,Edge. Search is said to be hijacked by ISP, but other people on the same network do not have this phenomenon. Trying to stop all stoppable services is also invalid. Antivirus software is also ineffective in comprehensive antivirus. Only entering the safe mode is normal. Seek a solution!

Windows chrome
Mar.25,2022

the answer has been found through my own unremitting efforts. The culprit is that a fake Office Activator (may actually activate). The original file name is office10_13_16_act.exe . After running, there is no interface, and eventually a prompt of "activate successfully" will pop up. After running, mkms.dat and vkms.dll files will be generated in the path C:\ Program Files (x86)\ Common Files\ system\ msadc . However, after each boot, there will be a "process" without a name, and viewing the details of the process will be transferred to a Windows service (the specific service name is forgotten, in short, it is about KMS activation and so on).

solution:

  1. Ctrl+Alt+Del opens the task manager and ends the process
  2. Open the Windows service and stop it (fast, otherwise it will be turned on automatically)
  3. Command Line sc delete {service_name} remove this service
  4. Delete two files of the above C:\ Program Files (x86)\ Common Files\ system\ msadc\

Previous: The way in which the front end preprocesses / formats the requested data.

Next: If you exit the mobile browser, websocket will shut down automatically. Won't it last for a long time?

css mysql arrays josn react html typescript webpack npm sass R objective-c .net sql-server jquery python-3.x angularjs django angular excel regex iphone ajax linux xml pandas vba spring database wordpress string wpf xcode windows bash postgresql oracle multithreading eclipse list firebase algorithm macos forms image scala visual-studio azure bootstrap spring-boot react-native python-2.7 docker performance function winforms matlab powershell apache dataframe api sqlite numpy rest shell selenium flutter dart maven loops qt swing android-studio csv express file class tensorflow sorting codeigniter perl
MySQL Query : SELECT * FROM `codeshelper`.`v9_news` WHERE status=99 AND catid='6' ORDER BY rand() LIMIT 5
MySQL Error : Disk full (/tmp/#sql-temptable-64f5-1eaef30-47fdb.MAI); waiting for someone to free some space... (errno: 28 "No space left on device")
MySQL Errno : 1021
Message : Disk full (/tmp/#sql-temptable-64f5-1eaef30-47fdb.MAI); waiting for someone to free some space... (errno: 28 "No space left on device")
Need Help?