给火绒规则作者参照的Kab规则

Rosa真紅

閲前須知
接下來會遇到以下幾類情況
手滑
完全手打 I和l不分 蝸牛速校隊
過時
前代系統的遺留 新系統已經不使用或改鍵值 蝸牛速審核
重復
與火絨已有規則重復或部分重復 或將來會出現重復 蝸牛速排查
國際化
某規則保護的軟件在天朝不常用 例如MSN ICQ等 同樣天朝的一些軟件也沒有定義 如QQ
非重要
此鍵值已無主要威脅 前提或進一步操作已被封堵 自行判斷
誤報或系統異常
由於火絨與卡巴斯基HIPS的機制不完全相同 文末會列出我系統中Microsoft組信任文件列表
其中會有多餘或缺失的文件自行判斷 若不添加很大幾率造成系統異常 蝸牛速排雷
蝸牛速既是說 與其指望我有生之年查完還是求人不如求己吧

整理這個規則的目的是爲了以隱私保護規則補強系統加固規則 使之達到到大部分FD和RD的效果
但是火絨現有的隱私保護規則無法命名 彈窗看到的是一個個鍵值目錄而非代表的意義 所以不適合電腦初學者使用
V大說以後會完善的自訂規則 完善之前可以根據需要選用
手打卡巴斯基使用規則 僅供研究參考 禁止轉載
要是卡巴知道了下個中文版本這些鍵值不公開就哭了
卡巴規則為主 輔以comodoV6默認規則
必須強調 火絨不包含的規則不代表火絨的規則有缺陷
火絨已經防禦了主要威脅 沒有包含的部分已無高危險性
火絨AD規則不夠完整 尚無良好的替代方法
尚未排雷 不懂的人亂加會出問題
規則資料完全公開供日後火絨的個人規則作者參考

我無意和誰爭論正體和簡化字哪個優越
也無意觸及天朝的民族思想
這也不是口水樓 算是技術資料匯集吧 望回帖不要無腦黑

由於篇幅過長 而且隨著編輯至少還會長兩倍左右 可用右上角樓層跳轉
目錄
簡介………………………………………………………………1樓
防火墻規則解析………………………………………………2樓
啓動設置………………………………………………………3樓
系統文件及關鍵設置………………………………………4樓
安全設置及IE規則…………………………………………5樓
系統服務及其它……………………………………………6樓
隐私保护规则………………………………………………7樓
系统墙补强……………………………………………………8樓
整理后RD規則（預留）…………………………………9樓
用以導入的脚本合集………………………………………10樓
以及FD RD規則的局限性

從卡巴和comodo偷來的規則 勿加精加亮加原創 低調
我會告訴你我是偷著更新的嗎？ 最后的更新日期是14年4月22日 低调低调

Rosa真紅

防火墻默認規則
規則名稱：DNS over TCP
協議：TCP
方向：發送
遠程端口：53
操作：根據應用程序規則

規則名稱：DNS over UDP
協議：UDP
方向：發送
遠程端口：53
操作：根據應用程序規則

規則名稱：Sending E-Mails
協議：TCP
方向：發送
遠程端口：25, 465, 143, 993
操作：根據應用程序規則

規則名稱：Any network activity
協議：全部
方向：接收/發送
地址：子網地址 受信任網絡
操作：允許

規則名稱：Any network activity
協議：全部
方向：接收/發送
地址：子網地址 局域網
操作：根據應用程序規則

規則名稱：Remote Desktop
協議：TCP
方向：接收
本地端口：3389
操作：阻止

規則名稱：Local Services (TCP)
協議：TCP
方向：接收
本地端口：135, 137, 138, 139, 445, 1110, 2869
操作：阻止
注：1110是卡巴斯基的監測端口

規則名稱：Local Services (UDP)
協議：UDP
方向：接收
本地端口：123, 135, 137, 138, 139, 445
操作：阻止

規則名稱：Any incoming TCP stream
協議：TCP
方向：接收
操作：根據應用程序規則

規則名稱：Any incoming UDP stream
協議：UDP
方向：接收
操作：根據應用程序規則

規則名稱：ICMP Destination Unreachable (in)
協議：ICMP
方向：接收（包）
ICMP设置：目标不可达 代码0
操作：允許

規則名稱：ICMP Echo Reply (in)
協議：ICMP
方向：接收（包）
ICMP设置：Echo响应 代码0
操作：允許

規則名稱：ICMP Time Exceeded (in)
協議：ICMP
方向：接收（包）
ICMP设置：超时 代码0
操作：允許

規則名稱：Any incoming ICMP
協議：ICMP
方向：接收（包）
操作：阻止

規則名稱：ICMPv6 Echo Request (in)
協議：ICMPv6
方向：接收（包）
ICMP類型：Echo请求 代码0
操作：阻止

可手動添加的規則庫中規則

規則名稱：Receiving E-Mails
協議：TCP
方向：發送
遠程端口：110, 995, 143, 993

規則名稱：Web-Browsing
協議：TCP
方向：發送
遠程端口：80 - 83, 443, 1080, 3128, 8000, 8080, 8088, 11523

