查看: 821|回复: 2
收起左侧

[分享] BD开始调查某些样本会隔离掉msi安装的服务项了

[复制链接]
Rukia
发表于 2025-9-26 22:04:57 | 显示全部楼层 |阅读模式
本帖最后由 Rukia 于 2025-9-26 22:07 编辑

Hello,

Thank you for contacting the Bitdefender Enterprise Support team.   
Our preliminary investigations have not yet revealed thereason why the MSIServer service key was removed. This seems to be an issue onour end, and we are currently attempting to reproduce the scenario so we can issue a fix for this issue.

However, the bdsyslog shows that the key was properly quarantined during the cleanup process and you should be able to restore it following a post-cleanupreboot of the machine.
We recommend restoring the mentioned key for the time being, and will be back with an explanation and a fix as soon as possible.

If you have further questions, feel free to reach back to us.  

Have a great day!


Best regards,

bbszy
发表于 2025-9-29 22:40:56 | 显示全部楼层
但是msi的银狐大概率查杀不了,exe的可以
inhh1
发表于 2025-9-29 23:41:40 | 显示全部楼层
本帖最后由 inhh1 于 2025-9-29 23:42 编辑
bbszy 发表于 2025-9-29 22:40
但是msi的银狐大概率查杀不了,exe的可以

bd企业版还好一点,只要银狐放了漏驱会直接截掉msi安装,后续释放物出不来了

个人版全看运气,大概率反复杀衍生
以及:bd企业版对部分银狐,如果你atd策略设置不当(设置成了仅阻止而不是清除)是会出问题的,体现在反复杀某个白加黑程序的注入,而且有概率杀不到(重启的时候大概率杀不到)
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-11-8 19:13 , Processed in 0.119355 second(s), 16 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表