增加Mcafee8.5 有害流泯程序功能設置修正檔

[psac]

McAfee8.5有害流泯程序修正檔

這個修正檔本人根據註冊表的變化製作成的，它可以阻止並移除流泯軟體，本修正檔是個註冊表文件，本來直接匯入即可，但McAfee8.5有個服務阻止此項操作，所以將McAfee McShield這個服務停止，即可匯入成功。

具體方法：XP系統右鍵我的電腦－管理－服務和應用程式－服務，找到McAfee McShield右鍵將其暫時停止，然後匯入註冊表文件即可。


（到目前為止，本人共收集了88個流泯程序，以後有新再重新製作）

McAfee8.5_add.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\NVP]

"UserDefinedDetection_0"="baidubar.dll:baidu"
"UserDefinedDetection_1"="ss_setup.exe:劃詞搜尋"
"UserDefinedDetection_2"="infomgr.exe:珊瑚蟲"
"UserDefinedDetection_3"="infonet.exe: 珊瑚蟲"
"UserDefinedDetection_4"="winup.exe:很棒小秘書"
"UserDefinedDetection_5"="hap.dll:很棒小秘書"
"UserDefinedDetection_6"="winhtp.dll:很棒小秘書"
"UserDefinedDetection_7"="hda.ini:很棒小秘書"
"UserDefinedDetection_8"="qylhelper.dll:青蛙娛樂"
"UserDefinedDetection_9"="ali.exe:阿里巴巴商機直通車"
"UserDefinedDetection_10"="assist4.exe:3721上網助手"
"UserDefinedDetection_11"="yassist4.exe:雅虎助手"
"UserDefinedDetection_12"="cns.exe:雅虎助手元件"
"UserDefinedDetection_13"="cns.dll:雅虎助手元件"
"UserDefinedDetection_14"="yascnsup.ini:雅虎助手元件"
"UserDefinedDetection_15"="yascnsup.cab:雅虎助手元件"
"UserDefinedDetection_16"="cnsinst.dll:雅虎助手元件"
"UserDefinedDetection_17"="autolive.dll:3721"
"UserDefinedDetection_18"="Helper.dll:3721"
"UserDefinedDetection_19"="assist.dll:3721"
"UserDefinedDetection_20"="adfilter.dll:3721"
"UserDefinedDetection_21"="repair.dll:3721"
"UserDefinedDetection_22"="xpstyle.dll:3721"
"UserDefinedDetection_23"="autolive.dll2:3721"
"UserDefinedDetection_24"="contmenu.dll:3721"
"UserDefinedDetection_25"="asiesec.dll:3721"
"UserDefinedDetection_26"="asnoad.dll:3721"
"UserDefinedDetection_27"="aswiper.dll:3721"
"UserDefinedDetection_28"="tbwrap.dll:3721"
"UserDefinedDetection_29"="asbar.dll:3721"
"UserDefinedDetection_30"="optimum.dll:3721"
"UserDefinedDetection_31"="dddiemon.dlluDu加速器"
"UserDefinedDetection_32"="duduacc.exeuDu加速器"
"UserDefinedDetection_33"="duduprosvc.exeuDu加速器"
"UserDefinedDetection_34"="dddspocx.dlluDu加速器"
"UserDefinedDetection_35"="ddddl.dlluDu加速器"
"UserDefinedDetection_36"="dmsched.exeuDu加速器"
"UserDefinedDetection_37"="rsen.dlluDu加速器"
"UserDefinedDetection_38"="dluban.datuDu加速器"
"UserDefinedDetection_39"="rep.exeuDu加速器"
"UserDefinedDetection_40"="btdl.dlluDu加速器"
"UserDefinedDetection_41"="dddskin.dlluDu加速器"
"UserDefinedDetection_42"="360Main.exe:360搜"
"UserDefinedDetection_43"="BaiDuBar.dll:百度搜霸"
"UserDefinedDetection_44"="bdgdins.dll:百度搜霸"
"UserDefinedDetection_45"="baidubar.dat:百度搜霸"
"UserDefinedDetection_46"="易趣購物.lnk:易趣"
"UserDefinedDetection_47"="eBayTb.dll:易趣"
"UserDefinedDetection_48"="eBayToolbarComm.dll:易趣"
"UserDefinedDetection_49"="movesearch.exe:網路豬"
"UserDefinedDetection_50"="aupdate.exe:網路豬"
"UserDefinedDetection_51"="pig.exe:網路豬"
"UserDefinedDetection_52"="msetup.exe:網路豬"
"UserDefinedDetection_53"="SearchM.dll:網路豬"
"UserDefinedDetection_54"="SoDAIE.dll:搜狗"
"UserDefinedDetection_55"="DtCtr.dll:搜狗"
"UserDefinedDetection_56"="AutoLive1.dll:一搜"
"UserDefinedDetection_57"="yisous.dll:一搜"
"UserDefinedDetection_58"="yisouu.dll:一搜"
"UserDefinedDetection_59"="yisoub.dll:一搜"
"UserDefinedDetection_60"="yisou.dll:一搜"
"UserDefinedDetection_61"="minib.dll:一搜"
"UserDefinedDetection_62"="Qyule.exe:青娛樂"
"UserDefinedDetection_63"="BugReport.exe:青娛樂"
"UserDefinedDetection_64"="SmartUpdater.exe:青娛樂"
"UserDefinedDetection_65"="DDTDesk.exe:新浪點點通"ddtastro.ocx
"UserDefinedDetection_66"="ddtastro.ocx:新浪點點通"
"UserDefinedDetection_67"="ddtchannel.ocx:新浪點點通"
"UserDefinedDetection_68"="DDTcomm.dll:新浪點點通"
"UserDefinedDetection_69"="DdtDLFast.ocx:新浪點點通"
"UserDefinedDetection_70"="DdtFavorite.ocx:新浪點點通"
"UserDefinedDetection_71"="ddtgame.ocx:新浪點點通"
"UserDefinedDetection_72"="DDTInit.dll:新浪點點通"
"UserDefinedDetection_73"="ddtkillw.ocx:新浪點點通"
"UserDefinedDetection_74"="ddtmail.ocx:新浪點點通"
"UserDefinedDetection_75"="ddtmusic.ocx:新浪點點通"
"UserDefinedDetection_76"="ddtnews.ocx:新浪點點通"
"UserDefinedDetection_77"="DDTongBar.dll:新浪點點通"
"UserDefinedDetection_78"="ddtpassport.ocx:新浪點點通"
"UserDefinedDetection_79"="DdtRss.ocx:新浪點點通"
"UserDefinedDetection_80"="ddtsh.ocx:新浪點點通"
"UserDefinedDetection_81"="ddtslive.ocx:新浪點點通"
"UserDefinedDetection_82"="ddtsms.ocx:新浪點點通"
"UserDefinedDetection_83"="ddtstock.ocx:新浪點點通"
"UserDefinedDetection_84"="DDTUpdate.dll:新浪點點通"
"UserDefinedDetection_85"="ddtwea.ocx:新浪點點通"
"UserDefinedDetection_86"="dlfast.exe:新浪點點通"
"UserDefinedDetection_87"="ImageSup.dll:新浪點點通"
"UserDefinedDetection_88"="rssreader.exe:新浪點點通"

[psac]

只要逐個雙擊把註冊訊息匯入就可以了！非常簡單，已經將大多數流氓軟件定義為病毒和阻止了它們進入系統中！
並且把系統文件全都保護起來了，基本上能夠全面的防護了系統，以為規則我設置的比較嚴厲所以打上這些規則後如果想要在系統盤中安裝程式時必須要把咖啡的監控關閉掉，不然會安裝不了的，WINDOWS更新時也須把監控關閉掉！


我的自定義有害程式策略.reg


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\NVP]
"DetectAdware"=dword:00000001
"DetectDialers"=dword:00000001
"DetectPotentiallyUnwantedApps"=dword:00000001
"DetectionExclusions"=hex(7):52,00,65,00,67,00,2d,00,46,00,6c,00,61,00,73,00,\
68,00,47,00,65,00,74,00,00,00,41,00,64,00,77,00,61,00,72,00,65,00,2d,00,46,\
00,6c,00,61,00,73,00,68,00,67,00,65,00,74,00,00,00,4a,00,63,00,63,00,61,00,\
74,00,63,00,68,00,2e,00,64,00,6c,00,6c,00,00,00,53,00,65,00,72,00,76,00,55,\
00,44,00,61,00,65,00,6d,00,6f,00,6e,00,2e,00,65,00,78,00,65,00,00,00,00,00
"DetectRemoteAdminTools"=dword:00000001
"DetectPasswordCrackers"=dword:00000001
"DetectSpyware"=dword:00000001
"DetectJokes"=dword:00000001
"UserDefinedDetection_0"="baidubar.dll:baidu"
"UserDefinedDetection_1"="ss_setup.exe:劃詞搜索"
"UserDefinedDetection_2"="infomgr.exe:珊瑚蟲"
"UserDefinedDetection_3"="infonet.exe: 珊瑚蟲"
"UserDefinedDetection_4"="winup.exe:很棒小秘書"
"UserDefinedDetection_5"="hap.dll:很棒小秘書"
"UserDefinedDetection_6"="winhtp.dll:很棒小秘書"
"UserDefinedDetection_7"="hda.ini:很棒小秘書"
"UserDefinedDetection_8"="qylhelper.dll:青蛙娛樂"
"UserDefinedDetection_9"="ali.exe:阿里巴巴商機直通車"
"UserDefinedDetection_10"="assist4.exe:3721上網助手"
"UserDefinedDetection_11"="yassist4.exe:雅虎助手"
"UserDefinedDetection_12"="cns.exe:雅虎助手元件"
"UserDefinedDetection_13"="cns.dll:雅虎助手元件"
"UserDefinedDetection_14"="yascnsup.ini:雅虎助手元件"
"UserDefinedDetection_15"="yascnsup.cab:雅虎助手元件"
"UserDefinedDetection_16"="cnsinst.dll:雅虎助手元件"
"UserDefinedDetection_17"="searchnet.exe:中搜元件"
"UserDefinedDetection_18"="servehost.exe:中搜元件"
"UserDefinedDetection_19"="FAD.sys:中搜元件"
"UserDefinedDetection_20"="Anfad.sys:中搜元件"
"UserDefinedDetection_21"="hProcess.sys:中搜元件"

