晓月小红伞安全引导切换解密、移植及工具发布

薇薇兔

本文转自晓月博客，解释权归晓月所有。

小红伞v9已经发布。虽然现在bug众多。升级方法欠缺。但是有一些东西还是值得借鉴的。
在安装到最后阶段时，v9出现一个配置向导，其中 有一步请你选择在计算机启动时，何时加载小红伞实时监控服务。如图：





默认是normal start，也就是普通加载，实时监控进程在引导资源管理器后进行桌面加载。
另外一个选择是在系统引导过程中进行加载。建议选择safe start。该加载为在系统引导到网络服务组时加载小红伞监控进程。
相信很多人在此步感到难以抉择，而随便选择了一个。而安装后，小红伞管理程序不再提供切换选项了。
随后，有人提出了使用avconfig.exe配置进程的/WIZARD参数的办法，重新打开这个配置向导进行切换的方法，但是，实践证明，由于德国人设计疏漏，该方法无法进行切换。
随后，我在安装中设置为安全引导模式，研究了注册表快照。发现本次v9的AntiVirService注册表键中，增加了"Group"="NetworkProvider"值，将该服务定义为网络组。意思是在系统引导到加载网络服务时，就开始加载本服务进程，也即是avguard进程。
因此，手动转换的方法很简单，运行regedit，打开注册表编辑器，展开HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntiVirService键，查看右面的值。
①改为普通启动模式：删除Group即可
②改为安全启动模式：新建Group字符串值，并设置其数据为：NetworkProvider
进阶运用：
一、移植应用于v8：此方法是windows服务预定义权限值。因此同样适合于v8的小红伞。将其应用在v8上。跟踪windows启动。发现avguard加载时间的确提前。
二、根据我的测试，要优先于可能的病毒前进行加载，定义为NetworkProvider还不够。因此，我建议将其调整为SchedulerGroup计划组进行加载，加载速度明显优先于其他服务。这样安全性得到进一步提高。
      此调整有一个负面，就是大家知道，小红伞avguard加载比较占资源，以前大家感觉进入桌面伞还没有打开，就是因为avguard还没有完成页面交换。通过此设置。加载过程调整到用户不可见的进度。也许你会感到“欢迎使用”这个界面停留时间增长了一点。其实这个无所谓，因为总的引导时间并没有变化。根据我的观察。好像提前加载还要快一些。这样当你启动到了桌面后，小红伞已经开伞了。
工具介绍：
如果你没有编辑注册表的知识或者怕编辑出错，我已经制作了切换工具。可以直接使用。
如果是v9。使用前请关闭小红伞文件和注册表保护，完毕后再打开。工具里面有关闭保护的方法介绍。



如果你没有编辑注册表的知识或者怕编辑出错，我已经制作了切换工具。可以直接使用。

下载工具：

http://hi.baidu.com/xiaojinglf/blog/item/5443ba8639014c3667096ece.html

[ 本帖最后由 薇薇兔 于 2009-3-21 16:56 编辑 ]

rzqevergo

前排支持 不过 听说那个safestart 会减慢开机速度
V8也没有 不也一样用了 就normal吧

幻石

好像晓月在伞的官方论坛发了个帖
http://forum.avira.com/wbb/index ... &threadID=85850

Antivir guide priority switching solutions and tools byThe original Address: http://hi.baidu.com/xiaojinglf/b ... 014c3667096ece.html

In the final stage, to install a configuration guide v9, one step you choose in computer startup, when loading the real-time monitoring service.



The default is normal start, that is, the ordinary load, real-time monitoring of the process in guiding the resource manager to load after the desktop.

The other one is in the system boot process to load. Choose recommended safe start. The load in the system boot to the network services group to monitor the process of loading the Antivir Guard

I believe a lot of people find it difficult at this step one, and not a selection. And after installation, management procedures are no longer provided the option to switch.

At my installation guide to set up for security model, studied the registry snapshot. Found in the v9 of AntiVirService registry key, add the "Group" = "NetworkProvider" value, defined as the service network group. Means that at system boot to load the network services to load on start the process of the Service, that is, avguard process.

Therefore, manual conversion is simple, run regedit, open the Registry Editor, expand HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ AntiVirService button to see the right value.

① replaced by an ordinary start mode: you can delete Group

② changed to Safe Boot mode: Group new string value and set its data to: NetworkProvider

Advanced use:

First, transplantation applies v8: this method are predefined windows Service permissions value. Therefore the same v8 fit in the little red umbrella. Will be on their application at v8. Tracking windows startup. Avguard loading time is indeed found in advance.

Two, according to my tests, it is necessary to take precedence over the possible prior to virus load, defined as NetworkProvider not enough. Therefore, I propose to adjust its plans for the group SchedulerGroup loading, loading speed obviously take precedence over other services. This security has been further enhanced.

This adjustment has a negative, that is, we all know, the little red umbrella avguard comparison of resources to load, before entering the U.S. feel umbrella Desktop also does not open, is not yet complete because avguard exchange page. Through this setting. Loading process does not adjust to the user can see the progress. Maybe you will find "Welcome to" The interface residence time increased by one point. In fact, this does not matter, because the overall lead time and has not changed. According to my observation. Ahead of time to load quickly even if some. So that when you boot to the desktop, the little red umbrella has been the line.

Edit the registry if you do not have the knowledge or fear of editing errors, I have produced a switch instrument. Can be used directly.



Download my tools: http://hi.baidu.com/xiaojinglf/b ... 014c3667096ece.html

twtwpx79

不错的工具。

swc1209

这么好的 东西没人顶？？？？？？

D20099188

。。。。
啥都不说了
支持

seven11

谢谢，收藏备用

mj9151

支持晓月，下来试试。