Pseudo IE icon deleted? Experts easily get

Recently, I often see some anti-virus website data display, intercepted to delete the "Taobao desktop icon", the latest variant of the Trojan, the desktop malicious icon turned into a desktop by shortcut Execution program Trojan. In addition to fake Taobao and other icons such as pseudo-IE icons, it is not only more deceptive, but also more difficult to remove. After deceiving users to click, it automatically turns to the phishing website, which threatens the user's computer. So how to delete the fake IE icon on such a difficult XP desktop?

So Baidu has a solution:

Open the Registry Editor,

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop

\\NameSpace\\

Keep the following 4 items:

{1f4de370-d627-11d1-ba4f-00a0c91eedba } Computer

{450D8FBA-AD25-11D0-98A8-0800361B1103} My Documents

{645FF040-5081-101B-9F08-00AA002F954} or {5ef4af3a-f726-11d0-b8a2-00c04fc309a4 } Recycle bin empty or full

{e17d4fc0-5564-11d1-83f2-00a0c90dc849} Search Results

Remember the first suspicious item,

Then go to HKEY_CLASSES_ROOT\\CLSID \\里找{112FDC99-4915-4f6e-B11B-41370D5F9A1A},

The contents found are as follows:

[HKEY_CLASSES_ROOT\\CLSID\\{112FDC99-4915-4f6e-B11B-41370D5F9A1A}]< Br>

"InfoTip"="@shdoclc.dll,-880"

"LocalizedString"="@shdoclc .dll,-880"

[HKEY_CLASSES_ROOT\\CLSID\\{112FDC99-4915-4f6e-B11B-41370D5F9A1A}\\DefaultIcon]

@=hex(2):73,00,68, 00,64,00,6f,00,63,00,6c,00,63,00,2e,00,64,00,6c,00,6c,00,2c,\\

00,30 ,00,00,00

[HKEY_CLASSES_ROOT\\CLSID\\{112FDC99-4915-4f6e-B11B-41370D5F9A1A}\\InProcServer32]

@="%SystemRoot%\\\\system32\\\\shdocvw .dll"

"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\\CLSID\\{112FDC99-4915-4f6e-B11B-41370D5F9A1A}\\shell]

@ ="Open Homepage (&H)"

[HKEY_CLASSES_ROOT\\CLSID\\{112FDC99-4915-4f6e-B11B-41370D5F9A1A}\\shell\\Properties (&R)] Previous12Next Page total 2 pages