Baidu download rogue Xiaobian finishing all precautions and self-help methods!

Last week, Baidu again made a fuss about it. If everyone downloads computer software from its or soft.hao123.com and installs it, it will be implanted with malicious code to hijack traffic. Xiao Bian, as a veteran of the melon people, after learning the ins and outs of things, come and talk to everyone about what to do before and after the move!

First of all, the malicious code that appears this time is not integrated in the software installation package, but appears in the P2P downloader that the website gives users to download software. Platforms like Blizzard's Battle.net and Tencent's TGP are all P2P downloaders. They must be used to get the software they want. It is a very popular software download method these years. For manufacturers, not only can you reduce the bandwidth pressure of the download server, but you can also throw away all kinds of "household buckets" and promotional products. After all, a few megabytes of software installation packages plus those messy things will definitely be seen at a glance.

As for how Baidu's malicious code works this time, take a look at the details of the figure below.

Although Baidu said in a timely manner that “outside the pot” is something that the outsourcing team does, it also reported to the police. However, Baidu’s digital signatures are used in these downloaders. Is it okay to say that you believe it?

For our average user, to completely guard against these rogue behaviors, you can only use two words: "No solution"! Xiao Bian really recommends that you want to install what software you use, do not believe in any so-called fly download site. Do not be lazy, directly to the software's official website directly download (search engines in the "XX official website" and other keywords, accurate distinction "official website", "download", "advertising promotion" and other words can be).

In addition, after downloading, double-clicking the software to start the installation, a situation similar to the one shown below is directly closed. This is obviously a P2P downloader, not a software installation file, and is deleted immediately after the fork is removed. Check carefully again if there is an unknown website or program on the browser home page and system startup items.

If it is found that it has been recruited, Xiaobian also provides two special killing tools for everyone.

Fire velvet special kill:

Http://huorong.cn/download/tools/hrkill-v1.0.0.10.exe

Baidu official cleaning tool:

Https://

Next, using the method described in the “Licensing of the revoked rogue software”, the digital certificates used by them are completely screened out, so that these rogues can no longer be blamed.