IP-Guard清除记录

Posted 2023-02-27 AlphaABCD

个人操作记录，暂时看是清除干净了

1. 火绒断网(防护中心-->高级防护-->IP协议控制)
    a. 禁止winrdlv3.exe访问网络 TCP/UDP 访问
	b. 限制端口-8235-TCP/UDP
	c. 限制端口8237-TCP/UDP

2. 使用 FreeFixer 处理有疑问的 程序

3. 使用 验证微软签名工具DigitalSignCheck 查找 签名带 "T.E.C Solutions" 字样的程序(.exe/.dll/.sys) 全部删除

    主要是这几个目录下：
    C:\\Program Files\\Common Files\\System
	C:\\WINDOWS
    C:\\WINDOWS\\system32
    C:\\WINDOWS\\SysWOW64
	C:\\Windows\\INF
	

IP-Guard的主要程序文件：

Agt3Tool

winrdlv3.exe

ONacAgent.exe

winhafnt64.dll

winhadnt64.dll

DtFrame64.dll

TIjtdrvd64.dll

DtsFrame64.dll

TMailHook64.dll

thooksv364.dll

winncap364.dll

winrdgv3.exe

winwdgv364.dll

TSandbox64.dll

TSafeDoc64.dll

IFOCMSDll64.dll

winencyx64.dll

winusrmd64.dll

sdfileicon64.dll

EnumIACC264.dll

winbrohca64.dll

thlpdrv64.sys

tijtdrv64.sys

tnullfilter.sys

tpacket7.sys

tsdencrypt.sys

tsdencryptmf.sys