表现：桌面出现多个IE的图标，双击后不是打开自己设置的主页而是打开了不熟悉的网站；不管是点鼠标右键选删除还是按键盘的delete键还是把这个图标拖到回收站均无法删除。
分析：这种情况通常是不小心打开了某些流氓网站，系统的设置被更改所导致。其原理是通过更改注册表，先在：HKEY_CLASSES_ROOT\CLSID\创建一个注册项，如下面这个创建的项是{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}：
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}]
@="Internet Explorer"
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\DefaultIcon]
@="\"C:\\Program Files\\Internet Explorer\\\\IEXPLORE.EXE\""
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell]
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\Open(&O)]
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\Open(&O)\Command]
@="\"C:\\Program Files\\Internet Explorer\\\\IEXPLORE.EXE\" %1 h%t%t%p:%/%/%ww%w%.%231%234%26%.c%o%m"
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\OpenMain]
@="打开主页(&H)"
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\Z]
@="删除(&D)"
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\Z\Command]
@="Rundll32.exe"
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\属性(&R)]
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\Shell\属性(&R)\Command]
@="Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"
[HKEY_CLASSES_ROOT\CLSID\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}\ShellFolder]
"Attributes"=dword:0000000a
然后再到这里：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\Desktop\NameSpace创建一个对应的项，如：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}]
@="Internet Explorer"
最后把正常的IE隐藏，这样桌面就产生了一个指向流氓网站且无法删除的图标了。
解决：知道原理后就好处理了，首先打开注册表：开始->运行->"regedit"，定位到：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace，正常情况下，这里有4项：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}]
@="Computer Search Results Folder"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103}]
@=""
"Removal Message"="@mydocs.dll,-900"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}]
@="Recycle Bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}]
@="Search Results Folder"
如果是被恶意更改的话，那么可能是下面这样的：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{11016101-E366-4D22-BC06-4ADA335C892B}]
@="IE History and Feeds Shell Data Source for Windows Search"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{13279F7B-09A5-E949-8880-7B7D2E7B0CAC}]
@="Internet Explorer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}]
@="Computer Search Results Folder"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103}]
@=""
"Removal Message"="@mydocs.dll,-900"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}]
@="Recycle Bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{BB2D18E9-F191-E249-B110-796EDE1736AC}]
@="Internet Explorer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}]
@="Search Results Folder"
可以看到，这个比上面正常的那个多了3个注册项，先把这3项删除，然后在：HKEY_CLASSES_ROOT\CLSID\这里查找对应的注册项，同样删除掉。最后把隐藏的IE调出来：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}.default"="0"
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000001
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"=dword:00000001
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=dword:00000001
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000
至此全部清理完毕，关闭注册表，刷新一下桌面，一般就恢复正常了
[转载：http://zhwqcd.blog.163.com/blog/static/13646315201021003032751/]
阅读(2000) | 评论(0) | 转发(0) |