規則名稱：IRC Activity (out)
協議：TCP
方向：發送
遠程端口：6660 - 7000

規則名稱：DHCP Address Assignment(UDP)
協議：UDP
方向：接收/發送
遠程端口：67, 547
本地端口：68, 546

規則名稱：Any outgoing TCP stream
協議：TCP
方向：發送

規則名稱：Any outgoing UDP stream
方向：協議：UDP
方向：發送

規則名稱：Any incoming ICMP
協議：ICMP
方向：接收（包）

規則名稱：ICMP Echo Request (out)
協議：ICMP
方向：發送（包）
ICMP類型：Echo

規則名稱：ActiveSync
協議：TCP
方向：接收
本地端口：990


規則庫中的非默認規則沒有默認操作
遠程端口和本地端口如未寫明則為空（全部）
地址未寫明則為全部地址

防火墻應用程序默認規則為：
受信任組允許
低限制組提示
高限制組提示
不信任組禁止

卡巴包過濾防火牆規則的新手向解釋
公用網絡
封堵本地入方向TCP/UDP135 445 遠程桌面TCP3389
NetBIOS名稱服務TCP/UDP137-139 SSDP發現服務TCP2869
NTP網絡時間協議UDP123的端口（火絨通訊規則）
以及卡巴監控使用端口TCP1110 1978
其中封堵123 137-139 2869的作用是防惡意探測
其它TCPUDP連接根據應用程序規則（火絨聯網控制）
允許接收ping包 數據包不可達和數據包超時三種類型的ICMP報文
禁止接收其它報文（火絨ICMP規則）
對出方向連接在公用網絡中沒有特別的規則

謹慎添加禁止的遠程端口是：53.67,68,80,443 僅IPv4
在系統時間校隊時會連出UDP123NTP網絡時間協議端口

使用comodo的DNS可以過濾小部份惡意或釣魚網址
8.26.56.26
156.154.70.22

Rosa真紅

操作系統類默認規則為
受信任組 允許讀取寫入刪除創建
低限制組 允許讀取 提示寫入刪除創建
高限制組 允許讀取 禁止寫入刪除創建並記錄日誌
不信任組 禁止讀取 禁止寫入刪除創建並記錄日誌