=============================

我的按需掃瞄設置.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion\Tasks\{818C7543-358A-4C84-899A-14334EMS4BGS}]
"nRepeatInterval"=dword:00000000
"Daily_nRepeatDays"=dword:00000000
"nPriority"=dword:00000050
"bAlwaysExit"=dword:00000000
"ScanArchives"=dword:00000001
"bDispMessage"=dword:00000000
"bSkipCDROM"=dword:00000000
"wFlags"=dword:0000047f
"wTaskType"=dword:00000004
"szLastScanFile0"=""
"dwMacroHeuristicsLevel"=dword:00000001
"Monthly_nDayOfWeek"=dword:00000000
"Monthly_maskMonthsOfYear"=dword:00000000
"nStopMonth"=dword:00000000
"wTaskAttrib"=dword:00000000
"bEnabled"=dword:00000000
"uKilobytes"=dword:00000400
"bLimitSize"=dword:00000001
"uMissedTaskDelay"=dword:00000005
"wLastExec"=dword:00000000
"nStartDay"=dword:00000000
"szProgExts"=""
"Weekly_nRepeatWeeks"=dword:00000000
"szMoveToFolder"="C:\\QUARANTINE\\"
"eRepeatOption"=dword:00000000
"nStartMonth"=dword:00000000
"bLogToFile"=dword:00000001
"bRepeatable"=dword:00000000
"bDoHSM"=dword:00000001
"bRunIfMissed"=dword:00000000
"eScheduleType"=dword:00000000
"nStopYear"=dword:00000000
"ApplyNVP"=dword:00000001
"NumExcludeItems"=dword:00000000
"dwScanPeriod"=dword:00000000
"bSkipBootScan"=dword:00000000
"bRandomizationEnabled"=dword:00000000
"bLogScanEncryptFail"=dword:00000001
"szSuggestMessage"=""
"nStartYear"=dword:00000000
"nUntilDuration"=dword:00000000
"bLogUserName"=dword:00000001
"szMessage"="您的自定義消息！"
"bGMTTime"=dword:00000000
"szScanItem0"="SpecialMemory"
"bSecDisplayMessage"=dword:00000000
"bStopScanPeriod"=dword:00000000
"bOnceADayEnabled"=dword:00000000
"Monthly_nDayNumOfMonth"=dword:00000000
"Monthly_nWeekNumOfMonth"=dword:00000000
"wTime"=dword:00001119
"bScanAllFiles"=dword:00000001
"bLogSettings"=dword:00000000
"UIType"=dword:00000001
"dwProgramHeuristicsLevel"=dword:00000001
"szScanItem1"="SpecialRegistrySpyware"
"uSecAction_Program"=dword:00000001
"uAction"=dword:00000003
"bSchConfigChanged"=dword:00000000
"bScanAllOle"=dword:00000000
"bSkipMemScan"=dword:00000001
"bAutoScan"=dword:00000001
"bApplyNow"=dword:00000001
"nUntilHour"=dword:00000000
"nStopDay"=dword:00000000
"nStartHour"=dword:00000000
"dwEndTime"=dword:00000000
"nRandomizationWndMins"=dword:00000000
"wDate"=dword:00000907
"bScanCompressed"=dword:00000001
"Idle_nIdleMinutes"=dword:00000000
"bAutoExit"=dword:00000000
"eUntilOption"=dword:00000000
"bNotifyAlertMgr"=dword:00000001
"Weekly_maskDaysOfWeek"=dword:00000000
"Monthly_eMonthlyOption"=dword:00000000
"szSecCustomMessage"=""
"dwPromptActionOptions"=dword:0000001f
"nStartMinute"=dword:00000000
"bScanSubDirs"=dword:00000001
"bScanDefaultFiles"=dword:00000000
"uScanNumItems"=dword:00000003
"bStopDateValid"=dword:00000000
"bSchedEnabled"=dword:00000000
"uAction_Program"=dword:00000003
"bLogSummary"=dword:00000001
"ScanMime"=dword:00000001
"szLogFileName"="%VSEDEFLOGDIR%\\OnDemandScanLog.txt"
"nUntilMinute"=dword:00000000
"uStartupDelay"=dword:00000005
"dwLastModified"=dword:0000001c
"LogFileFormat"=dword:00000001
"uSecAction"=dword:00000001
"szTaskName"="掃瞄所有固定磁碟"
"szScanItem2"="FixedDrives"
"szScanItem3"="SpecialCookiesSpyware"
"DetectAdware"=dword:00000000
"DetectDialers"=dword:00000000
"DetectJokes"=dword:00000000
"DetectPasswordCrackers"=dword:00000000
"DetectPotentiallyUnwantedApps"=dword:00000000
"DetectRemoteAdminTools"=dword:00000000
"LogFormat"=dword:00000001
"bDontScanCompress"=dword:00000000

===========================


我的按訪問掃瞄設置.reg


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration]
"bDisableScanning"=dword:00000000
"Alert_MaxAlertsKb"=dword:000003e8
"bFileCacheEnabled"=dword:00000001
"bStartDisabled"=dword:00000000
"wFlags"=dword:00001000
"uKilobytes"=dword:00000064
"ScannerThreadTimeout"=dword:00002710
"szLogFileName"="%VSEDEFLOGDIR%\\OnAccessScanLog.txt"
"bScanFloppyOnShutdown"=dword:00000000
"DotVirOnQuarantine"=dword:00000001
"bReloadDATs"=dword:00000000
"Alert_UsersCanDelete"=dword:00000001
"dwExitStatus"=dword:00000000
"Alert_AutoShowList"=dword:00000001
"Alert_UsersCanRemove"=dword:00000001
"WorkAroundAllocateFloppies"=dword:00000001
"bDenyFloppyMountIfInfected"=dword:00000000
"bDontScanMBRSectors"=dword:00000000
"bLogToFile"=dword:00000001
"szTaskName"="按訪問掃瞄"
"SmoothWritesExtensions"="ini 日誌"
"bDisconnectUser"=dword:00000000
"uCloseDelta"=dword:000001f4
"dwLastModified"=dword:00000341
"ScanArchiveTimeout"=dword:00000005
"bLogClean"=dword:00000001
"dwMaxLogSizeMB"=dword:00000001
"bLoadAtStartup"=dword:00000001
"bLimitSize"=dword:00000001
"bDontScanBootSectors"=dword:00000000
"DotVirToDenyWrite"=dword:00000001
"Alert_UsersCanClean"=dword:00000001
"bApplyNow"=dword:00000001
"bVScan"=dword:00000001
"OnlyUseDefaultConfig"=dword:00000001
"DotVirToDenyFailedClean"=dword:00000001
"ScannerThreadTimeoutEx"=dword:00002710
"szMoveToFolder"="\\quarantine\\"
"wTaskType"=dword:00000001
"bLogSettings"=dword:00000000
"RepairBootSectors"=dword:00000000
"bLogUserName"=dword:00000001
"Alert_UsersCanQuarantine"=dword:00000001
"Alert_LocalMessage"="McAfee VirusScan 警報！"
"szDisconnectMessage"="病毒警報！！！"
"wTime"=dword:00000200
"ReportEncryptedFiles"=dword:00000001
"LogFileFormat"=dword:00000001
"WorkAroundAllocateCDRoms"=dword:00000001
"wDate"=dword:00000000
"bLogSummary"=dword:00000001
"Alert_MaxAlertsCount"=dword:000003e8
"bLogDateTime"=dword:00000001
"EOLPId"=dword:00002ef3

