título
Como posso remover a mensagem Win7 de um exe que tem essa mensagem aparecer "Você deseja permitir que o programa a seguir de um editor desconhecido faça alterações no seu computador"?
Eu recebo uma mensagem como
QuandotentoexecutarumEXE
OEXEéMFTRCRD64.exe
link
Clique em "clone ou download" em verde e, em seguida, em "zip de download" em azul
Eutenteicopiarc:\windows\system32\calc.exeparac:\abetenteicopiaresseexe(MFTRCRD64.exe)parac:\ab.calc.exe(calc.exeéclaroporMS),nãotemnenhumproblema.Qualquerprogramaqueeuescrevaecompilenãotemproblema.Masesteprogramaapareceumamensagem.Muitosprogramasqueescrevoporoutraspessoasnãomostramamensagem.Poralgumarazão,esteapareceestamensagem.
NãoháfluxosanexadosaoEXE,porissonãoconsigoveroqueestácausandoisso.EuseiqueoWindowsXPcostumavafazeralgumacoisadesegurançaevocêpoderiaexcluirumfluxodeidentificadordezonaassociadoaoarquivoeestavatudobem.Masissoédiferente,éoUACdandoamensagem(claro,owin7temoUACwinxpnão).
Mas,paraquasetodososarquivosexecutáveisquerecebodequalquerlugar,nãoreceboessamensagemdoUAC.MaseufaçoparaestearquivoMFTRCRD64.EXE.Entãodeveseralgosobrecomooarquivofoiproduzido,eeumeperguntoseeupossomudarisso.
C:\ab>dirVolumeindriveChasnolabel.VolumeSerialNumberisB411-D580DirectoryofC:\ab01/10/201612:31AM<DIR>.01/10/201612:31AM<DIR>..14/07/200902:38AM918,528calc.exe15/09/201509:42PM1,099,499MFTRCRD64.exe2File(s)2,018,027bytes2Dir(s)7,114,272,768bytesfreeC:\ab>calcC:\ab>MFTRCRD64.exeC:\ab>streamsMFTRCRD64.exeStreamsv1.56-EnumeratealternateNTFSdatastreamsCopyright(C)1999-2007MarkRussinovichSysinternals-www.sysinternals.comC:\ab>
Rikfazumaobservaçãointeressante,quepodeestartentandoescreveremalgumlugarquenãoépermitido,ondevocêtemqueseradministrativo.Edefatoeunãoentendoessacaixaquandoemumpromptadministrativocmd.
"your running into the "Installer Detection Technology" or IDT from
the UAC. It tries to detect if it's dealing with an "installer" and if
so, gives you that prompt. Here are two links you can read more about
it and check the list for IDT-methods to see if you can solve it.
http://answers.microsoft.com/en-us/windows/forum/windows_7-security/uac-message-do-you-want-to-allow-the-following/bea30ad8-9ef8-4897-aab4-841a65f7af71
and http://technet.microsoft.com/en-us/library/cc709628(v=ws.10).aspx "
O link answers.microsoft.com diz "Isso ocorre quando programas desconhecidos (não assinados) tentam gravar dados em pastas do sistema protegidas ou configurações do Registro, e o UAC está buscando sua permissão"
O link do technet diz
Filename includes keywords like "install," "setup," "update," etc.
Keywords in the following Versioning Resource fields: Vendor, Company
Name, Product Name, File Description, Original Filename, Internal
Name, and Export Name. Keywords in the side-by-side manifest embedded
in the executable. Keywords in specific StringTable entries linked in
the executable. Key attributes in the RC data linked in the
executable. Targeted sequences of bytes within the executable.
Eu incluí algumas saídas do monitor do processador (eu entendo que substituiu o regmon), embora eu não tenha idéia de quais áreas de registro das áreas de pasta que ele está acessando, que podem desencadear isso (se for mesmo)
link
Eu tentei escrever um programa afiado para escrever em uma área onde você tem que ser administrativo (fazendo um arquivo c: \ arquivos de programas \ abc.aaa), link mas percebo que não acionou um UAC, que acabou de fazer uma exceção de acesso não autorizado.
Eu também tentei executar um exe de 32 bits que tinha configurado o nome do arquivo, e ele não o acionou
C:\crp3>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp3
02/10/2016 01:31 PM <DIR> .
02/10/2016 01:31 PM <DIR> ..
22/02/2014 08:21 PM 12,689,608 a_setup_.exe
15/09/2015 09:42 PM 1,099,499 MFTRCRD64.exe
25/07/2015 01:03 AM 73,216 w.exe
3 File(s) 13,862,323 bytes
2 Dir(s) 7,455,793,152 bytes free
C:\crp3>file a_setup_.exe
a_setup_.exe; PE32 executable for MS Windows (GUI) Intel 80386 32-bit
C:\crp3>a_setup_.exe
C:\crp3> :: didn't trigger it
C:\crp3>
adição adicional
Eu aceito a resposta do rik e as grandes contribuições do dan, que vieram na discussão.