啓動設置
默認排序
anyfile_open
HKCR\*file\shell\open\command\*
anyfile_runas
HKCR\*file\shell\runas\command\*
AEDebug
*\Software\Microsoft\Windows NT\CurrentVersion\AEDebug\Debugger
Winlogon_Shell
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Winlogon_Shell
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit
Winlogon_Shell
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\System
Winlogon_Shell
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost
Winlogon_Shell
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet
Winlogon_Shell
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup
Winlogon_Notify
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*\DllName
Main_Run
*\Software\*\Windows*\CurrentVersion\Run*\*
ICQ_Agent
*\Software\Mirabilis\ICQ\Agent\Apps\*
ICQ_Path
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ICQ*\Path
ActiveSetup
HKLM\Software\Microsoft\Active Setup\Installed Components\*\StubPath
WOW_BOOT
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW\BOOT\*
WOW_NonWindowsApp
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW\NonWindowsApp\*
WOW_Standard
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW\Standard\*
CurrentVersion_Drivers
HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion\Drivers\*
CurrentVersion_Drivers32
HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion\Drivers32\*
AppInit_DLLs
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
ShellServiceObjectDelayLoad
*\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\*
BootExecute
HKLM\system\currentcontrolset\control\Session Manager\BootExecute
VBA_Monitors
HKLM\SOFTWARE\Microsoft\VBA\Monitors\*\CLSID
SCRNSAVE
*\Control Panel\Desktop\SCRNSAVE.EXE
SharedTaskScheduler
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\*
ShellExecuteHooks
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*
System_Scripts
*\Software\Policies\Microsoft\Windows\System\Scripts\*\*
Explorer_Run
*\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\*
WinSock2_Parameters
HKLM\SYSTEM\CurrentControlSte\Services\WinSock2\Parameters\*\*
Taskman
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
Policies_Shell
*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
Shell Extensions
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\*
Command_Processor_AutoRun
*\Software\Microsoft\Command Processor\AutoRun
Explorer_FileExts
*\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\*
MPRServices
HKLM\System\CurrentControlSet\Control\MPRServices\*\DLLName
Common Startup
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders\Common Startup
Common Startup
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders\Startup
Common Startup
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders\Start Menu
Common Startup
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders\Common Start Menu
GPExtensions
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\*
Environment
HKLM\SYSTEM\ControlSet???\Control\Session Manager\Environment\*
GinaDLL
*\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
BootVerificationProgram
HKLM\SYSTEM\ControlSet???\Control\BootVerificationProgram\ImagePath
VirtualDeviceDrivers
HKLM\SYSTEM\ControlSet???\Control\VirtualDeviceDrivers\VDD
SafeBoot_AlternateShell
HKLM\SYSTEM\ControlSet???\Control\SafeBoot\AlternateShell
SafeBoot_Minimal
HKLM\SYSTEM\ControlSet???\Control\SafeBoot\Minimal\*\ImagePath
SafeBoot_Network
HKLM\SYSTEM\ControlSet???\Control\SafeBoot\Network\*\ImagePath
SafeBoot_Minimal_Parameters
HKLM\SYSTEM\ControlSet???\Control\SafeBoot\Minimal\*\Parameters\ServiceDll
Main_Run_Cuser
*\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
Main_Run_Cuser
*\Software\Microsoft\Windows NT\CurrentVersion\Windows\run
SafeBoot_Network_Parameters
HKLM\SYSTEM\ControlSet???\Control\SafeBoot\Network\*\Parameters\ServiceDll
ImageFileExecutionOptions
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\Debugger
ftp_open
*classes\ftp\shell\open\command\*
mailto_open
*\SOFTWARE\Classes\mailto\shell\open\command\*
subsystems
*\SYSTEM\CONTROLSET???\CONTROL\SESSION MANAGER\SUBSYSTEMS\windows
session_execute
HKLM\system\currentcontrolset\control\Session Manager\SetupExecute
session_execute
HKLM\system\currentcontrolset\control\Session Manager\Execute
IE_components
*\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DESKTOP\COMPONENTS\*
IE_extensions
*\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTESIONS\*
IE_pi_extensions
*\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PLUGINS\EXTENSION\location
RDPWD
*\SYSTEM\CONTROLSET???\CONTROL\TERMINAL SERVER\WDS\RDPWD\startupprograms
terminal_serv_inst
*\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\*
distrib_units
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\*
IE_components
*\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DESKTOP\COMPONENTS\*\*
IE_extensions
*\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*\*
IE_pi_extensions
*\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PLUGINS\EXTENSION\*\location
terminal_serv_inst
*\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\*\*
distrib_units
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\*\*
extensions
*\Software\Microsoft\Windows NT\CurrentVersion\Extensions\*
win_ini
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\load
win_ini
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\run
win_ini
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\winlogon
system_ini
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\boot\shell
protocol_filter
HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\*
protocol_filter
HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\*\*
protocol_handler
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\*
protocol_handler
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\*\*
ColumnHandlers
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\*
ColumnHandlers
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\*\*
LangBarAddin
HKLM\Software\Microsoft\Ctf\LangBarAddin\*
LangBarAddin
HKLM\Software\Microsoft\Ctf\LangBarAddin\*\*
MountPoint
*\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\*\Shell\*\command\*
CdromAutoRun
HKLM\SYSTEM\CurrentControlSet\Services\Cdrom\AutoRun
Autorun.inf
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf\*
AutoplayHandlers
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\CancelAutoplay\Files\*
ShellIconOverlayIdentifiers
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*\*
SubSystemsWindows
HKLM\SYSTEM\ControlSet???\Control\Session Manager\SubSystems\Windows
KnownDlls
*\SYSTEM\CONTROLSET???\CONTROL\SESSION MANAGER\KNOWNDLLS\*
CommonStartup1
%HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders^Common Startup%\*
CommonStartup2
%HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders^Common Startup%\*
UserStartup1
%HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders^Startup%\*
UserStartup2
%HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders^Startup%\*
TasksFolder
%HKLM\SOFTWARE\Microsoft\SchedulingAgent^TasksFolder%\*
LsaNotificationPackages
HKLM\SYSTEM\ControlSet???\Control\Lsa\Notification Packages
ImageFileExecutionOptions2
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\VerifierDlls
LsaAuthenticationPackages
HKLM\SYSTEM\ControlSet???\Control\Lsa\Authentication Packages
LsaSecurityPackages
HKLM\SYSTEM\ControlSet???\Control\Lsa\Security Packages
KeyboardLayouts
HKLM\SYSTEM\ControlSet???\Control\Keyboard Layouts\*\*
AppCertDlls
HKLM\SYSTEM\ControlSet???\Control\Session Manager\AppCertDlls\*
BITS-IGDSearcherDLL
*\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\IGDSearcherDLL
ServiceControlManagerExtension
*\SYSTEM\CONTROLSET???\Control\ServiceControlManagerExtension
SystemLsaExtensionConfig
*\SYSTEM\CONTROLSET???\Control\LsaExtensionConfig\LsaSrv\Extensions
SystemSecurityProviders
*\SYSTEM\CONTROLSET???\Control\SecurityProviders\SecurityProviders
DllSurrogate
*\AppId\{????????-????-????-????-????????????}DllSurrogate
RemoteRpcDll
*\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
AccessibilityConfiguration
*\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration
Accessibility-ATs
*\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\*
PendingFileRenameOperations2
*\SYSTEM\CONTROLSET???\Control\Session Manager\PendingFileRenameOperations2
InternetSettingsProxyServer
*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
InternetSettingsProxyEnable
*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
SaferCodeIdentifiers1
*\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\*\*
SaferCodeIdentifiers2
*\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\*
GroupPolicyStartup
*\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\*
GroupPolicyMachineStartup
*\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\*
ddeexec
*\http\shell\open\ddeexec\*
InternetSettingsDefaultConnectionSettings
*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
InternetSettingsSavedLegacySettings
*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
comodo補充啟動規則
*\Software\Microsoft\Windows CE Services\AutoStart
  *\Software\Microsoft\Rpc\*
*\Software\Microsoft\netsh\*
*\Software\Microsoft\SideShow\Gadgets\*
  *\Software\Microsoft\Windows\CurrentVersion\BITS
*\Software\Microsoft\Windows\CurrentVersion\DriverSearching\Plugin\*
*\Software\Microsoft\Windows NT\CurrentVersion\Autheniation*
  *\Software\Microsoft\Windows NT\CurrentVersion\Windows*
  *\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\*
  *\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\*
  *\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\*
*\Software\Microsoft\Command Processor\AutoRun
  *\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*
  *\Software\Microsoft\Windows NT\CurrentVersion\Accessibility*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AppKey\*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\*
  *\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\*Startup
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\*Start Menu
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*
  *\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.???\*
*\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\*
*\SOFTWARE\Microsoft\Internet Explorer\Help_Menu_URLs\*