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration\Default]
"ProcessList"=hex(7):00,00,00,00
"dwProgramHeuristicsLevel"=dword:00000001
"bScanCompressed"=dword:00000001
"uAction_Program"=dword:00000003
"NumExcludeItems"=dword:00000001
"uAction"=dword:00000003
"LocalExtensionMode"=dword:00000001
"bScanIncoming"=dword:00000001
"bNetworkScanEnabled"=dword:00000001
"bScanOutgoing"=dword:00000001
"uSecAction"=dword:00000001
"uSecAction_Program"=dword:00000001
"szIncludeExts"=""
"ReportEncryptedFiles"=dword:00000000
"ScanArchives"=dword:00000001
"szProgExts"=""
"ExcludedItem_0"="5|2|"
"ScanMime"=dword:00000001
"dwMacroHeuristicsLevel"=dword:00000001
"ApplyNVP"=dword:00000001
"NetworkExtensionMode"=dword:00000001
"DetectPrograms"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration\High]
"dwMacroHeuristicsLevel"=dword:00000001
"bScanOutgoing"=dword:00000001
"uAction"=dword:00000005
"LocalExtensionMode"=dword:00000001
"ApplyNVP"=dword:00000001
"Exclusions"=""
"dwProgramHeuristicsLevel"=dword:00000001
"uSecAction_Program"=dword:00000003
"ProcessList"=hex(7):34,00,6e,00,74,00,2e,00,65,00,78,00,65,00,00,00,61,00,67,\
00,65,00,6e,00,74,00,2e,00,65,00,78,00,65,00,00,00,61,00,69,00,6d,00,2e,00,\
65,00,78,00,65,00,00,00,62,00,65,00,61,00,72,00,73,00,68,00,61,00,72,00,65,\
00,2e,00,65,00,78,00,65,00,00,00,43,00,6d,00,64,00,2e,00,45,00,78,00,65,00,\
00,00,63,00,73,00,63,00,72,00,69,00,70,00,74,00,2e,00,65,00,78,00,65,00,00,\
00,65,00,75,00,64,00,6f,00,72,00,61,00,2e,00,65,00,78,00,65,00,00,00,45,00,\
78,00,63,00,65,00,6c,00,2e,00,65,00,78,00,65,00,00,00,45,00,78,00,70,00,6c,\
00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,46,00,69,00,6c,00,\
65,00,4e,00,61,00,76,00,69,00,67,00,61,00,74,00,6f,00,72,00,2e,00,65,00,78,\
00,65,00,00,00,66,00,74,00,70,00,2e,00,65,00,78,00,65,00,00,00,67,00,64,00,\
6f,00,6e,00,6b,00,65,00,79,00,2e,00,65,00,78,00,65,00,00,00,67,00,6e,00,75,\
00,63,00,6c,00,65,00,75,00,73,00,2e,00,65,00,78,00,65,00,00,00,49,00,43,00,\
51,00,2e,00,65,00,78,00,65,00,00,00,49,00,65,00,78,00,70,00,6c,00,6f,00,72,\
00,65,00,2e,00,65,00,78,00,65,00,00,00,69,00,6e,00,65,00,74,00,69,00,6e,00,\
66,00,6f,00,2e,00,65,00,78,00,65,00,00,00,6d,00,69,00,72,00,63,00,2e,00,65,\
00,78,00,65,00,00,00,6d,00,6f,00,62,00,73,00,79,00,6e,00,63,00,2e,00,65,00,\
78,00,65,00,00,00,6d,00,6f,00,73,00,61,00,69,00,63,00,2e,00,65,00,78,00,65,\
00,00,00,6d,00,6f,00,7a,00,69,00,6c,00,6c,00,61,00,2e,00,65,00,78,00,65,00,\
00,00,4d,00,73,00,41,00,63,00,63,00,65,00,73,00,73,00,2e,00,65,00,78,00,65,\
00,00,00,4d,00,73,00,49,00,6d,00,6e,00,2e,00,65,00,78,00,65,00,00,00,6d,00,\
73,00,6d,00,73,00,67,00,73,00,2e,00,65,00,78,00,65,00,00,00,6d,00,73,00,6e,\
00,36,00,2e,00,65,00,78,00,65,00,00,00,6e,00,65,00,6f,00,32,00,30,00,2e,00,\
65,00,78,00,65,00,00,00,6e,00,65,00,74,00,73,00,63,00,61,00,70,00,65,00,2e,\
00,45,00,78,00,65,00,00,00,6e,00,65,00,74,00,73,00,63,00,70,00,36,00,2e,00,\
65,00,78,00,65,00,00,00,6f,00,70,00,65,00,72,00,61,00,2e,00,65,00,78,00,65,\
00,00,00,4f,00,75,00,74,00,6c,00,6f,00,6f,00,6b,00,2e,00,65,00,78,00,65,00,\
00,00,50,00,6f,00,77,00,65,00,72,00,50,00,6e,00,74,00,2e,00,65,00,78,00,65,\
00,00,00,74,00,66,00,74,00,70,00,2e,00,65,00,78,00,65,00,00,00,56,00,69,00,\
73,00,69,00,6f,00,33,00,32,00,2e,00,65,00,78,00,65,00,00,00,77,00,61,00,6f,\
00,6c,00,2e,00,65,00,78,00,65,00,00,00,57,00,69,00,6e,00,50,00,4d,00,2d,00,\
33,00,32,00,2e,00,65,00,78,00,65,00,00,00,57,00,69,00,6e,00,57,00,6f,00,72,\
00,64,00,2e,00,45,00,78,00,65,00,00,00,77,00,73,00,5f,00,66,00,74,00,70,00,\
2e,00,65,00,78,00,65,00,00,00,77,00,73,00,63,00,72,00,69,00,70,00,74,00,2e,\
00,65,00,78,00,65,00,00,00,77,00,75,00,61,00,75,00,63,00,6c,00,74,00,2e,00,\
65,00,78,00,65,00,00,00,78,00,6f,00,6c,00,6f,00,78,00,2e,00,65,00,78,00,65,\
00,00,00,79,00,70,00,61,00,67,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,\
79,00,75,00,70,00,64,00,61,00,74,00,65,00,2e,00,65,00,78,00,65,00,00,00,00,\
00
"ScanArchives"=dword:00000000
"NetworkExtensionMode"=dword:00000001
"bNetworkScanEnabled"=dword:00000000
"bScanCompressed"=dword:00000001
"uSecAction"=dword:00000003
"uAction_Program"=dword:00000005
"ScanMime"=dword:00000001
"NumExcludeItems"=dword:00000000
"ReportEncryptedFiles"=dword:00000001
"szProgExts"=""
"szIncludeExts"=""
"bScanIncoming"=dword:00000001
"DetectPrograms"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration\Low]
"ScanMime"=dword:00000001
"uSecAction"=dword:00000003
"uSecAction_Program"=dword:00000003
"LocalExtensionMode"=dword:00000001
"bNetworkScanEnabled"=dword:00000000
"ExcludedItem_0"="5|2|"
"ApplyNVP"=dword:00000001
"dwMacroHeuristicsLevel"=dword:00000001
"bScanIncoming"=dword:00000001
"NetworkExtensionMode"=dword:00000001
"dwProgramHeuristicsLevel"=dword:00000001
"bScanCompressed"=dword:00000001
"szProgExts"=""
"ScanArchives"=dword:00000000
"ReportEncryptedFiles"=dword:00000000
"ProcessList"=hex(7):41,00,65,00,78,00,61,00,75,00,64,00,69,00,74,00,70,00,6c,\
00,73,00,2e,00,65,00,78,00,65,00,00,00,41,00,65,00,78,00,6e,00,73,00,63,00,\
6c,00,69,00,65,00,6e,00,74,00,2e,00,65,00,78,00,65,00,00,00,41,00,65,00,78,\
00,6e,00,73,00,63,00,6c,00,69,00,65,00,6e,00,74,00,74,00,72,00,61,00,6e,00,\
73,00,70,00,6f,00,72,00,74,00,2e,00,65,00,78,00,65,00,00,00,41,00,65,00,78,\
00,6e,00,73,00,77,00,64,00,75,00,73,00,72,00,2e,00,65,00,78,00,65,00,00,00,\
00,00
"uAction"=dword:00000005
"NumExcludeItems"=dword:00000001
"bScanOutgoing"=dword:00000000
"uAction_Program"=dword:00000005
"szIncludeExts"=""
"DetectPrograms"=dword:00000000

