Examkin

Question

Difficulty: MediumWeb Browser Security and Pop-Up/Redirect Troubleshooting

A desktop support technician is troubleshooting a Windows 11 workstation where opening the web browser via the desktop shortcut continuously launches an unwanted advertising website alongside the standard homepage. When launching the browser executable directly from the installation directory in Program Files, the advertising site does not load. The technician has already cleared the browser cache and disabled all active extensions. Which of the following is the MOST likely cause of this issue?

  1. The target field in the browser desktop shortcut properties has been appended with a malicious URL parameter.Answer
  2. B
    The Windows hosts file contains a malicious IP mapping directing traffic to the advertising domain.
  3. C
    A persistent browser helper object (BHO) is hijacking search query requests.
  4. D
    The system proxy settings in Internet Options are configured to redirect all web traffic.

Answer

The target field in the browser desktop shortcut properties has been appended with a malicious URL parameter.
Malware often alters the Target property of desktop shortcut links by appending a URL parameter after the executable path. When launched via the shortcut, the browser processes the URL parameter and opens the site. Launching the executable file directly from the file system bypasses the modified shortcut parameters, explaining why the issue only occurs when using the desktop icon.

Step-by-Step Solution

1
Analyze the difference in browser behavior between the two launch methods.
The unwanted advertising site opens ONLY when launched via the shortcut icon, but NOT when running the executable directly.
Isolating launch triggers narrows the problem specifically to shortcut properties rather than global system or browser-wide settings.
2
Inspect the properties of the browser desktop shortcut file.
The Target field shows extra arguments after the executable path, such as appending a URL to the launch command.
Malware frequently modifies shortcut parameters so that a specific web page is passed as a command-line argument during browser startup.
3
Determine the appropriate remediation step.
Remove the unwanted URL string from the shortcut Target field or delete and recreate the shortcut icon.
Cleaning the shortcut Target path restores normal browser launching without executing extra URL arguments.

Key Concept

Browser Hijacker Shortcut Parameter Manipulation
Estimated Time:1m 30s
Rate this question

Topics

Web Browser Security and Pop-Up/Redirect Troubleshooting

More questions from this topic