新引擎特殊福利，新增Support Scam Malware的检测与查杀

驭龙

ELOHIM 发表于 2016-10-22 19:15
我这里有啊。真的有。
你那是什么系统什么版本？？

EnableIntegrityServices
已经确认是在WIN 10 TH2上的WD 4.9上有，其他版本我没有看。

但是WIN 10 AU上的WD 4.10已经没有这个EnableIntegrityServices功能了

ELOHIM

驭龙 发表于 2016-10-22 19:30
EnableIntegrityServices
已经确认是在WIN 10 TH2上的WD 4.9上有，其他版本我没有看。

那好吧，这个服务有什么功能呢？
我已经启用一段时间了。
一会儿发个贴子…………

Microsoft Antimalware Service Command Line Utility (c) 2006-2015 Microsoft Corp
Use this tool to automate and troubleshoot Microsoft Antimalware Service

Usage:
MpCmdRun.exe [command] [-options]

Command Description
   -? / -h                                    Displays all available options
                                              for this tool
   -Scan [-ScanType #] [-File <path> [-DisableRemediation] [-BootSectorScan]]
         [-Timeout <days>]
                                              Scans for malicious software
   -Trace [-Grouping #] [-Level #]            Starts diagnostic tracing
   -GetFiles                                  Collects support information
   -RemoveDefinitions [-All]                  Restores the installed
                                              signature definitions
                                              to a previous backup copy or to
                                              the original default set of
                                              signatures
                      [-DynamicSignatures]    Removes only the dynamically
                                              downloaded signatures
   -SignatureUpdate [-UNC | -MMPC]            Checks for new definition updates
   -Restore  [-ListAll | [-Name <name>] [-All] [-Path <path>]]  Restore or list
                                                               quarantined item(s)
   -AddDynamicSignature [-Path]               Loads a dynamic signature
   -ListAllDynamicSignatures                  List the loaded dynamic signatures
   -RemoveDynamicSignature [-SignatureSetID]  Removes a dynamic signature
   -EnableIntegrityServices                   Enables integrity services
   -SubmitSamples                             Submit all sample requests

Additional Information:

Support information will be in the following directory:
C:\ProgramData\Microsoft\Windows Defender\Support

   -Scan [-ScanType value]
        0  Default, according to your configuration
        1  Quick scan
        2  Full system scan
        3  File and directory custom scan

           [-File <path>]
                Indicates the file or directory  to be scanned, only valid for custom scan.

           [-DisableRemediation]
                This option is valid only for custom scan.
                When specified:
                  - File exclusions are ignored.
                  - Archive files are scanned.
                  - Actions are not applied after detection.
                  - Event log entries are not written after detection.
                  - Detections from the custom scan are not displayed in the user interface.
                  - The console output will show the list of detections from the custom scan.

           [-BootSectorScan]
                Enables boot sector scanning; only valid for custom scan.

           [-Timeout <days>]
                Timeout in days; maximum value is 30.
                If this parameter is not specified, default value is 7 days for full scan and 1 day for all other scans.

      Return code is
      0    if no malware is found or malware is successfully remediated and no additional user action is required
      2    if malware is found and not remediated or additional user action is required to complete remediation or there is error in scanning.  Please check History for more information.

   -Trace [-Grouping value] [-Level value]
        Begins tracing Microsoft Antimalware Service's actions.
        You can specify the components for which tracing is enabled and
        how much information is recorded.
        If no component is specified, all the components will be logged.
        If no level is specified, the Error, Warning and Informational levels
        will be logged. The data will be stored in the support directory
        as a file having the current timestamp in its name and bearing
        the extension BIN.

        [-Grouping]
        0x1    Service
        0x2    Malware Protection Engine
        0x4    User Interface
        0x8    Real-Time Protection
        0x10   Scheduled actions
        0x20   NIS/GAPA

        [-Level]
        0x1    Errors
        0x2    Warnings
        0x4    Informational messages
        0x8    Function calls
        0x10   Verbose
        0x20   Performance

   -GetFiles [-Scan]
        Gathers the following log files and packages them together in a
        compressed file in the support directory

        - Any trace files from Microsoft Antimalware Service
        - The Windows Update history log
        - All Microsoft Antimalware Service events from the System event log
        - All relevant Microsoft Antimalware Service registry locations
        - The log file of this tool
        - The log file of the signature update helper tool

        [-Scan]
        Scans for unusual files.  The files and results of the scan
        will be packaged in the compressed file.

   -RemoveDefinitions
        Restores the last set of signature definitions

        [-All]
        Removes any installed signature and engine files. Use this
        option if you have difficulties trying to update signatures.

        [-DynamicSignatures]
        Removes all Dynamic Signatures.

   -SignatureUpdate
        Checks for new definition updates

        [-UNC [-Path <path>]]
        Performs update directly from UNC file share specified in <path>
        If -Path is not specified, update will be performed directly from the
             preconfigured UNC location

        [-MMPC]
        Performs update directly from Microsoft Malware Protection Center

   -Restore
        [-ListAll]
        List all items that were quarantined

        [-Name <name>]
        Restores the most recently quarantined item based on threat name
        One Threat can map to more than one file

        [-All]
        Restores all the quarantined items based on name

        [-Path]
        Specify the path where the quarantined items will be restored.
        If not specified, the item will be restored to the original path.
   -AddDynamicSignature -Path <path>
        Adds a Dynamic Signature specified by <path>

   -ListAllDynamicSignatures
        Lists SignatureSet ID's of all Dynamic Signatures added to the client
        via MAPS and MPCMDRUN -AddDynamicSignature

   -RemoveDynamicSignature -SignatureSetID <SignatureSetID>
        Removes a Dynamic Signature specified by <SignatureSetID>

猪头无双

驭龙 发表于 2016-10-22 18:41
吃完饭回来，找了半天，才发现是我自己发的帖子
http://bbs.kafan.cn/thread-2058158-1-1.html

辛苦，辛苦

我去拿到虚拟机里看看火绒+规则能不能抗住

驭龙

猪头无双 发表于 2016-10-22 20:11
辛苦，辛苦

我去拿到虚拟机里看看火绒+规则能不能抗住

就火绒，防得住又如何

不说了

驭龙

ELOHIM 发表于 2016-10-22 19:39
那好吧，这个服务有什么功能呢？
我已经启用一段时间了。
一会儿发个贴子…………

只不过是检证完整性而已，启用会更卡系统的

猪头无双

驭龙 发表于 2016-10-22 20:14
就火绒，防得住又如何

不说了

只是玩玩反正虚拟机只要不穿，随它去折腾

驭龙

猪头无双 发表于 2016-10-22 20:16
只是玩玩反正虚拟机只要不穿，随它去折腾

如果防住，记得回那帖子，让我也期待一下，其实我真的不是黑蓉儿的人

ELOHIM

驭龙 发表于 2016-10-22 20:15
只不过是检证完整性而已，启用会更卡系统的

已经启用一段时间。。

蓉儿是？？？

猪头无双

驭龙 发表于 2016-10-22 20:25
如果防住，记得回那帖子，让我也期待一下，其实我真的不是黑蓉儿的人

你要失望了反正我套用的fly-mc的规则+我的自定义规则是没防住······

驭龙

猪头无双 发表于 2016-10-22 20:32
你要失望了反正我套用的fly-mc的规则+我的自定义规则是没防住······

其实我懂得，只是希望能防住