===========================

我的訪問保護設置.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\BehaviourBlocking]
"szLogFileName_Ent"="%VSEDEFLOGDIR%\\BufferOverflowProtectionLog.txt"
"FileBlockEnabled_8"=dword:00000001
"FileBlockEnabled_14"=dword:00000001
"FileBlockEnabled_7"=dword:00000000
"FileBlockEnabled_4"=dword:00000001
"FileBlockEnabled_29"=dword:00000001
"FileBlockEnabled_21"=dword:00000001
"LogFileFormat"=dword:00000002
"EnterceptMode"=dword:00000001
"FileBlockEnabled_30"=dword:00000001
"VSIDSendMessage"=dword:00000000
"VSIDBlockTimeout"=dword:0000000a
"VSIDBlock"=dword:00000001
"dwMaxLogSizeMB_Ent"=dword:00000001
"FileBlockEnabled_16"=dword:00000001
"FileBlockEnabled_18"=dword:00000001
"FileBlockEnabled_15"=dword:00000001
"FileBlockEnabled_20"=dword:00000001
"FileBlockEnabled_6"=dword:00000000
"bLogToFile"=dword:00000001
"FileBlockEnabled_25"=dword:00000001
"bLimitSize"=dword:00000001
"FileBlockEnabled_11"=dword:00000001
"FileBlockEnabled_17"=dword:00000001
"FileBlockEnabled_22"=dword:00000001
"FileBlockEnabled_26"=dword:00000001
"FileBlockEnabled_0"=dword:00000001
"FileBlockEnabled_27"=dword:00000000
"FileBlockEnabled_13"=dword:00000001
"FileBlockEnabled_5"=dword:00000001
"PortBlockProcessExclusionList"=hex(7):46,00,72,00,61,00,6d,00,65,00,77,00,6f,\
00,72,00,6b,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,2e,00,65,00,78,00,\
65,00,00,00,41,00,67,00,65,00,6e,00,74,00,6e,00,74,00,2e,00,65,00,78,00,65,\
00,00,00,00,00
"FileBlockEnabled_3"=dword:00000001
"FileBlockEnabled_28"=dword:00000001
"szLogFileName"="%VSEDEFLOGDIR%\\AccessProtectionLog.txt"
"FileBlockEnabled_12"=dword:00000001
"PortBlockReport"=dword:00000001
"bLimitSize_Ent"=dword:00000001
"dwMaxLogSizeMB"=dword:00000001
"LogFileFormat_Ent"=dword:00000001
"FileBlockEnabled_19"=dword:00000001
"FileBlockEnabled_23"=dword:00000001
"FileBlockEnabled_24"=dword:00000001
"EnterceptShowMessages"=dword:00000001
"FileBlockEnabled_1"=dword:00000001
"FileBlockEnabled_9"=dword:00000001
"bLogToFile_Ent"=dword:00000001
"FileBlockEnabled_2"=dword:00000001
"VSIDMessage"=""
"ShareBlockMode"=dword:00000000
"FileBlockEnabled_10"=dword:00000001
"ShareBlockReport"=dword:00000001
"EnterceptEnabled"=dword:00000001
"PortBlockReportMinutes"=dword:00000001
"VSIDBlockOnNonVirus"=dword:00000001
"FileBlockEnabled_31"=dword:00000001
"FileBlockEnabled_32"=dword:00000001
"FileBlockEnabled_33"=dword:00000001
"FileBlockEnabled_34"=dword:00000001
"FileBlockEnabled_35"=dword:00000001
"FileBlockEnabled_36"=dword:00000001
"FileBlockEnabled_37"=dword:00000001
"FileBlockEnabled_38"=dword:00000001
"FileBlockEnabled_39"=dword:00000001
"Fifanluntan x b s"=hex:00
"FileBlockEnabled_40"=dword:00000001
"FileBlockEnabled_41"=dword:00000001
"FileBlockEnabled_42"=dword:00000001
"FileBlockEnabled_43"=dword:00000001
"FileBlockEnabled_44"=dword:00000001
"FileBlockEnabled_45"=dword:00000001
"FileBlockEnabled_46"=dword:00000001
"FileBlockEnabled_47"=dword:00000001
"FileBlockEnabled_48"=dword:00000001
"FileBlockEnabled_49"=dword:00000001
"FileBlockEnabled_50"=dword:00000001
"FileBlockEnabled_51"=dword:00000001
"FileBlockEnabled_52"=dword:00000001
"FileBlockEnabled_53"=dword:00000001
"FileBlockEnabled_54"=dword:00000001
"FileBlockEnabled_55"=dword:00000001
"FileBlockEnabled_56"=dword:00000001
"FileBlockEnabled_57"=dword:00000001
"FileBlockEnabled_58"=dword:00000001
"FileBlockEnabled_59"=dword:00000001
"FileBlockEnabled_60"=dword:00000001
"EnterceptExclusionProcess_0"="explorer.exe"
"EnterceptExclusionModule_0"=""
"EnterceptExclusionAPI_0"="VirtualProtect"
"EnterceptExclusionProcess_1"="WINWORD.EXE"
"EnterceptExclusionModule_1"=""
"EnterceptExclusionAPI_1"="GetProcAddress"
"EnterceptExclusionProcess_2"="WINWORD.EXE"
"EnterceptExclusionModule_2"=""
"EnterceptExclusionAPI_2"="VirtualProtect"
"EnterceptExclusionProcess_3"="IEXPLORE.EXE"
"EnterceptExclusionModule_3"=""
"EnterceptExclusionAPI_3"="GetProcAddress"
"EnterceptExclusionProcess_4"="IEXPLORE.EXE"
"EnterceptExclusionModule_4"=""
"EnterceptExclusionAPI_4"="VirtualProtect"
"EnterceptExclusionProcess_5"="EXCEL.EXE"
"EnterceptExclusionModule_5"=""
"EnterceptExclusionAPI_5"="GetProcAddress"
"EnterceptExclusionProcess_6"="EXCEL.EXE"
"EnterceptExclusionModule_6"=""
"EnterceptExclusionAPI_6"="VirtualProtect"
"EnterceptExclusionProcess_7"="POWERPNT.exe"
"EnterceptExclusionModule_7"=""
"EnterceptExclusionAPI_7"="GetProcAddress"
"EnterceptExclusionProcess_8"="POWERPNT.EXE"
"EnterceptExclusionModule_8"=""
"EnterceptExclusionAPI_8"="VirtualProtect"
"EnterceptExclusionProcess_9"="explorer.exe"
"EnterceptExclusionModule_9"=""
"EnterceptExclusionAPI_9"="GetProcAddress"
"EnterceptExclusionProcess_10"="msimn.exe"
"EnterceptExclusionModule_10"=""
"EnterceptExclusionAPI_10"="GetProcAddress"
"EnterceptExclusionProcess_11"="msimn.exe"
"EnterceptExclusionModule_11"=""
"EnterceptExclusionAPI_11"="VirtualProtect"
"EnterceptExclusionProcess_12"="wmplayer.exe"
"EnterceptExclusionModule_12"=""
"EnterceptExclusionAPI_12"="GetProcAddress"
"EnterceptExclusionProcess_13"="wmplayer.exe"
"EnterceptExclusionModule_13"=""
"EnterceptExclusionAPI_13"="VirtualProtect"
"FileBlockEnabled_61"=dword:00000001
"FileBlockEnabled_62"=dword:00000001
"FileBlockEnabled_63"=dword:00000001
"PortBlockEnabled_0"=dword:00000001
"PortBlockName_0"="禁止大量發送郵件的蠕蟲病毒發送郵件"
"PortBlockDirection_0"=dword:00000001
"PortBlockRange_0"="25"
"PortBlockWhiteList_0"="amgrsrvc.exe,tomcat.exe,outlook.exe,msimn.exe,agent.exe,eudora.exe,nlnotes.exe,mozilla.exe,netscp.exe,opera.exe,winpm-32.exe,pine.exe,poco.exe,thebat.exe,thunderbird.exe,ntaskldr.exe,inetinfo.exe,nsmtp.exe,nrouter.exe,tomcat5.exe,tomcat5w.exe,ebs.exe,FireSvc.exe,modulewrapper.exe,MSKSrvr.exe,MSKDetct.exe,mapisp32.exe,Foxmail.exe,DreamMail.exe"
"PortBlockEnabled_1"=dword:00000001
"PortBlockName_1"="禁止 IRC 通訊"
"PortBlockDirection_1"=dword:00000001
"PortBlockRange_1"="6666-6669"
"PortBlockWhiteList_1"=""
"PortBlockEnabled_2"=dword:00000001
"PortBlockName_2"="禁止 IRC 通訊"
"PortBlockDirection_2"=dword:00000000
"PortBlockRange_2"="6666-6669"
"PortBlockWhiteList_2"=""
"PortBlockEnabled_3"=dword:00000000
"PortBlockName_3"="禁止從萬維網上下載"
"PortBlockDirection_3"=dword:00000001
"PortBlockRange_3"="80"
"PortBlockWhiteList_3"="outlook.exe,msimn.exe,iexplore.exe,mozilla.exe,netscp.exe,opera.exe,thunderbird.exe,msn6.exe,neo20.exe,mobsync.exe,waol.exe,nlnotes.exe"
"PortBlockEnabled_4"=dword:00000000
"PortBlockName_4"="禁止 FTP 入站通訊（阻止諸如 Nimda 等病毒傳播）"
"PortBlockDirection_4"=dword:00000000
"PortBlockRange_4"="20-21"
"PortBlockWhiteList_4"=""
"PortBlockEnabled_5"=dword:00000000
"PortBlockName_5"="禁止 FTP 出站通訊（阻止病毒下載文件）"
"PortBlockDirection_5"=dword:00000001
"PortBlockRange_5"="20-21"
"PortBlockWhiteList_5"="ftp.exe,iexplore.exe"
"PortBlockEnabled_6"=dword:00000000
"PortBlockName_6"="135-139"
"PortBlockDirection_6"=dword:00000000
"PortBlockRange_6"="135-139"
"PortBlockWhiteList_6"=""
"PortBlockEnabled_7"=dword:00000000
"PortBlockName_7"="445"
"PortBlockDirection_7"=dword:00000000
"PortBlockRange_7"="445-445"
"PortBlockWhiteList_7"=""
"PortBlockEnabled_8"=dword:00000000
"PortBlockName_8"="90"
"PortBlockDirection_8"=dword:00000001
"PortBlockRange_8"="90-90"
"PortBlockWhiteList_8"=""
"PortBlockEnabled_9"=dword:00000000
"PortBlockName_9"="5000"
"PortBlockDirection_9"=dword:00000000
"PortBlockRange_9"="5000-5000"
"PortBlockWhiteList_9"=""
"FileBlockRuleName_0"="禁止 Internet Explorer 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_0"="iexplore.exe"
"FileBlockWildcard_0"="**\\temp*\\**"
"FileBlockWhat_0"=dword:00080000
"FileBlockReport_0"=dword:00000001
"FileBlockRuleName_1"="禁止 Internet Explorer 從 Downloaded Programs 資料夾啟動文件 (.exe)"
"FileBlockProcess_1"="iexplore.exe"
"FileBlockWildcard_1"="**\\Downloaded Program Files\\**\\*.exe"
"FileBlockWhat_1"=dword:00080000
"FileBlockReport_1"=dword:00000002
"FileBlockRuleName_2"="禁止 Outlook 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_2"="outlook.exe"
"FileBlockWildcard_2"="**\\temp*\\**"
"FileBlockWhat_2"=dword:00080000
"FileBlockReport_2"=dword:00000002
"FileBlockRuleName_3"="禁止 Outlook Express 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_3"="msimn.exe"
"FileBlockWildcard_3"="**\\temp*\\**"
"FileBlockWhat_3"=dword:00080000
"FileBlockReport_3"=dword:00000002
"FileBlockRuleName_4"="禁止 Packager 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_4"="packager.exe"
"FileBlockWildcard_4"="**\\temp*\\**"
"FileBlockWhat_4"=dword:00080000
"FileBlockReport_4"=dword:00000002
"FileBlockRuleName_5"="禁止 MSN 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_5"="msn6.exe"
"FileBlockWildcard_5"="**\\temp*\\**"
"FileBlockWhat_5"=dword:00080000
"FileBlockReport_5"=dword:00000002
"FileBlockRuleName_6"="禁止 WinZip32 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_6"="winzip32.exe"
"FileBlockWildcard_6"="**\\temp*\\**"
"FileBlockWhat_6"=dword:00080000
"FileBlockReport_6"=dword:00000002
"FileBlockRuleName_7"="禁止 WinRAR 從 Temp 資料夾啟動任何專案"
"FileBlockProcess_7"="winrar.exe"
"FileBlockWildcard_7"="**\\temp*\\**"
"FileBlockWhat_7"=dword:00080000
"FileBlockReport_7"=dword:00000002
"FileBlockRuleName_8"="禁止從 Temp 資料夾執行腳本"
"FileBlockProcess_8"="?script.exe"
"FileBlockWildcard_8"="**\\temp*\\**"
"FileBlockWhat_8"=dword:00020000
"FileBlockReport_8"=dword:00000002
"FileBlockRuleName_9"="禁止使用 tftp.exe，因為某些蠕蟲使用它。"
"FileBlockProcess_9"="*"
"FileBlockWildcard_9"="**\\tftp.exe"
"FileBlockWhat_9"=dword:001f0000
"FileBlockReport_9"=dword:00000001
"FileBlockRuleName_10"="禁止訪問可疑的啟動專案 (.exe)"
"FileBlockProcess_10"="*"
"FileBlockWildcard_10"="**\\startup\\**\\*.exe"
"FileBlockWhat_10"=dword:000f0000
"FileBlockReport_10"=dword:00000001
"FileBlockRuleName_11"="禁止訪問可疑的啟動專案 (.scr)"
"FileBlockProcess_11"="*"