啓動設置的新手向解釋
卡巴把啓動和設置放在一組 可能是因爲有些項處於中間地帶不好分開
而且都是會開機加載的内容
卡巴規則中的HK?? 是HKEY和後面兩個的縮寫
HKCR既是HKEY_CLASSES_ROOT
HKCU既是HKEY_CURRENT_USER
HKLM既是HKEY_LOCAL_MACHINE
還好卡巴規則中沒有出現HKUS和HKCC
不懂的鍵值可以google一下 其實大部分看英文就明白了 有爭議的會一點點寫出

Rosa真紅

系統文件
默認排序
15版默认不启用规则名称前已加空格
boot.ini
%SystemDrive%\boot.ini
win.ini
%windir%\win.ini
system.ini
%windir%\system.ini
  autoexec.bat
%SystemDrive%\autoexec.bat
  config.sys
%SystemDrive%\config.sys
SystemExe
%windir%\*.exe
SystemDll
%windir%\*.dll
Drivers
%windir%\*.sys
Kernel1
%windir%\system32\ntoskrnl.exe
Kernel2
%windir%\system32\ntkrnlpa.exe
  InternetExplorer_DLL
%ProgramW6432%\Internet Explorer\*.dll
  InternetExplorer_EXE
%ProgramW6432%\Internet Explorer\*.exe
  InternetExplorer_SYS
%ProgramW6432%\Internet Explorer\*.sys
InternetExplorer_DLL86
%ProgramFiles(x86)%\Internet Explorer\*.dll
  InternetExplorer_EXE86
%ProgramFiles(x86)%\Internet Explorer\*.exe
  InternetExplorer_SYS86
%ProgramFiles(x86)%\Internet Explorer\*.sys
  WindowsCatroot
%windir%\system32\catroot\*\*.*
WindowsDrivers
%windir%\system32\drivers\*.*
WindowsDriversStore
%windir%\system32\driverstore\*\*
  klogon.dl（卡巴文件）
%windir%\system32\klogon.dll
  msvcp100.dll
%windir%\sysWOW64\msvcp100.dll
msvcr100.dll
%windir%\sysWOW64\msvcr100.dll
InternetExplorer_DLL2
%ProgramFiles%\Internet Explorer\*.dll
InternetExplorer_EXE2
%ProgramFiles%\Internet Explorer\*.exe
InternetExplorer_SYS2
%ProgramFiles%\Internet Explorer\*.sys
comodo補充系統文件規則
%SystemDrive%\bootmgr
%SystemDrive%\boot\*
%SystemDrive%\ntdetect.com
%SystemDrive%\ntldrl
%windir%\*.ocx
%windir%\*.bat
%windir%\*.pif
%windir%\*.scr
%windir%\*.cpl
%windir%\*.com
%windir%\*.cmd

comodo補充重要鍵
HKLM\SYSTEM\ControlSet???\Services\*
HKLM\SYSTEM\ControlSet???\Control\*
HKLM\SYSTEM\ControlSet???\Class\*
*\SYSTEM\ControlSet???\Enum\ROOT\LEGACY_*\CSConfigFlags
*\SOFTWARE\Microsoft\Driver Signing\Policy
*\SOFTWARE\Classes\Filter*
*\SOFTWARE\Classes\*\shell*
*\SOFTWARE\Classes\*\DefaultIcon*
*\SOFTWARE\Classes\.*\*
*\SOFTWARE\Classes\AutoProxyTypes*
*\SOFTWARE\Classes\PROTOCOLS\Filter\*
*\SOFTWARE\Classes\PROTOCOLS\Handler\*
*\SOFTWARE\Classes\CLSID*
*\SOFTWARE\Classes\AppID*
*\SOFTWARE\Classes\LocalSettings\*
*\SOFTWARE\Microsoft\Security Center\*
*\SOFTWARE\Microsoft\Code Store Database\Distribution Units\*
*\SOFTWARE\Microsoft\Ctf\LangBarAddin\*
HKUS\*\Environment*
HKUS\*\Control Panel*
*\Software\Microsoft\Windows\CurrentVersion\Control Panel\Don't Load\*
*\SOFTWARE\Policies\*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths*
*\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore*

