确认:
C:\Program Files\NetManage
删除启动项:
<WinlogonNotify: WinEvents><WinEvents.dll> []
停止并禁用服务和驱动程序
Volume Shadow Copyremd9 / ServiceCopyremd9
acpidisk / acpidisk
p1ofdze / p1ofdzee
z3fs / z3fs
删除浏览器加载项(需确认)
[STURLConnection Control]
{1E40C477-ECA7-48DC-A9FC-D4F77A365442} <C:\WINNT\Downloaded Program Files\STURLConnection.ocx, IBM>
[STAutoAway Control]
{53F92AF2-3C1E-4A63-B2EA-2E33DA6286B7} <C:\WINNT\Downloaded Program Files\STAutoAway.ocx, ibm hrl>
[JNILoader Control]
{8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59} <C:\WINNT\Downloaded Program Files\STJNILoader.ocx, Databeam>
重启系统,显示隐藏文件,删除上述相关文件.