"FileBlockWildcard_11"="**\\startup\\**\\*.scr"
"FileBlockWhat_11"=dword:000f0000
"FileBlockReport_11"=dword:00000001
"FileBlockRuleName_12"="禁止訪問可疑的啟動專案 (.hta)"
"FileBlockProcess_12"="*"
"FileBlockWildcard_12"="**\\startup\\**\\*.hta"
"FileBlockWhat_12"=dword:000f0000
"FileBlockReport_12"=dword:00000001
"FileBlockRuleName_13"="禁止訪問可疑的啟動專案 (.pif)"
"FileBlockProcess_13"="*"
"FileBlockWildcard_13"="**\\startup\\**\\*.pif"
"FileBlockWhat_13"=dword:000f0000
"FileBlockReport_13"=dword:00000001
"FileBlockRuleName_14"="禁止訪問可疑的啟動專案 (.com)"
"FileBlockProcess_14"="*"
"FileBlockWildcard_14"="**\\startup\\**\\*.com"
"FileBlockWhat_14"=dword:000f0000
"FileBlockReport_14"=dword:00000001
"FileBlockRuleName_15"="禁止遠端修改文件 (.exe)"
"FileBlockProcess_15"="System:Remote"
"FileBlockWildcard_15"="**\\*.exe"
"FileBlockWhat_15"=dword:00040000
"FileBlockReport_15"=dword:00000001
"FileBlockRuleName_16"="禁止遠端修改文件 (.scr)"
"FileBlockProcess_16"="System:Remote"
"FileBlockWildcard_16"="**\\*.scr"
"FileBlockWhat_16"=dword:00040000
"FileBlockReport_16"=dword:00000001
"FileBlockRuleName_17"="禁止遠端修改文件 (.ocx)"
"FileBlockProcess_17"="System:Remote"
"FileBlockWildcard_17"="**\\*.ocx"
"FileBlockWhat_17"=dword:00040000
"FileBlockReport_17"=dword:00000001
"FileBlockRuleName_18"="禁止遠端修改文件 (.dll)"
"FileBlockProcess_18"="System:Remote"
"FileBlockWildcard_18"="**\\*.dll"
"FileBlockWhat_18"=dword:00040000
"FileBlockReport_18"=dword:00000001
"FileBlockRuleName_19"="禁止遠端創建/修改/刪除 Windows 資料夾和子資料夾中的任何內容"
"FileBlockProcess_19"="System:Remote"
"FileBlockWildcard_19"="%windir%\\**\\*"
"FileBlockWhat_19"=dword:00150000
"FileBlockReport_19"=dword:00000001
"FileBlockRuleName_20"="禁止遠端創建/修改/刪除 Windows 資料夾和子資料夾中的文件 (.ini)"
"FileBlockProcess_20"="System:Remote"
"FileBlockWildcard_20"="%windir%\\**\\*.ini"
"FileBlockWhat_20"=dword:00150000
"FileBlockReport_20"=dword:00000001
"FileBlockRuleName_21"="禁止遠端創建/修改/刪除系統根目錄中的任何內容"
"FileBlockProcess_21"="System:Remote"
"FileBlockWildcard_21"="%systemdrive%\\*"
"FileBlockWhat_21"=dword:00150000
"FileBlockReport_21"=dword:00000001
"FileBlockRuleName_22"="禁止遠端創建/修改/刪除文件 (.exe)"
"FileBlockProcess_22"="System:Remote"
"FileBlockWildcard_22"="**\\*.exe"
"FileBlockWhat_22"=dword:00150000
"FileBlockReport_22"=dword:00000001
"FileBlockRuleName_23"="禁止遠端創建/修改/刪除文件 (.scr)"
"FileBlockProcess_23"="System:Remote"
"FileBlockWildcard_23"="**\\*.scr"
"FileBlockWhat_23"=dword:00150000
"FileBlockReport_23"=dword:00000001
"FileBlockRuleName_24"="禁止遠端創建/修改/刪除文件 (.ocx)"
"FileBlockProcess_24"="System:Remote"
"FileBlockWildcard_24"="**\\*.ocx"
"FileBlockWhat_24"=dword:00150000
"FileBlockReport_24"=dword:00000001
"FileBlockRuleName_25"="禁止遠端創建/修改/刪除文件(.pif)"
"FileBlockProcess_25"="System:Remote"
"FileBlockWildcard_25"="**\\*.pif"
"FileBlockWhat_25"=dword:00150000
"FileBlockReport_25"=dword:00000001
"FileBlockRuleName_26"="禁止遠端創建 autorun.inf 文件"
"FileBlockProcess_26"="System:Remote"
"FileBlockWildcard_26"="**\\autorun.inf"
"FileBlockWhat_26"=dword:00010000
"FileBlockReport_26"=dword:00000001
"FileBlockRuleName_27"="監視系統資料夾"
"FileBlockProcess_27"="*"
"FileBlockWildcard_27"="%windir%\\**\\*.*"
"FileBlockWhat_27"=dword:00050000
"FileBlockReport_27"=dword:00000002
"FileBlockRuleName_28"="禁止系統盤根目錄建立新文件"
"FileBlockProcess_28"="*"
"FileBlockWildcard_28"="%systemdrive%\\*.*"
"FileBlockWhat_28"=dword:00010000
"FileBlockReport_28"=dword:00000001
"FileBlockRuleName_29"="禁止在 Windows 資料夾中創建新文件 (.dll)"
"FileBlockProcess_29"="*"
"FileBlockWildcard_29"="%windir%\\*.dll"
"FileBlockWhat_29"=dword:00010000
"FileBlockReport_29"=dword:00000001
"FileBlockRuleName_30"="禁止在 Windows 資料夾中創建新文件 (.exe)"
"FileBlockProcess_30"="*"
"FileBlockWildcard_30"="%windir%\\*.exe"
"FileBlockWhat_30"=dword:00010000
"FileBlockReport_30"=dword:00000001
"FileBlockRuleName_31"="禁止在 System32 資料夾中創建新文件 (.dll)"
"FileBlockProcess_31"="*"
"FileBlockWildcard_31"="%windir%\\system32\\*.dll"
"FileBlockWhat_31"=dword:00010000
"FileBlockReport_31"=dword:00000001
"FileBlockRuleName_32"="禁止在 System32 資料夾中創建新文件 (.exe)"
"FileBlockProcess_32"="*"
"FileBlockWildcard_32"="%windir%\\system32\\*.exe"
"FileBlockWhat_32"=dword:00010000
"FileBlockReport_32"=dword:00000001
"FileBlockRuleName_33"="禁止在 Windows 資料夾中創建新文件 (.sys)"
"FileBlockProcess_33"="*"
"FileBlockWildcard_33"="%windir%\\*.sys"
"FileBlockWhat_33"=dword:00010000
"FileBlockReport_33"=dword:00000001
"FileBlockRuleName_34"="禁止在 Windows 資料夾中創建新文件 (.com)"
"FileBlockProcess_34"="*"
"FileBlockWildcard_34"="%windir%\\*.com"
"FileBlockWhat_34"=dword:00010000
"FileBlockReport_34"=dword:00000001
"FileBlockRuleName_35"="禁止在 System32 資料夾中創建新文件 (.sys)"
"FileBlockProcess_35"="*"
"FileBlockWildcard_35"="%windir%\\system32\\*.sys"
"FileBlockWhat_35"=dword:00010000
"FileBlockReport_35"=dword:00000001
"FileBlockRuleName_36"="禁止在 System32 資料夾中創建新文件 (.com)"
"FileBlockProcess_36"="*"
"FileBlockWildcard_36"="%windir%\\system32\\*.com"
"FileBlockWhat_36"=dword:00010000
"FileBlockReport_36"=dword:00000001
"FileBlockRuleName_37"="禁止在 Windows 資料夾中創建新文件 (.bat)"
"FileBlockProcess_37"="*"
"FileBlockWildcard_37"="%windir%\\*.bat"
"FileBlockWhat_37"=dword:00050000
"FileBlockReport_37"=dword:00000001
"FileBlockRuleName_38"="禁止在 System32 資料夾中創建新文件 (.bat)"
"FileBlockProcess_38"="*"
"FileBlockWildcard_38"="%windir%\\system32\\*.bat"
"FileBlockWhat_38"=dword:00050000
"FileBlockReport_38"=dword:00000001
"FileBlockRuleName_39"="保護hosts"
"FileBlockProcess_39"="*"
"FileBlockWildcard_39"="%windir%\\system32\\drivers\\etc\\hosts"
"FileBlockWhat_39"=dword:00150000
"FileBlockReport_39"=dword:00000001
"FileBlockRuleName_40"="保護win.ini"
"FileBlockProcess_40"="*"
"FileBlockWildcard_40"="%windir%\\win.ini"
"FileBlockWhat_40"=dword:00140000
"FileBlockReport_40"=dword:00000001
"FileBlockRuleName_41"="保護system.ini"
"FileBlockProcess_41"="*"
"FileBlockWildcard_41"="%windir%\\system.ini"
"FileBlockWhat_41"=dword:00140000
"FileBlockReport_41"=dword:00000001
"FileBlockRuleName_42"="免疫3721上網助手/中文郵"
"FileBlockProcess_42"="*"
"FileBlockWildcard_42"="**\\3721\\**"
"FileBlockWhat_42"=dword:00050000
"FileBlockReport_42"=dword:00000001
"FileBlockRuleName_43"="禁止雅虎助手"
"FileBlockProcess_43"="*"
"FileBlockWildcard_43"="**\\Assistant\\**"
"FileBlockWhat_43"=dword:00050000
"FileBlockReport_43"=dword:00000001
"FileBlockRuleName_44"="禁止3721網路實名"
"FileBlockProcess_44"="*"
"FileBlockWildcard_44"="%windir%\\Downloaded Program Files\\cns*.*"
"FileBlockWhat_44"=dword:00050000
"FileBlockReport_44"=dword:00000001
"FileBlockRuleName_45"="禁止DUDU"
"FileBlockProcess_45"="*"
"FileBlockWildcard_45"="**\\dudu\\**"
"FileBlockWhat_45"=dword:00050000
"FileBlockReport_45"=dword:00000001
"FileBlockRuleName_46"="禁止網路豬"
"FileBlockProcess_46"="*"
"FileBlockWildcard_46"="**\\網路豬\\**"
"FileBlockWhat_46"=dword:00050000
"FileBlockReport_46"=dword:00000001
"FileBlockRuleName_47"="禁止劃詞搜索"
"FileBlockProcess_47"="*"
"FileBlockWildcard_47"="**\\Program Files\\wsearch\\**"
"FileBlockWhat_47"=dword:00050000
"FileBlockReport_47"=dword:00000001
"FileBlockRuleName_48"="禁止新劃詞搜索"
"FileBlockProcess_48"="*"
"FileBlockWildcard_48"="**\\*HuaCi*\\**"
"FileBlockWhat_48"=dword:00050000
"FileBlockReport_48"=dword:00000001
"FileBlockRuleName_49"="禁止baidu"
"FileBlockProcess_49"="*"
"FileBlockWildcard_49"="**\\baidu\\**"
"FileBlockWhat_49"=dword:00050000
"FileBlockReport_49"=dword:00000001
"FileBlockRuleName_50"="禁止360度搜"
"FileBlockProcess_50"="*"
"FileBlockWildcard_50"="**\\360so\\**"
"FileBlockWhat_50"=dword:00050000
"FileBlockReport_50"=dword:00000001
"FileBlockRuleName_51"="禁止QQ廣告"
"FileBlockProcess_51"="*"
"FileBlockWildcard_51"="**\\AD\\**"
"FileBlockWhat_51"=dword:00050000
"FileBlockReport_51"=dword:00000001
"FileBlockRuleName_52"="禁止Infofo Bar"
"FileBlockProcess_52"="*"
"FileBlockWildcard_52"="**\\Infofo Bar\\**"
"FileBlockWhat_52"=dword:00050000
"FileBlockReport_52"=dword:00000001
"FileBlockRuleName_53"="禁止IInfo"
"FileBlockProcess_53"="*"
"FileBlockWildcard_53"="**\\IInfo\\**"
"FileBlockWhat_53"=dword:00050000
"FileBlockReport_53"=dword:00000001
"FileBlockRuleName_54"="禁止很棒小秘書"
"FileBlockProcess_54"="*"
"FileBlockWildcard_54"="**\\HDP\\**"
"FileBlockWhat_54"=dword:00050000
"FileBlockReport_54"=dword:00000001
"FileBlockRuleName_55"="禁止很棒小秘書"
"FileBlockProcess_55"="*"
"FileBlockWildcard_55"="**\\henbangtemp\\**"
"FileBlockWhat_55"=dword:00050000
"FileBlockReport_55"=dword:00000001
"FileBlockRuleName_56"="禁止青蛙娛樂"
"FileBlockProcess_56"="*"
"FileBlockWildcard_56"="**\\Qyule\\**"
"FileBlockWhat_56"=dword:00050000
"FileBlockReport_56"=dword:00000001
"FileBlockRuleName_57"="禁止一搜"
"FileBlockProcess_57"="*"
"FileBlockWildcard_57"="**\\YiSou\\**"
"FileBlockWhat_57"=dword:00050000
"FileBlockReport_57"=dword:00000001
"FileBlockRuleName_58"="禁止CNNIC"
"FileBlockProcess_58"="*"
"FileBlockWildcard_58"="**\\CNNIC\\**"
"FileBlockWhat_58"=dword:00050000
"FileBlockReport_58"=dword:00000001
"FileBlockRuleName_59"="禁止CNNIC"
"FileBlockProcess_59"="*"
"FileBlockWildcard_59"="**\\cdn*.*"
"FileBlockWhat_59"=dword:00050000
"FileBlockReport_59"=dword:00000001
"FileBlockRuleName_60"="禁止阿里巴巴商機直通車"
"FileBlockProcess_60"="*"
"FileBlockWildcard_60"="**\\alitb*\\**"
"FileBlockWhat_60"=dword:00050000
"FileBlockReport_60"=dword:00000001
"FileBlockRuleName_61"="禁止新浪點點通"
"FileBlockProcess_61"="*"
"FileBlockWildcard_61"="**\\*ddt*\\**"
"FileBlockWhat_61"=dword:00050000
"FileBlockReport_61"=dword:00000001
"FileBlockRuleName_62"="禁止中搜"
"FileBlockProcess_62"="*"
"FileBlockWildcard_62"="**\\*Searchnet*\\**"
"FileBlockWhat_62"=dword:00050000
"FileBlockReport_62"=dword:00000001
"FileBlockRuleName_63"="隱私文件"
"FileBlockProcess_63"="*"
"FileBlockWildcard_63"="E:\\MTV\\hhh\\**"
"FileBlockWhat_63"=dword:001a0000
"FileBlockReport_63"=dword:00000000

