64位Windows操作系统McAfee Host Intrusion Prevention 8.0的一些功能开启记录

TianShiYuEr

1. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\HIP\Config\Settings]
   
2. //显示任务栏图标
   
3. "ClientUI_ShowTrayIcon"=dword:00000001
   
4. //允许通过任务栏图标“全部禁用”
   
5. "ClientUI_AllowDisableFeature"=dword:00000001
   
6. //允许通过任务栏图标“禁用Firewall”
   
7. "ClientUI_AllowDisableFirewall"=dword:00000001
   
8. //允许通过任务栏图标“禁用IPS”
   
9. "ClientUI_AllowDisableIps"=dword:00000001
   
10. //开启Firewall
    
11. "FW_Enabled"=dword:00000001
    
12. //开启防火墙“入站”学习模式
    
13. "FW_LearnModeInEnabled"=dword:00000001
    
14. //开启防火墙“出站”学习模式
    
15. "FW_LearnModeOutEnabled"=dword:00000001
    
16. //开启Firewall启动保护
    
17. "FW_BootTimeEnabled"=dword:00000001
    
18. //开启防火墙IP欺骗保护
    
19. "FW_IpSpoofEnabled"=dword:00000001
    
20. //开启IPS
    
21. "IPS_IsLicensed"=dword:00000001
    
22. //开启Host IPS
    
23. "IPS_HipsEnabled"=dword:00000001
    
24. //开启Network IPS
    
25. "IPS_NipsEnabled"=dword:00000001
    
26. //开启IPS启动保护
    
27. "IPS_BootTimeIpsEnabled"=dword:00000001
    
28. 
    
29. 
    
30. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\HIP]
    
31. //开机自动开启Host IPS、Network IPS、Firewall
    
32. "LastEnabledStateHips"=dword:00000001
    
33. "LastEnabledStateNips"=dword:00000001
    
34. "LastEnabledStateFirewall"=dword:00000001

复制代码

另外看了一下文档，发现ClientControl.exe很有用：

1. Usage: ClientControl.exe [/<arg>]
   
2. 
   
3. Args:        1) /help
   
4. 
   
5.         2) /start <service name>
   
6. 
   
7.                 The service name is optional. Service 'enterceptAgent' is used by default. Other possible service name is: hipmgmt
   
8. 
   
9.         3) /stop <password> <service name>
   
10. 
    
11.                 The service name is optional. Service 'enterceptAgent' is used by default. Other possible service name is: hipmgmt
    
12. 
    
13.         4) /log <password> <log type> <log option>
    
14. 
    
15.                 Log Type:        0 = HIPS
    
16.                                 1 = Firewall
    
17. 
    
18.                 Log Option:        0 = off
    
19.                                 1 = error
    
20.                                 2 = warning
    
21.                                 3 = info
    
22.                                 4 = debug,
    
23.                                 5 = violation (HIPS only)
    
24. 
    
25.         5) /engine <password> <engine type> <engine option>
    
26. 
    
27.                 Engine Type:        0 = all
    
28.                                 1 = buffer overflow
    
29.                                 2 = sql (server only)
    
30.                                 3 = registry
    
31.                                 4 = services
    
32.                                 5 = files
    
33.                                 6 = http (server only)
    
34.                                 7 = host ips api
    
35.                                 8 = illegal use
    
36.                                 9 = program
    
37.                                 10 = hook
    
38. 
    
39.                 Engine Option:        0 = off
    
40.                                 1 = on
    
41. 
    
42.         6) /export /s <path to event log source file> <path of event log export file>
    
43. 
    
44.                 The source file path is optional. Do not include the "/s" flag if there's no source file.
    
45. 
    
46.         7) /readNaiLic
    
47. 
    
48.         8) /exportConfig <path of export file> <config type ...>
    
49. 
    
50.                 Config Type:        0 = all
    
51.                                 1 = app protection
    
52.                                 2 = blocked hosts
    
53.                                 3 = firewall
    
54.                                 4 = hip custom sigs
    
55.                                 5 = IPS exceptions
    
56.                                 6 = settings
    
57.                                 7 = trusted apps
    
58.                                 8 = trusted networks
    
59.                                 9 = network ips sigs
    
60.                                 10 = hip sigs
    
61.                                 11 = hip engines
    
62.                                 12 = logon sessions
    
63.                                 13 = DNS blocking rules
    
64. 
    
65.         9) /defConfig <password>
    
66. 
    
67.         10) /startupIPSProtection <path of export file>
    
68. 
    
69.         11) /execInfo <path of executable file>
    
70. 
    
71.         12) /fwPassthru <password> <option>
    
72. 
    
73.                 Option:        0 = off
    
74.                         1 = on
    
75. 
    
76.         13) /fwStateTableSize <password> <a numeric value between 32768 and 262144>
    
77. 
    
78. Notes:
    
79. 
    
80. 1) A password is required for the "stop", "log", "engine", "defConfig", "fwPassthru", and "fwStateTableSize" operations.
    
81. 
    
82. 2) There must be at least one space between the arg, the password, and any other required parameters.
    
83. 
    
84. 3) For operations taking numeric arguments (e.g. "log", "engine", and "exportConfig"), those arguments will be converted to unsigned integers. For example, if you enter an argument like "10.1", the program will convert that to "10" and continue execution using the converted value.
    
85. 
    
86. 4) See ClientControl.log for runtime logging. It is written to C:\Documents and Settings\All Users\Application Data\McAfee\Host Intrustion Prevention (non-Vista) or C:\Program Data\McAfee\Host Intrustion Prevention (Vista)

复制代码

aeonhuang

非常有用的资料啊

liangxy

学习了，可惜不会折腾

busihou

已弃用HIP8.0了
QQ不定时的断网连网
没Q的日子不好过

ccccccccs

QQ不定时断线是因为HIP 8.0规则设置问题。

我目前最大的问题是，　规则条数到达一定数量后，　再添加规则时，　排序不自动错乱。

牧岩

我系统是Win8.1 Pro x64，安装了小红伞Avira Antivirus Pro 14 最新版，在迈克菲官网下载了最新的HIPS 8.0 P4，看说明是支持Windows 8.1的，安装不成功，一直等到进程Windows Installer结束，然后在默认的安装目录没有，不知道怎么解决……

看日志文件，显示“安装成功或错误状态: 1603。”