最近咱们的基准线在样本区表现不错，一点也不像基准线，原因何在？见本帖

驭龙

先说一下，尽管AMP不断完善和进化，我还是那句话，我不推荐不了解它的用户使用它，安全软件有不计其数，选择适合自己的很重要，没必要选择你不了解的基准线级别杀软AMP，这是我给大家的忠告，如果以后大家用AMP中毒，可不要怪我没有提醒你哦。

最近AMP家族在样本区的表现一点也不基准线，很疯狂，完全碾压DrWeb的成绩，有时候可以跟Avira和Kaspersky的成绩一较高下，这是啥情况？

直到今天，MMPC发布的每月报告，我才知道原由

原来MMPC真的开始杀PUA了，不像2014年7月的时候那样，只是说一说和执行标准，现在可真的是杀境外PUA了，如果杀国内的话，那会是什么样子？

官方原文
https://www.microsoft.com/security/portal/enterprise/threatreports_october_2015.aspx

更不可思议的是，我发现有一些PUA被定义为Severe级威胁，下面的日志可见PUA的等级为Severe。
https://www.microsoft.com/securi ... ased&Package=AM

Antimalware (Antivirus + Antispyware)                        

Name	Alert Level
Trojan:Win32/Adduser!rfn	Severe
PUA:Win32/AdGazelle	Severe
Worm:MSIL/Ainslot.A	Severe
PUA:Win32/Amonetize	Severe
VirTool:MSIL/Antisow.A	Severe
VirTool:INF/Autorun!rfn	Severe
Trojan:Win32/Avkill	Severe
TrojanSpy:Win32/Bancos	Severe
Backdoor:Win32/Bedep!rfn	Severe
Backdoor:Win64/Bedep.A	Severe
PUA:Win32/BetterInstall	Severe
TrojanSpy:Win32/Bholog!rfn	Severe
Backdoor:MSIL/Bladabindi	Severe
Backdoor:MSIL/Bladabindi.AJ	Severe
Backdoor:MSIL/Bladabindi.AL	Severe
Backdoor:MSIL/Bladabindi.B	Severe
Trojan:Win32/Blakamba!rfn	Severe
Worm:Win32/Bokill.C	Severe
PUA:Win32/CandyOpen	Severe
Trojan:Win32/Ceatrg.A	Severe
VirTool:Win32/CeeInject.GF	Severe
Trojan:Win32/CoinMiner!rfn	Severe
PUA:Win32/ConvertAd	Severe
PUA:Win32/Coupoon	Severe
PUA:Win32/CrawlerToolbar	Severe
PUA:Win32/Creprote.A	Severe
PUA:Win32/Creprote.B	Severe
PUA:Win32/Creprote.C	Severe
TrojanSpy:MSIL/Crime.B	Severe
PUA:Win32/CrossRider	Severe
Trojan:Win32/Cuffahlt!rfn	Severe
Trojan:Win32/Danginex!rfn	Severe
Worm:Win32/DarkSnow!rfn	Severe
PUA:Win32/DealPli	Severe
Rogue:Win32/Defmid!rfn	Severe
VirTool:Win32/DelfInject	Severe
TrojanDownloader:Win32/Dembr!rfn	Severe
PUA:Win32/DLHelper	Severe
Trojan:Win32/Doedlid!rfn	Severe
TrojanDownloader:Win32/Dofoil.T	Severe
Backdoor:Win32/Dokstormac!rfn	Severe
TrojanDownloader:O97M/Donoff	Severe
TrojanDownloader:O97M/Donoff.AF	Severe
TrojanDownloader:O97M/Donoff.AG	Severe
Worm:Win32/Dorkbot.I	Severe
PUA:Win32/DownloadAdmin	Severe
PUA:Win32/DownloadAssistant	Severe
PUA:Win32/DownloadMR	Severe
Trojan:Win32/Dynamer!ac	Severe
PWS:Win32/Dyzap.F	Severe
PUA:Win32/Elex	Severe
Worm:Win32/Emudbot!rfn	Severe
Trojan:Win32/Enchanim	Severe
PUA:Win32/EoRezod	Severe
TrojanClicker:Win32/Erbon!rfn	Severe
Trojan:MSIL/Eskimo.A	Severe
PWS:Win32/Fareit	Severe
PUA:Win32/FourShared	Severe
Backdoor:Win32/Fynloski	Severe
Backdoor:Win32/Fynloski!rfn	Severe
Backdoor:Win32/Fynloski.A	Severe
Backdoor:Win32/Fynloski.R	Severe
Worm:Win32/Gamarue	Severe
Trojan:Win32/Gatak!rfn	Severe
PUA:Win32/GoFileExpress	Severe
TrojanSpy:MSIL/Golroted.A	Severe
TrojanSpy:MSIL/Golroted.B	Severe
Trojan:Win32/Gupboot!rfn	Severe
Trojan:Win32/Hideproc!rfn	Severe
PUA:Win32/ICLoaded	Severe
PUA:Win32/Imali	Severe
VirTool:Win32/Injector.GE	Severe
PUA:Win32/InstallBrain	Severe
PUA:Win32/InstallCore	Severe
PUA:Win32/InstallIQ	Severe
PUA:Win32/InstallMate	Severe
Worm:VBS/Jenxcus	Severe
Backdoor:Win32/Kelihos	Severe
Backdoor:Win32/Kelihos!rfn	Severe
TrojanSpy:Win32/Keylogger!rfn	Severe
PUA:Win32/KipodTools	Severe
Trojan:Win32/Kovter!rfn	Severe
TrojanDownloader:Win32/Ladivyrop!rfn	Severe
TrojanDownloader:Win32/Leechole!rfn	Severe
TrojanDownloader:Win32/Lidared!rfn	Severe
Trojan:MSIL/Limitless.A	Severe
PUA:Win32/Linkular	Severe