[psac]

McAfeeR Host Intrusion Prevention Release Candidate（主動入侵防護RC版本）
Overview

概述
McAfeeR Host Intrusion Prevention agents protects desktops and servers against zero-day and known attacks. As the only host intrusion prevention system (IPS) combining behavioral rules, signatures and a system firewall, McAfee Host Intrusion Prevention provides unmatched proactive threat protection of critical systems and applications, preserving the confidentiality of data and ensuring business availability.

McAfeeR 主動入侵防護保護台式機和服務器實時的和已知的攻擊。作為唯一結合行為規則,病毒特徵庫和一個系統防火牆的主動入侵防禦系統（IPS)，McAfee 主動入侵防護提供前攝性的重要的系統和應用程式防護， 保護資料的機密，確保商業機密。

New Product Features

新產品功能
Full ePolicy Orchestrator management

完整的ePO管理
Vulnerability coverage target is all known Windows vulnerabilities

Full Desktop Firewall 8.5 feature set (including Quarantine and Connection Aware policies)
Mass deployment (supports 100,000 agents)
Near silent operation
Local UI for better management
Localization in 7 languages

Beta Schedule

測試計劃
Release Candidate - 02/06/2006

Supported Operating Systems:

支持系統
Windows 2000 Professional
Windows 2000 Server
Windows 2000 Advanced
Windows 2003 Server
Windows 2003 Enterprise
Windows XP Professional

Test Environment

測試環境：
1 ePolicy Orchestrator 3.6 server
1 or more client systems
ePolicy Orchestrator agent 3.5.5 beta package.*
Host Intrusion Prevention Server installation program**

相關文件：
Documents
Readme Release Candidate

Product Guide Release Candidate

Quick Reference Card Release Candidate


官方地址：
ePolicy Orchestrator 3.6 downloads
Click here to download an evaluation copy of ePolicy Orchestrator 3.6

Click here to download ePolicy Orchestrator 3.6 patch 1 beta

Click here to view the ePolicy Orchestrator 3.6 Patch 1 Beta Readme

Please do not install ePolicy Orchestrator 3.6 Patch 1 beta in a production environment.
You should close the ePO console UI (and ensure in task manager that mmc.exe is gone) prior to installing the ePO Patch 1.
ePolicy Orchestrator Agent (CMA 3.5.5) Beta II download
Click here to download ePolicy Orchestrator Agent (CMA 3.5.5 Release Candidate)
Download the Japanese Host Intrusion Prevention Release Candidate
Click here to download the Host Intrusion Prevention Server - Japanese version

Click here to download the Host Intrusion Prevention Client - Japanese version

Download the German Host Intrusion Prevention Release Candidate
Click here to download the Host Intrusion Prevention Server - German version

Click here to download the Host Intrusion Prevention Client - German version

Download the French Host Intrusion Prevention Release Candidate
Click here to download the Host Intrusion Prevention Server - French version

Click here to download the Host Intrusion Prevention Client - French version


英文版本（服務器版本）下載https://secure.nai.com/us/forms/down...rver_rc_en.zip

英文（客戶端版本）下載
https://secure.nai.com/us/forms/down...t_433_1_en.Zip

[psac]

為了改進線上的安全服務，McAfee在週三宣佈它已經收購了SiteAdvisor公司。SiteAdviso擁有一個關於網站的資料庫，而這些資料是關於間諜軟件，廣告軟件，垃圾郵件，瀏覽器攻擊和線上欺詐。

　　McAfee表示，這次並購得到的技術將使得用戶聯合使用它公司其他產品的情況下進行網上衝浪顯得更加安全。

　　McAfee表示，SiteAdvisor的技術也包括網路搜索。當用戶通過Google，Yahoo或MSN進行搜索時，通過這個技術可以在搜索結果旁邊顯示相應連接的安全等級。並且，在用戶瀏覽網頁的過程中，工具欄上的一個按鈕會隨著所瀏覽網站的安全等級而改變顏色，以顯示不同的安全程度。

　　不過目前McAfee還沒透露這次收購得到的技術什麼時候才整合到其產品中去。
===============================================
McAfee8.0I麥咖啡企業版升級出錯解決方案（ffffffdf@3）
我不懂英文,只是用線上翻譯,大概瞭解了一下是對 "ffffffdf@3" 錯誤的,詳情請參看
http://forums.mcafeehelp.com/viewtopic.php?t=58138


把系列代碼輸入記事本，另存為 .reg文件格式就可以了.也可以下載附件中的文件直接匯入即可.
注意:匯入前,請先關閉咖啡的"按訪問掃瞄".