系統文件類的新手向解釋

%SystemDrive%引用的是系統安裝的盤符 一般是C盤 在已有系統中引導安裝的系統可能會改盤符
%windir%一般指向C:\Windows
%ProgramW6432%一般指向C:\Program Files
%ProgramFiles(x86)%一般指向C:\Program Files (x86)
%ProgramData%一般指向C:\ProgramData
%USERPROFILE%一般指向C:\Users\用戶的目錄
現有的火絨文件保護不支持引用參數 所以需用時請替換
Vista SP1以後引導機制變了 boot.ini消失
autoexec.bat config.sys ntldrl ntdetect.com文件boot目錄
這幾個是XP的規則
bootmgr是Vista以後的
Win7後專用以引導的分區 沒有無聊的分配盤符 不寫底層就很安全

Rosa真紅

安全設置
默認排序
TemplatePolicies
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\*\*
ZoneMap
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\*\*
Zones
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\*\*
Policies_TemplatePolicies
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\*\*
Policies_ZoneMap
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\*\*
Policies_Zones
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\*\*
Policies_Explorer
*\SOFTWARE\Microsoft\Windows\Currentversion\Policies\Explorer\*
Policies_System
*\Software\Microsoft\Windows\Currentversion\Policies\System\*
Memory Management
HKLM\SYSTEM\ControlSet???\Control\Session Manager\Memory Management\EnforceWriteProtection
Winlogon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable
Driver Signing
*\Software\Microsoft\Driver Signing\Policy
Firewall Policy
HKLM\SYSTEM\ControlSet???\Services\SharedAccess\Parameters\FirewallPolicy\*\*
Policies_Explorer2
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\*
Policies_Explorer3
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\*\*
KAV_AppcompatFlags（卡巴文件）
*\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\*avp.exe
Classes_exe1
*classes\.exe
Classes_exe2
*classes\.exe\*\*
Classes_exe3
*classes\.exe\*
PendingFileRenameOperarions
*\SYSTEM\CONTROLSET???\CONTROL\SESSION MANAGER\PendingFileRenameOperations
SessionManager_Environment
*\SYSTEM\CONTROLSET???\CONTROL\SESSION MANAGER\ENVIRONMENT\*
WinlogonNotify1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*\*
WinlogonNotify2
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*
SystemCertificates1
HKLM\SOFTWARE\Microsoft\SystemCertificates\*\*
SystemCertificates2
HKLM\SOFTWARE\Microsoft\SystemCertificates\*
SystemControlNetwork1
HKLM\SYSTEM\ControlSet???\Control\Network\*\*
SystemControlNetwork2
HKLM\SYSTEM\ControlSet???\Control\Network\*
SystemEnumRoot1
HKLM\SYSTEM\ControlSet???\Enum\Root\*\*
SystemEnumRoot2
HKLM\SYSTEM\ControlSet???\Enum\Root\*
SystemServices1
HKLM\SYSTEM\ControlSet???\services\*\*
SystemServices2
HKLM\SYSTEM\ControlSet???\services\*
SoftwareClasses1
HKLM\SOFTWARE\Classes\*\*
SoftwareClasses2
HKLM\SOFTWARE\Classes\*
SoftwareClasses3
HKLM\SOFTWARE\Wow6432Node\Classes\*\*
SoftwareClasses4
HKLM\SOFTWARE\Wow6432Node\Classes\*
ControlEarlyLaunch1
HKLM\System\ControlSet???\Control\EarlyLaunch\*\*
ControlEarlyLaunch2
HKLM\System\ControlSet???\Control\EarlyLaunch\*
PoliciesEarlyLaunch1
HKLM\System\ControlSet???\Policies\EarlyLaunch\*\*
PoliciesEarlyLaunch2
HKLM\System\ControlSet???\Policies\EarlyLaunch\*
Policies_Zones1
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\*
Classes_CLSID2
HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\*\*
ColumnHandlers2
HKLM\SOFTWARE\Wow6432Node\Classes\Folder\shellex\ColumnHandlers\*
ColumnHandler3
HKLM\SOFTWARE\Wow6432Node\Classes\Folder\shellex\ColumnHandlers\*\*
portocol_filter2
HKLM\SOFTWARE\Wow6432Node\Classes\PROTOCOLS\Filter\*
portocol_filter3
HKLM\SOFTWARE\Wow6432Node\Classes\PROTOCOLS\Filter\*\*
portocol_handler2
HKLM\SOFTWARE\Wow6432Node\Classes\PROTOCOLS\Handler\*
portocol_handler3
HKLM\SOFTWARE\Wow6432Node\Classes\PROTOCOLS\Handler\*
SecurityCenterMonitoring2
HKLM\SOFTWARE\Microsoft\Security Center\Monitoring\*\*