PWS:Win32/Lmir!rfn	Severe
Trojan:MSIL/Loksec.A	Severe
Backdoor:Win32/Lybsus.A	Severe
PUA:Win32/Lyrics	Severe
PUA:Win32/MediaGet	Severe
Trojan:Win32/Miuref.B	Severe
Trojan:Win32/Mkar!rfn	Severe
VirTool:Win32/ModTool!rfn	Severe
Worm:Win32/Mothyfil.A	Severe
PUA:Win32/Mplug	Severe
Trojan:Win32/MultiInjector.A!rfn	Severe
Trojan:Win32/MultiInjector.C!rfn	Severe
Trojan:Win32/Multsarch!rfn	Severe
TrojanDownloader:Win32/Mytonel!rfn	Severe
Worm:Win32/NeksMiner!rfn	Severe
Backdoor:Win32/NetWiredRC.C	Severe
Trojan:Win32/Neurevt	Severe
Trojan:Win32/Neurevt.AB	Severe
TrojanDownloader:Win32/Nibbeg!rfn	Severe
TrojanSpy:Win32/Nivdort!rfn	Severe
TrojanSpy:Win32/Nivdort.Z	Severe
Backdoor:MSIL/Noancooe!rfn	Severe
Backdoor:MSIL/Noancooe.C	Severe
Backdoor:Win32/Nosrawec!rfn	Severe
VirTool:JS/Obfuscator.GY	Severe
PUA:Win32/Ogimant	Severe
TrojanSpy:MSIL/Omaneat!rfn	Severe
Rogue:Win32/Onescan!rfn	Severe
PWS:Win32/OnLineGames!rfn	Severe
PUA:Win32/OptimizePro	Severe
PUA:Win32/OptInstaller	Severe
PUA:Win32/OutBrows	Severe
Trojan:Win32/Pariham!rfn	Severe
Backdoor:Win32/PcClient!rfn	Severe
PWS:HTML/Phish!rfn	Severe
TrojanDownloader:Win32/Potukorp!rfn	Severe
PUA:Win32/PriceFountain	Severe
Backdoor:Win32/Prorat	Severe
Trojan:Win32/Provis!rfn	Severe
TrojanDownloader:MSIL/Pstinb.I	Severe
TrojanDownloader:MSIL/Ranos.A	Severe
Worm:Win32/Rebhip	Severe
Worm:Win32/Rebhip!rfn	Severe
TrojanDownloader:Win32/Renos.NL	Severe
Ransom:Win32/Reveton.Y	Severe
PUA:Win32/RexInstalle	Severe
Trojan:Win32/Rofin!rfn	Severe
TrojanDropper:Win32/Ropest.A	Severe
Trojan:Win32/Salrenmetie!rfn	Severe
PUA:Win32/Samon	Severe
Worm:Win32/Sddrop!rfn	Severe
TrojanDropper:Win32/Sirefef!rfn	Severe
Trojan:Win32/Skeeyah.A!rfn	Severe
TrojanDownloader:Win32/Small	Severe
PUA:Win32/Soft32Downloader	Severe
PUA:Win32/SoftPuls	Severe
PUA:Win32/Solimba	Severe
PUA:Win32/Somoto	Severe
PUA:Win32/SonoControl	Severe
PUA:Win32/SpigotSearch	Severe
Backdoor:MSIL/Splori.A	Severe
PUA:Win32/SquareNet	Severe
Trojan:Win32/Startpage!rfn	Severe
PWS:MSIL/Stimilina.I	Severe
PUA:Win32/SuiteSearch	Severe
Trojan:MSIL/Survins!rfn	Severe
Trojan:Win32/Swrort!rfn	Severe
Trojan:Win32/Swrort.A	Severe
Ransom:Win32/Teerac.A	Severe
Ransom:Win32/Tescrypt!rfn	Severe
Trojan:Win32/Trafog!rfn	Severe
PUA:Win32/Tugspay	Severe
TrojanDownloader:Win32/Tugspay.A	Severe
TrojanDownloader:Win32/Upatre!rfn	Severe
Trojan:Win32/Urelas!rfn	Severe
TrojanSpy:Win32/Ursnif	Severe
TrojanSpy:Win32/Ursnif!rfn	Severe
Trojan:Win32/VB	Severe
VirTool:Win32/VBInject	Severe
PUA:Win32/Vintaller	Severe
PUA:Win32/VOPackage	Severe
Trojan:Win32/Vundo!rfn	Severe
Trojan:Win32/Vundo.RZ	Severe
TrojanDownloader:Win32/Waledac.AL	Severe
TrojanDownloader:Win32/Wintrim!rfn	Severe
PUA:Win32/WinWrapper	Severe
Trojan:Win32/Xtrat	Severe
Backdoor:Win32/Xtrat!rfn	Severe
Backdoor:Win32/Xtrat.A	Severe
Worm:Win32/Xtrat.C	Severe
TrojanSpy:MSIL/Yakbeex.A	Severe
PWS:Win32/Zbot	Severe
Backdoor:Win32/Zegost!rfn	Severe
Trojan:Win32/Zipparch!rfn	Severe
TrojanDownloader:Win32/Zlob!rfn	Severe
Trojan:Win32/Zonsterarch!rfn	Severe
Trojan:Win32/Zonsterarch.BW	Severe
Adware:Win32/AddLyrics	High
BrowserModifier:Win32/Diplugem	High
Adware:Win32/EoRezo	High
Adware:Win32/Hebogo	High
Adware:Win32/Pirrit	High
BrowserModifier:Win32/Webalta	High
HackTool:MSIL/Boilod.A	Moderate
HackTool:Win32/Mailpassview	Moderate
HackTool:Win32/PasswordFox	Moderate