McAfee企業版升級出錯解決方案（ffffffdf@3）.reg
Windows Registry Editor Version 5.00

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Interface\{0000000c-0000-0000-C000-000000000046}]
@="IStream"

[HKEY_CLASSES_ROOT\Interface\{0000000c-0000-0000-C000-000000000046}\NumMethods]
@="14"

[HKEY_CLASSES_ROOT\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32]
@="{00000320-0000-0000-C000-000000000046}"

====================================

8002801d@2错误解决.reg

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}]

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0]
@="FrameworkService 1.0 Type Library"

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\0]

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\0\win32]
@="C:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\FLAGS]
@="0"

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\HELPDIR]
@="C:\\Program Files\\Network Associates\\Common Framework\\"

====================================
8002801d@3錯誤解決.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7576F677-3945-4DA2-B9F0-37850028A7E7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7576F677-3945-4DA2-B9F0-37850028A7E7}\1.0]
@="UpdateSubSys 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7576F677-3945-4DA2-B9F0-37850028A7E7}\1.0\0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7576F677-3945-4DA2-B9F0-37850028A7E7}\1.0\0\win32]
@="C:\\Program Files\\Network Associates\\Common Framework\\UpdateSubSys.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7576F677-3945-4DA2-B9F0-37850028A7E7}\1.0\FLAGS]
@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7576F677-3945-4DA2-B9F0-37850028A7E7}\1.0\HELPDIR]
@="C:\\Program Files\\Network Associates\\Common Framework\\"
=============================

80040154@1.reg

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{50CCECAC-7286-4CA0-9AD0-E309A2318482}]
@="FrameworkFactory Class"

[HKEY_CLASSES_ROOT\CLSID\{50CCECAC-7286-4CA0-9AD0-E309A2318482}\InprocServer32]
@="C:\\Program Files\\Network Associates\\Common Framework\\SecureFrameworkFactory.dll"
"ThreadingModel"="Free"

[HKEY_CLASSES_ROOT\CLSID\{50CCECAC-7286-4CA0-9AD0-E309A2318482}\ProgID]
@="SecureFrameworkFactory.FrameworkFactory.1"

[HKEY_CLASSES_ROOT\CLSID\{50CCECAC-7286-4CA0-9AD0-E309A2318482}\Programmable]

[HKEY_CLASSES_ROOT\CLSID\{50CCECAC-7286-4CA0-9AD0-E309A2318482}\TypeLib]
@="{90969396-649F-48A2-A082-6DEBA7A51F50}"

[HKEY_CLASSES_ROOT\CLSID\{50CCECAC-7286-4CA0-9AD0-E309A2318482}\VersionIndependentProgID]
@="SecureFrameworkFactory.FrameworkFactory"

====================================

80040155@3錯誤解決.reg

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Interface\{D831533D-0324-4EA4-B3FD-073AFEE85181}]
@="IMcAfeeUpdate"

[HKEY_CLASSES_ROOT\Interface\{D831533D-0324-4EA4-B3FD-073AFEE85181}\ProxyStubClsid]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\Interface\{D831533D-0324-4EA4-B3FD-073AFEE85181}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\Interface\{D831533D-0324-4EA4-B3FD-073AFEE85181}\TypeLib]
@="{7576F677-3945-4DA2-B9F0-37850028A7E7}"
"Version"="1.0"





==========================
8002801d@2錯誤解決.reg

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}]

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0]
@="FrameworkService 1.0 Type Library"

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\0]

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\0\win32]
@="C:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\FLAGS]
@="0"

[HKEY_CLASSES_ROOT\TypeLib\{745BA2BA-9B0E-459E-8A9C-A47C6A0131F1}\1.0\HELPDIR]
@="C:\\Program Files\\Network Associates\\Common Framework\\"

==================================


[HKEY_CLASSES_ROOT\Interface\{0000000c-0000-0000-C000-000000000046}]
@="IStream"

[HKEY_CLASSES_ROOT\Interface\{0000000c-0000-0000-C000-000000000046}\NumMethods]
@="14"

[HKEY_CLASSES_ROOT\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32]
@="{00000320-0000-0000-C000-000000000046}"



===============

McAfee8.5sa有害流泯程式修正檔
這個修正檔本人根據註冊表的變化製作成的，它可以阻止並刪除流泯軟件，本修正檔是個註冊表文件，本來直接匯入即可，但McAfee8.5有個服務阻止此項操作，所以將McAfee McShield這個服務停止，即可匯入成功。

具體方法：XP系統右鍵我的電腦－管理－服務和應用程式－服務，找到McAfee McShield右鍵將其暫時停止，然後匯入註冊表文件即可。

（到目前為止，本人共收集了88個流泯程式，以後有新再重新製作）
McAfee8.5有害流泯程序补丁.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\NVP]

"UserDefinedDetection_0"="baidubar.dll:baidu"
"UserDefinedDetection_1"="ss_setup.exe:划词搜索"
"UserDefinedDetection_2"="infomgr.exe:珊瑚虫"
"UserDefinedDetection_3"="infonet.exe: 珊瑚虫"
"UserDefinedDetection_4"="winup.exe:很棒小秘书"
"UserDefinedDetection_5"="hap.dll:很棒小秘书"
"UserDefinedDetection_6"="winhtp.dll:很棒小秘书"
"UserDefinedDetection_7"="hda.ini:很棒小秘书"
"UserDefinedDetection_8"="qylhelper.dll:青蛙娱乐"
"UserDefinedDetection_9"="ali.exe:阿里巴巴商机直通车"
"UserDefinedDetection_10"="assist4.exe:3721上网助手"
"UserDefinedDetection_11"="yassist4.exe:雅虎助手"
"UserDefinedDetection_12"="cns.exe:雅虎助手组件"
"UserDefinedDetection_13"="cns.dll:雅虎助手组件"
"UserDefinedDetection_14"="yascnsup.ini:雅虎助手组件"
"UserDefinedDetection_15"="yascnsup.cab:雅虎助手组件"
"UserDefinedDetection_16"="cnsinst.dll:雅虎助手组件"
"UserDefinedDetection_17"="autolive.dll:3721"
"UserDefinedDetection_18"="Helper.dll:3721"
"UserDefinedDetection_19"="assist.dll:3721"
"UserDefinedDetection_20"="adfilter.dll:3721"
"UserDefinedDetection_21"="repair.dll:3721"
"UserDefinedDetection_22"="xpstyle.dll:3721"
"UserDefinedDetection_23"="autolive.dll2:3721"
"UserDefinedDetection_24"="contmenu.dll:3721"
"UserDefinedDetection_25"="asiesec.dll:3721"
"UserDefinedDetection_26"="asnoad.dll:3721"
"UserDefinedDetection_27"="aswiper.dll:3721"
"UserDefinedDetection_28"="tbwrap.dll:3721"
"UserDefinedDetection_29"="asbar.dll:3721"
"UserDefinedDetection_30"="optimum.dll:3721"
"UserDefinedDetection_31"="dddiemon.dlluDu加速器"
"UserDefinedDetection_32"="duduacc.exeuDu加速器"
"UserDefinedDetection_33"="duduprosvc.exeuDu加速器"
"UserDefinedDetection_34"="dddspocx.dlluDu加速器"
"UserDefinedDetection_35"="ddddl.dlluDu加速器"
"UserDefinedDetection_36"="dmsched.exeuDu加速器"
"UserDefinedDetection_37"="rsen.dlluDu加速器"
"UserDefinedDetection_38"="dluban.datuDu加速器"
"UserDefinedDetection_39"="rep.exeuDu加速器"
"UserDefinedDetection_40"="btdl.dlluDu加速器"
"UserDefinedDetection_41"="dddskin.dlluDu加速器"
"UserDefinedDetection_42"="360Main.exe:360搜"
"UserDefinedDetection_43"="BaiDuBar.dll:百度搜霸"
"UserDefinedDetection_44"="bdgdins.dll:百度搜霸"
"UserDefinedDetection_45"="baidubar.dat:百度搜霸"
"UserDefinedDetection_46"="易趣购物.lnk:易趣"
"UserDefinedDetection_47"="eBayTb.dll:易趣"
"UserDefinedDetection_48"="eBayToolbarComm.dll:易趣"
"UserDefinedDetection_49"="movesearch.exe:网络猪"
"UserDefinedDetection_50"="aupdate.exe:网络猪"
"UserDefinedDetection_51"="pig.exe:网络猪"
"UserDefinedDetection_52"="msetup.exe:网络猪"
"UserDefinedDetection_53"="SearchM.dll:网络猪"
"UserDefinedDetection_54"="SoDAIE.dll:搜狗"
"UserDefinedDetection_55"="DtCtr.dll:搜狗"
"UserDefinedDetection_56"="AutoLive1.dll:一搜"
"UserDefinedDetection_57"="yisous.dll:一搜"
"UserDefinedDetection_58"="yisouu.dll:一搜"
"UserDefinedDetection_59"="yisoub.dll:一搜"
"UserDefinedDetection_60"="yisou.dll:一搜"
"UserDefinedDetection_61"="minib.dll:一搜"
"UserDefinedDetection_62"="Qyule.exe:青娱乐"
"UserDefinedDetection_63"="BugReport.exe:青娱乐"
"UserDefinedDetection_64"="SmartUpdater.exe:青娱乐"
"UserDefinedDetection_65"="DDTDesk.exe:新浪点点通"ddtastro.ocx
"UserDefinedDetection_66"="ddtastro.ocx:新浪点点通"
"UserDefinedDetection_67"="ddtchannel.ocx:新浪点点通"
"UserDefinedDetection_68"="DDTcomm.dll:新浪点点通"
"UserDefinedDetection_69"="DdtDLFast.ocx:新浪点点通"
"UserDefinedDetection_70"="DdtFavorite.ocx:新浪点点通"
"UserDefinedDetection_71"="ddtgame.ocx:新浪点点通"
"UserDefinedDetection_72"="DDTInit.dll:新浪点点通"
"UserDefinedDetection_73"="ddtkillw.ocx:新浪点点通"
"UserDefinedDetection_74"="ddtmail.ocx:新浪点点通"
"UserDefinedDetection_75"="ddtmusic.ocx:新浪点点通"
"UserDefinedDetection_76"="ddtnews.ocx:新浪点点通"
"UserDefinedDetection_77"="DDTongBar.dll:新浪点点通"
"UserDefinedDetection_78"="ddtpassport.ocx:新浪点点通"
"UserDefinedDetection_79"="DdtRss.ocx:新浪点点通"
"UserDefinedDetection_80"="ddtsh.ocx:新浪点点通"
"UserDefinedDetection_81"="ddtslive.ocx:新浪点点通"
"UserDefinedDetection_82"="ddtsms.ocx:新浪点点通"
"UserDefinedDetection_83"="ddtstock.ocx:新浪点点通"
"UserDefinedDetection_84"="DDTUpdate.dll:新浪点点通"
"UserDefinedDetection_85"="ddtwea.ocx:新浪点点通"
"UserDefinedDetection_86"="dlfast.exe:新浪点点通"
"UserDefinedDetection_87"="ImageSup.dll:新浪点点通"
"UserDefinedDetection_88"="rssreader.exe:新浪点点通"

[psac]

MVSE（McAfee VirusScan Enterprise)的文件保護規則設置簡易方法
MVSE（McAfee VirusScan Enterprise)8.0i與7.0相比，增加了很多新功能，其中很重要的一項就是「訪問保護」(具有木馬連接阜阻擋、共享資源保護等作用)，這也使McAfee不再僅僅只是防殺病毒這麼簡單。