comodo補充IE設置規則
*\SOFTWARE\Clients\StartMenuInternet\*
*\SOFTWARE\Microsoft\Internet Domains\*
*\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\*
*\SOFTWARE\Microsoft\Internet Explorer\Styles\Stylesheet
*\SOFTWARE\Microsoft\Internet Explorer\Styles\Use My Stylesheet
*\SOFTWARE\Microsoft\Internet Explorer\Styles\User Stylesheet
*\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\*
*\SOFTWARE\Microsoft\Internet Explorer\SearchURL\*
*\SOFTWARE\Microsoft\Internet Explorer\Control Panel\*
*\SOFTWARE\Microsoft\Internet Explorer\Download\*
*\SOFTWARE\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions
*\SOFTWARE\Microsoft\Internet Explorer\ShellBrowser\*
*\SOFTWARE\Microsoft\Internet Explorer\WebBrowser\*
*\SOFTWARE\Microsoft\Internet Explorer\MenuExt\*
*\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{*}
*\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\Wallpaper
*\SOFTWARE\Microsoft\Internet Explorer\Main\*Start Page*
*\SOFTWARE\Microsoft\Internet Explorer\Main\Search*
*\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
*\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL
*\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page
*\SOFTWARE\Microsoft\Internet Explorer\Main\HOMEOldSP
*\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL
*\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
*\Software\Microsoft\Internet Explorer\Search\SearchAssistant
*\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SafeSites\*
  *\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\*
  *\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections*
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MinLevel
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Safety Warning Level
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Trust Warning Level
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Security_RunActiveXControls
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Security_RunScripts
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\Cookies\*
  *\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy*
    *\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\*
    *\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\*
    *\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\User Agent\*

Rosa真紅

系統服務
默認排序
Services_ImagePath
HKLM\System\ControlSet???\Services\*\ImagePath
Services_Parameters
HKLM\System\ControlSet???\Services\*\Parameters\ServiceDll
Services_VXD
HKLM\System\ControlSet???\Services\VXD\*\StaricVxD
Host_path
HKLM\SYSTEM\ControlSet???\Services\Tcpip\Parameters\DataBasePath
Classes_CLSID
HKLM\SOFTWARE\Classes\CLSID\*\*
DNSSettings
HKLM\SYSTEM\ControlSet???\Services\Tcpip\Parameters\Interfaces\*\NameServer
PersistenRoutes
HKLM\SYSTEM\ControlSet???\Services\Tcpip\Parameters\PersistenRoutes\*
NTVDMConfig
HKLM\HARDWARE\Description\system\Configuration Data
KLAdminShares
*\*$\*
KLNetPipe
\*\pipe\*

comodo補充臨時註冊表項（估計沒人會加）
*\SOFTWARE\Classes\*\shell
*\SOFTWARE\Classes\*\shell\BagMRU*
*\SOFTWARE\Classes\*\shell\Bags*
*\SOFTWARE\Classes\*\shell\MuiCache*

comodo補充臨時文件
%temp%\*
?:\$Recycle.Bin\*
%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files\*

comodo補充Windows系統應用程序
%windir%\system32\svchost.exe
%windir%\system32\services.exe
%windir%\system32\smss.exe
%windir%\system32\csrss.exe
%windir%\system32\winlogon.exe
%windir%\system32\spoolsv.exe
%windir%\system32\lsass.exe
%windir%\system32\wbem\WMIAdap.exe
%windir%\system32\wbem\WMIPrvSE.exe
%windir%\system32\VSSVC.exe
%windir%\system32\consent.exe
%windir%\system32\SearchIndexer.exe
%windir%\system32\SearchProtocolHost.exe
%windir%\system32\dwm.exe

comodo補充windows更新應用程序
%windir%\system32\msiexec.exe
%windir%\SysWOW64\msiexec.exe
%windir%\system32\wuauclt.exe

根据14版校对后删除的注册表键
启动设置
protocol_filter2
HKCR\PROTOCOLS\Filter\*
protocol_filter2
HKCR\PROTOCOLS\Filter\*\*
protocol_handler2
HKCR\PROTOCLOLS\Handler\*
protocol_handler2
HKCR\PROTOCLOLS\Handler\*\*
安全设置
ShellExtensionsApproved1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\*
ShellExtensionsApproved2
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\*
SystemCertificates3
HKLM\SOFTWARE\Wow6432Node\Microsoft\SystemCertificates\*\*
SystemCertificates4
HKLM\SOFTWARE\Wow6432Node\Microsoft\SystemCertificates\*\
SecurityCenterMonitoring
HKLM\SOFTWARE\Wow6432Node\Microsoft\Security Center\Monitoring\*\*
ImageFileExecutionOptions
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\*