ericdj

表示很多杀软现在亚历山大吧

驭龙

ericdj 发表于 2015-10-29 08:57
表示很多杀软现在亚历山大吧

本来今天想去测试DrWeb 11.0.1 Beta的，可想到DrWeb开扫描加载程序和模块以后的卡，我真的有一点望而却步，再加上DrWeb的VFE五年没有什么更新，而AMP的却每月在调整功能，以及WD的稳定性和流畅性，甚至是查杀水平都碾压DrWeb，我真的犹豫了，哈

ericdj

驭龙 发表于 2015-10-29 09:02
本来今天想去测试DrWeb 11.0.1 Beta的，可想到DrWeb开扫描加载程序和模块以后的卡，我真的有一点望而却步 ...

如果微软PUA都杀………


嗯嗯，下午去实验室把那个台式机杀软换成SCEP

驭龙

ericdj 发表于 2015-10-29 09:03
如果微软PUA都杀………

现在好像只是杀国外的特定PUA，并不是都杀，定义为PUA严重级别的威胁，都是厂商信誉差的，才会被MMPC定义为严重级别PUA，所以在国内，估计效果不理想

ericdj

驭龙 发表于 2015-10-29 09:08
现在好像只是杀国外的特定PUA，并不是都杀，定义为PUA严重级别的威胁，都是厂商信誉差的，才会被MMPC定义 ...

现在用诺顿，还是觉得有点卡
没办法，临时用，内存才2g…
伤不起啊

哥在东北玩泥巴

请问微软最新版本的SCEP官方下载地址在什么地方啊？望楼主告知，谢谢。也是免费的吗？也支持WIN8.1系统吗？@驭龙

jmkbird

驭龙 发表于 2015-10-29 09:02
本来今天想去测试DrWeb 11.0.1 Beta的，可想到DrWeb开扫描加载程序和模块以后的卡，我真的有一点望而却步 ...

蜘蛛这样根本推广不了，现在很少有这么卡的杀软了

驭龙

哥在东北玩泥巴 发表于 2015-10-29 09:11
请问微软最新版本的SCEP官方下载地址在什么地方啊？望楼主告知，谢谢。也是免费的吗？也支持WIN8.1 ...

官方不提供完整版的最新版本SCEP客户端安装包，需要通过测试版提取，而且版本没有WIN 8.1自带的WD版本高

驭龙

ericdj 发表于 2015-10-29 09:10
现在用诺顿，还是觉得有点卡
没办法，临时用，内存才2g…
伤不起啊

我也2G内存，但用什么也不是很卡，当然DrWeb除外