她的文件訪問保護設置其實很簡單，比起TINY的文件保護，這個容易多了。MVSE文件保護命令編寫非常簡單，很容易上手，同時支持通配符（*代表任何文件，\**\代表任何資料夾，%windir%代表系統資料夾...）例如禁止在系統資料夾下建立exe可執行文件（防止病毒／木馬）只要這樣寫就可以：%windir%\*.exe，選擇建立新文件
如果要想禁止系統資料夾下面所有子資料夾（包括system32）下建立exe文件只要稍做改動即可：%windir%\**\*.exe 同樣的道理，禁止建立dll,sys等文件依葫蘆畫瓢就可以了


對於保護的動作可以是讀取，寫入，執行，刪除，新增，對文件進行全方位的監控， 保護的響應方式也可以根據規則的嚴格性和後果的嚴重性，自己設定，非常靈活

[psac]

MCAFee（麥咖啡）工作行程解釋+設置指南
作者：不詳 　來源於：太平洋軟件 　發佈時間：2005-9-3 11:46:46


首先介紹一下安裝後產生的工作行程！
如果不安裝8.1的防火牆就一共應該有7個工作行程
UpdaterUI.exe、shstat.exe、Tbmon.exe 、Vstskmgr.exe 、Mcshield.exe 、Frameworkservice.exe 、naPrdMgr.exe
　　　UpdaterUI.exe：自動升級進（咖啡一個星期升級一次。）
　　　shstat.exe：也就是你系統欄裡那個盾牌一樣的圖示，啟動項處於註冊表內.(裝完重新啟動系統後，圖示才會出現在系統任務欄中。不
過，即使沒有圖示，VirusScan Enterprise 仍在執行，且您的電腦仍受到保護。）
您可以通過檢查以下註冊表鍵進行確認：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShStatEXE="C:\Program Files\Network
Associates\VirusScan\SHSTAT.EXE"/STANDALONE
　　Tbmon.exe：錯誤報告程式
　　Vstskmgr.exe（Network Associates Task Manager）：這個東西屬於系統服務。
　　Mcshield.exe：咖啡的核心，系統服務！
　　Frameworkservice.exe（McAfee Framework 服務，McAfee 產品的共享元件框架）：咖啡的後台框架工作行程，屬於服務。平時關閉的話，經
過我測試是不影響普通使用的，但是會影響升級，且這個工作行程和Vstskmgr.exe不一樣，他不能自動的去啟動服務，如果你調整成手動，那麼你非得自己動手去啟動這個服務，才能執行升級程式。
　　naPrdMgr.exe：這個工作行程以前的版本就有，它是個Frameworkservice.exe在一起的，如果Frameworkservice.exe被停止，則它絕對不會在任務管理器裡出現。
下面就打開你的咖啡，（右擊系統工作列咖啡的圖示，選virusscan控制台)





這裡就是咖啡的簡單的網路防火牆功能，可以設定讓麥咖啡來阻止相應的連接阜，比如阻止了25連接阜以後，就可以禁止某些木馬把你的密碼等信
息當郵件發送出去，但是如果你用軟件發郵件也會被阻止，可以在排除工作行程中輸入你現在使用的郵件軟件的工作行程名字，比如foxmail.exe
比如有個木馬是blazer5，連接的是5000連接阜，在這裡設置一下可以屏蔽掉5000連接阜，如下圖





這裡可以設置你的共享資源，主要是下面，他已經有很多的自帶規則了，你可以禁止在windows的目錄中新增文件，防止木馬的破壞，要裝軟件
的時候臨時執行，這樣雖然比較麻煩，但是安全性確實很不錯。預定的設置狀態下，打開一個壓縮文件是無法直接雙擊執行文件的，像上面那
個的設置，因為有些壓縮包裝中可能有惡意代碼，在臨時資料夾中執行某些惡意程式.



這裡是防止某些病毒利用緩衝區溢出漏洞來傳播




建議把關機時檢測軟碟關了，不然很煩的，下面的掃瞄時間是個很難改動的設置，時間太短的話可能會檢查不完，太長的話有大文件會很慢 (



這是一個很不錯的設定，可以對高低風險的工作行程進行不同的設置，比如有些病毒很喜歡使用系統工作行程的名字，當然就是高風險的了，這樣設置
的話可以對低風險工作行程放寬設置以降低系統資源佔用掃瞄文件這裡，可以設置成只在讀取文件時檢測，這樣可以節省一些資源，當然也是放棄了安全性的。如果你在局域網上，建議選中檢測網路
驅動器。掃瞄文件類型，按訪問掃瞄的話建議選擇預定類型，一般某些不常用的類型，包括某些.bak文件，都是沒有太大危害的，至少現在他
不會執行，不是特別擔心的話選擇預定類型好了。下面是排除列表，就是不掃瞄的資料夾，比如麥咖啡把破解的serv-u當病毒，這裡可以把 (
這裡要說的就是是否掃瞄壓縮文件，我的建議是不掃瞄，因為掃瞄他們會花去大量的時間，即時裡面有病毒，也需要先解壓出來，就是直接運 (
這裡可以在系統空閒的時候自動掃瞄記憶體或者某些敏感資料夾。新增一個按需掃瞄任務，目標是記憶體或者敏感資料夾（比如c:\windows\），然後點計劃

這裡可以選擇檢測時的cpu佔用率，太低的花話可能會讓檢測速度變慢。如果你設定了空閒時掃瞄記憶體的話，這裡還是改低一些吧。
========================================
MCAFEE 官方下載地址歷覽 〔部分〕

請指導其他的官方地址 補全 謝謝
第一個連接改成這個吧，新的地址。

http://www.mcafee.com/apps/downloads...ent=enterprise
McAfee官方病毒庫下載網頁2.1 更新
http://www.mcafee.com/apps/downloads...ent=enterprise


1.9更新

1、McAfee個人簡體中文版本VirusScan10.0.27官方下載地址
http://sdownload.nai.com/products/PR...-use_ZH-CN.EXE




2006年1月4日新增MCAFEE的VSE8.5 BETA I
https://secure.nai.com/us/forms/down...SE85_372_5.Zip

12.1更新：
McAfee 5000引擎
http://download.nai.com/products/nai...ta5eng5000.exe




1.mcafee8.0i（英文版http://sdownload.nai.com/products/pr.../VSE80iLEN.Zip

（中文版http://sdownload.nai.com/products/pr.../VSE80iLCS.Zip

（anti_spyware/v8.0）直接整合在mcafee8.0i
http://sdownload.nai.com/products/PR....0/MASE80L.Zip

（修正檔11）
http://download.nai.com/products/pro...x/VSE80P11.Zip

（整合修正檔10的mcafee）中文版http://sdownload.nai.com/products/pr.../VSE80iLEN.Zip

12.2更新
MVSE 8I繁體中文版
http://sdownload.nai.com/products/pr.../VSE80ilct.Zip

英文版
http://sdownload.nai.com/products/pr.../VSE80iLCS.Zip

McAfee VirusScan 2005
繁體中文版下載：
http://sdownload.nai.com/products/PR...0_11_ZH-TW.EXE
英語版：
http://sdownload.nai.com/products/PR...EN_HomeUse.exe
西班牙語版：
http://sdownload.nai.com/products/PR..._9_0_10_ES.EXE
德語版：
http://sdownload.nai.com/products/PR..._9_0_10_DE.EXE

2.
McAfee Desktop Firewall 8.0簡體中文版：
http://sdownload.nai.com/products/pr.../MDF800LCN.zip
mcafee Desktop_Firewall 8.5英文版
http://sdownload.nai.com/products/PR...N-Licensed.zip
繁體中文版：
http://download.nai.com/products/eva.../MDF850ETW.zip

MDF 8.5的HOTFIX 2:
http://sdownload.nai.com/products/pr...OTFIX2_LEN.ZIP

3.mcafee個人版防火牆[http://download.mcafee.com/products/...PFPH6144EN.exe

4.個人版spamkiller
http://download.mcafee.com/products/...MSKH6107EN.exe

5.MIS7105EN
http://download.mcafee.com/products/.../MIS7105EN.exe

6.個人版殺毒9108
http://download.mcafee.com/products/.../VSH9108EN.exe

7.個人版McAfee.VirusScan.v10.0.21.Retail
http://219.134.128.58/cgi-bin/dl/026...Retail-ZWT.exe

8.McAfee ePolicy Orchestrator 3.5 多國語言授權版本：
http://download.mcafee.com/products/.../EPO350LML.Zip

9.Mcafee 5000引擎BETA4
http://download.nai.com/products/nai...ta4eng5000.exe


（整合修正檔10的mcafee）中文版http://sdownload.nai.com/products/pr.../VSE80iLEN.Zip

英文版
http://sdownload.nai.com/products/pr.../VSE80iLCS.Zip
McAfee VirusScan Enterprise 8.5i Beta Refresh
出來了！！！
鏈接是：
http://www.mcafee.com/us/enterprise/...cafee/vse.html
關於5000系列引擎：官方說明
The current schedule for the release is as follows:
v5000 Release Candidate (all platforms except Netware, and OS400) - 2006-01-23
20060123釋放出RC引擎 適用於全部平台除了netware和os400

v5100 Release Candidate posted to Beta site - Jun
六月將釋放出best測試版本

v5100 Released for elective download - Jul
七月開始系統有選擇性的下載

v5100 Automatic Update from McAfee activated - Aug
8月開始自動升級MCAFEE產品
McAfee VirusScan Enterprise 8.0i能夠由McAfee ePolicy Orchestrator (ePO) 或McAfee ProtectionPilot來進行統一管理，實現跨平台的軟件部署、策略管理和圖形報告，從而更加主動地保護PC機和服務器。

McAfee ProtectionPilot 1.0.1 繁體版
http://sdownload.nai.com/products/PR.../PRP101LCT.Zip
McAfee ProtectionPilot 1.0.1簡體版
http://sdownload.nai.com/products/PR.../PRP101LCS.Zip
http://sdownload.nai.com/products/PR.../PRP101LCS.Zip