對抗U盤autorun.inf類型威脅的註冊表鍵
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\*\shell\open\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\*\shell\autorun\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\*\shell\explorer\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\*\shell\*\Command\*
from http://bbs.kafan.cn/thread-206247-1-1.html 感謝深紅的雪

CurrentControlSet、ControlSet001、ControlSet002的區別
注：火絨常用CurrentControlSet 卡巴常用ControlSet???
from http://blog.csdn.net/echoisland/article/details/6251804

comodo補充的規則還沒有開始整理
等卡巴規則整理完再以附加包的形式發出
加一個空格的是與卡巴部分重復的 comodo通配範圍較廣
加兩個空格的是卡巴通配範圍較廣
第一次篩選僅甄別與火絨已有規則重復的部分
準備開始排雷
排雷后下一次篩選要做的工作是：加漢語名 校隊 剔除過於國際化的軟體 英文名不會有親和力的

Rosa真紅

身份数据的默认规则为
受信任组 允许读取写入创建删除
低限制组 提示读取写入创建删除
高限制组 提示读取写入创建删除并记录日志
不信任组 拒绝读取写入创建删除并记录日志

身份数据 用户文件
RSS Cookies
%USERPROFILE%\Local Settings\Application Data\Microsoft\Feeds\*
My documents2
%HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders^Personal%\*
Cookies2
%HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders^Cookies%\*
History2
%HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders^History%\*
RSS Cookies2
%USERPROFILE%\AppData\Local\Microsoft\Feeds\*

身份数据 程序设置 Internet浏览器 Internet Explorer
DefaultPrefix
*\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\*
Prefixes
*\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\*
AboutURLs
*\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\*
Search
*\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant
Search
*\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Secondary Start Pages
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title
Main
*\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page
URLSearchHooks
*\Software\Microsoft\Internet Explorer\URLSearchHooks\*
SearchURL
*\Software\Microsoft\Internet Explorer\SearchURL\*
SafeSites
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SafeSites\*
Styles
*\Software\Microsoft\Internet Explorer\Styles\Use My Stylesheet
Styles
*\Software\Microsoft\Internet Explorer\Styles\User Stylesheet
ControlPanel
*\Software\Policies\Microsoft\Internet Explorer\Control Panel\*
IE_Download
*\Software\Microsoft\Internet Explorer\Download\*
IE_Attachments
*\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\*
IE_Associations
*\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\*
NoBrowserOptions
*\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions
BHO
*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*\*
IEToolbar
*\SOFTWARE\Microsoft\Internet Explorer\Toolbar\*\*
MenuExt
*\SOFTWARE\Microsoft\Internet Explorer\MenuExt\*\*
Wallpaper
*\Software\Microsoft\Internet Explorer\Desktop\General\*Wallpaper
InternetExplorerExtensions1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\*\*
InternetExplorerExtensions2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\*
InternetExplorerExtensions3
*\Software\Microsoft\Internet Explorer\*\Extensions\*\*
InternetExplorerExtensions4
*\Software\Microsoft\Internet Explorer\*\Extensions\*
InternetExplorerMenuExt2
*\Software\Microsoft\Internet Explorer\MenuExt\*

身份数据 程序设置 Internet浏览器 Mozilla Firefox
FirefoxSettings
HKLM\SOFTWARE\Mozilla\*Firefox*\*\*
FirefoxProfile
%AppData%\Mozilla\Firefox\Profiles\*\*.db

身份数据 程序设置 Internet浏览器 Opera
OperaMailSettings
%AppData%\Opera\Opera\mail\*.*
OperaProfileSettings
%AppData%\Opera\Opera\profile\*.*
OperaMailSettings
%AppData%\Opera\wand.dat

身份数据 程序设置 Internet浏览器 Google chrome
ChromeSettings1
HKLM\SOFTWARE\Google\*Chrome*\*\*

身份数据 程序设置 文件管理器 Explorer
contextmenuhandlers1
HKCR\*\shellex\contextmenuhandlers\*\*
ExplorerBrowserHelperObjects1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*\*
ExplorerBrowserHelperObjects2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\*

身份数据 程序设置 文件管理器 Far (Manager)
FarFTPSettings
*\Software\Far\Plugins\FTP\*\*
FarPluginSettings
*\Software\Far\PluginsCache\*\*
FarHistory
*\Software\Far\Saved*\*\*

身份数据 程序设置 文件管理器 Total Commander
WinCmdSettings
%windir%\wincmd.ini
WinCmdFtpSettings
%windir%\wcx_ftp.ini

身份数据 程序设置 邮件客户端 Outlook Express
OutlookExpressAccounts
*\Software\Microsoft\Internet Account Manager\Accounts\*\*
OutlookExpressSettings
*\Software\Microsoft\Outlook Express\*\*\*
OutlookExpressIdentities
*\Identities\*\Software\Microsoft\Outlook Express\*\*\*
OutlookExpressBases
%USERPROFILE%\Local Settings\Application Data\Identities\*\Microsoft\Outlook Express\*.*
OutlookExpressBases2
%USERPROFILE%\AppData\Local\Identities\*\Microsoft\Outlook Express\*.*

