下載軟體後桌面多出「商業導航」圖示，點擊強制跳轉惡意網址 (如 pp55.com)，右鍵無刪除選項，屬惡意軟體劫持「網上鄰居」CLSID ({208D2C60-3AEA-1069-A2D7-08002B30309D}) 所致。本文提供精準註冊表修復腳本，一鍵還原系統原貌。

惡意修改特徵 (HKCR\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D})

@="商業導航"
"InfoTip"="商業導航"
"LocalizedString"="商業導航"
[DefaultIcon] @="C:\\Program Files\\Internet Explorer\\am_home.ico"
[InProcServer32] @="C:\\WINDOWS\\system32\\ieframe.dll"
[shell\打開(&H)\Command] @="C:\\Program Files\\Internet Explorer\\iexplore.exe https://www.pp55.com"

標準修復數據 (可直接存為 fix_commercial_nav.reg 雙擊導入)

Windows Registry Editor Version 5.00

; === 恢復 HKCR\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D} 為「網上鄰居」 ===
[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}]
@="網上鄰居"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
  6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,53,00,48,00,45,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,\
  2d,00,32,00,32,00,39,00,31,00,32,00,00,00
"IntroText"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
  6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,53,00,48,00,45,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,\
  2d,00,33,00,31,00,37,00,34,00,39,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
  6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
  5c,00,53,00,48,00,45,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,\
  2d,00,39,00,32,00,31,00,37,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,\
  00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,31,00,37,\
  00,00,00

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,\
  00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell]
@="none"

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find]
@=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  53,00,48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,\
  2d,00,32,00,39,00,31,00,38,00,00,00
"SuppressionPolicy"=dword:00000080

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,\
  00,00,00

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\ddeexec]
@="[FindFolder(\"%l\", %I)]"

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\ddeexec\application]
@="Folders"

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\ddeexec\topic]
@="AppProperties"

[HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder]
"HideOnDesktopPerUser"=""

; === 修復 HKCU 使用者層殘留圖示 ===
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,\
  00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,31,00,37,\
  00,00,00

執行步驟

1. 將上述內容存為 fix_commercial_nav.reg (UTF-16 LE 編碼最佳)。
2. 以管理員身分雙擊執行 → 是 → 確定。
3. 重啟電腦 (或重啟 explorer.exe)。
4. 桌面右鍵 → 「內容」→ 「桌面」→ 「自訂桌面」→ 「一般」→ 勾選「網上鄰居」恢復圖示。

同步修復 IE 首頁被劫持

; 恢復 IE 首頁啟動命令
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\打開(&H)\Command]
@="C:\\Program Files\\Internet Explorer\\iexplore.exe"

執行後：右鍵桌面 IE → 內容 → 一般 → 首頁設為 about:blank 或信任網址。

防護建議

• 軟體下載僅信任官網/主流軟體管家，拒絕「高速下載器」捆綁安裝。
• 部署 AppLocker 規則：僅允許簽名驗證通過的安裝程式執行。
• 定期掃描 HKCR\CLSID\ 下非常見 GUID 項目 (腳本化巡檢)。
• 端點防護開啟「瀏覽器劫持/桌面圖示異常」行為監控。