身份数据 程序设置 邮件客户端 The Bat!
TheBatShellSettings
HKCR\The Bat*\*\*

身份数据 程序设置 邮件客户端 Thunderbird
ThunderbirdSettings
HKLM\SOFTWARE\Mozilla\*Thunderbird*\*\*
ThunderbirdSettings2
%AppData%\Thunderbird\*.*

身份数据 程序设置 邮件客户端 Outlook
OutlookAddins1
HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\*\*
OutlookAddins2
HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\*
ExchangeCustomActions1
HKLM\SOFTWARE\Microsoft\Exchange\Client\Custom Actions\*
ExchangeExtensions1
HKLM\SOFTWARE\Microsoft\Exchange\Client\Extensions\*

身份数据 程序设置 即时通讯程序 ICQ
ICQAccountSettings2
%AppData%\ICQ\*.*

身份数据 程序设置 即时通讯程序 Mail.ru Agent
MailRuAgentSettings
*\Software\Mail.Ru\Agent\*
MailRuAgentAccounts2
%AppData%\Mra\*.*

身份数据 程序设置 即时通讯程序 Skype
SkypeSettings
*\Software\Skype\*\*
SkypeAccountAndHistory2
%AppData%\Skype\*\*.*

身份数据 程序设置 即时通讯程序 Windows Live Messenger
MSMessengerAccountSettings
%USERPROFILE%\Local Settings\Application Data\Microsoft\Messenger\*.*
MSMessengerFiles
%HKLM\SOFTWARE\Microsoft\MessengerService^InstallationDirectory%\*.*
MSMessengerAccountSettings2
%USERPROFILE%\AppData\Local\Microsoft\Messenger\*.*
MSMessengerFiles2
%HKLM\SOFTWARE\Microsoft\Windows Live\Messenger^InstallationDirectory%\*.*

身份数据 程序设置 电子钱包 WebMoney
WebMoneySettings
*\SOFTWARE\WebMoney\*\*

身份数据 程序设置 电子钱包 Bitcoin
KLBitcoinDefaultLocation
%AppData%\Bitcion\*.*

Rosa真紅

此楼将更新锁定Win7/Win8防火墙设置部分
我系统里火绒的通讯规则不能用 所以才要研究这个
如果你已经开启了安全设置的策略规则不需要添加这个 我添加了就会不提示锁死它
追踪到关于防火墙的组策略的配置文件 优先于控制面板打开的那个
这个貌似是传说中的GPO
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{????????-????-????-????-???????????}Machine\SOFTWARE\Policies\Microsoft\WindowsFirewall\*
这个也是GPO 默认的
HKEY_USERS\S-1-5-21-??????????-??????????-??????????-????\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{????????-????-????-????-????????????}Machine\SOFTWARE\Policies\Microsoft\WindowsFirewall\*
试着新建了一个规则 按照规则名查找 结果在（重要）
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\*
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\WindowsFirewall\*
这是控制面板打开的防火墙高级设置的配置文件 影响下一次开机时防火墙的配置（重要）
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\*
谁电脑里有相应的ControlSet002请告诉我
其中HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy下的FirewallRules
是一般软体会写的项 数值中有|Dir=Out|的项添加了也虽然会生效但是默认设置下无影响 向其它项里面写东西是流氓行为
备份的默认配置在
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Defaults\FirewallPolicy\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\*
这是日志（不重要）
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Microsoft-Windows-Firewall\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Microsoft-Windows-Firewall\*
即使是Win8 系统墙的安全性也不见得高到哪里 折腾系统墙纯是不得已

GPO：代表组策略对象，它存储组策略的相关配置信息。可以连接到任何SDOU，由GPC和GPT构成。
http://blog.sina.com.cn/s/blog_3f3700e9010081py.html

Rosa真紅

这层先删了 放什么考虑考虑

Rosa真紅

卡飯論壇不支持xml格式
請改後綴名爲xml



這套整理的FD RD規則的作用是保護系統不被感染破壞和惡意篡改設置
沒有包含對非系統軟體的感染破壞篡改竊取信息等其它惡意行為
例如盜號 注入進程或者用鍵盤記錄器把密碼記錄了上傳上去
駐留內存運行 作惡 但是不感染系統
在非系統盤下盤下del *.*甚至format
感染其它隨系統啟動的非Microsoft軟體 等等
以這套規則是沒用的
需要根據天朝的軟體訂制 類似comodoV5第三方規則
卡巴和comodo總公司都不在天朝 對天朝的某些軟體沒有特別的規則
選用卡巴和comodo的原因是公司比較有節操所以通用性強
還有很多需要AD規則才能保護 等火絨開放了AD規則再酌情整理

以下FD和RD規則 肯定還有信任文件要加 有彈窗多的規則要刪
適合中等以上電腦水平的參考
這幾份全導入也沒事 只要彈了窗能看懂