No entanto, quando removo essa linha RequireAdmin da parte superior, não obtenho nenhuma resposta no prompt cmd não administrativo ou administrativo.
Mas não é importante. Tanto rik quanto dan receberam a mesma resposta de erro.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\harvey>cd \crp4
C:\crp4>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4
02/10/2016 03:51 PM <DIR> .
02/10/2016 03:51 PM <DIR> ..
02/10/2016 03:15 PM 1,517 changelog.txt
02/10/2016 03:15 PM 1,114 LICENSE.md
02/10/2016 03:15 PM 163,548 MFTRCRD.au3
02/10/2016 03:51 PM 1,222,656 mftrcrd.exe
02/10/2016 03:15 PM 755,712 mftrcrd2.exe
02/10/2016 03:15 PM 792,064 MFTRCRD64.exe
02/10/2016 03:16 PM 1,222,656 MFTRCRDNEW.exe
02/10/2016 03:15 PM 755,712 MFTRCRD_old.exe
02/10/2016 03:47 PM 1,222,656 MFTRCRD_sci.exe
02/10/2016 03:15 PM 0 readme.txt
10 File(s) 6,137,635 bytes
2 Dir(s) 7,346,610,176 bytes free
C:\crp4>mftrcrd.exe
C:\crp4>mftrcrd64.exe
C:\crp4>notepad.exe MFTRCRD.au3
C:\crp4>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
C:\crp4>
C:\crp4>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
C:\crp4>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
C:\crp4>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
C:\crp4>file mftrcrd.exe
mftrcrd.exe; PE32 executable for MS Windows (GUI) Intel 80386 32-bit
C:\crp4>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
C:\crp4>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4
02/10/2016 03:51 PM <DIR> .
02/10/2016 03:51 PM <DIR> ..
02/10/2016 03:15 PM 1,517 changelog.txt
02/10/2016 03:15 PM 1,114 LICENSE.md
02/10/2016 03:15 PM 163,548 MFTRCRD.au3
02/10/2016 03:51 PM 1,222,656 mftrcrd.exe
02/10/2016 03:15 PM 755,712 mftrcrd2.exe
02/10/2016 03:15 PM 792,064 MFTRCRD64.exe
02/10/2016 03:16 PM 1,222,656 MFTRCRDNEW.exe
02/10/2016 03:15 PM 755,712 MFTRCRD_old.exe
02/10/2016 03:47 PM 1,222,656 MFTRCRD_sci.exe
02/10/2016 03:15 PM 0 readme.txt
10 File(s) 6,137,635 bytes
2 Dir(s) 7,348,428,800 bytes free
C:\crp4>MFTRCRD_sci C?0x100000 -d indxdump=off 4096 -s
C:\crp4>mftr_old.exe C?0x100000 -d indxdump=off 4096 -s
'mftr_old.exe' is not recognized as an internal or external command,
operable program or batch file.
C:\crp4>mftrcrd_old.exe C?0x100000 -d indxdump=off 4096 -s
C:\crp4>md a
C:\crp4>copy mftrcrd.exe
The file cannot be copied onto itself.
0 file(s) copied.
C:\crp4>copy mftrcrd.exe a
1 file(s) copied.
C:\crp4>cd a
C:\crp4\a>del mftrcrd.exe
C:\crp4\a>cd ..
C:\crp4>cd a
C:\crp4\a>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
02/10/2016 04:37 PM <DIR> .
02/10/2016 04:37 PM <DIR> ..
02/10/2016 04:37 PM <DIR> MftRcrd-master
0 File(s) 0 bytes
3 Dir(s) 7,346,700,288 bytes free
C:\crp4\a>cd MftRcrd-master
C:\crp4\a\MftRcrd-master>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a\MftRcrd-master
02/10/2016 04:37 PM <DIR> .
02/10/2016 04:37 PM <DIR> ..
02/10/2016 04:37 PM 1,517 changelog.txt
02/10/2016 04:37 PM 1,114 LICENSE.md
02/10/2016 04:37 PM 163,563 MFTRCRD.au3
02/10/2016 04:37 PM 755,712 MFTRCRD.exe
02/10/2016 04:37 PM 792,064 MFTRCRD64.exe
02/10/2016 04:37 PM 0 readme.txt
6 File(s) 1,713,970 bytes
2 Dir(s) 7,346,700,288 bytes free
C:\crp4\a\MftRcrd-master>move * ..\
C:\crp4\a\MftRcrd-master\changelog.txt
C:\crp4\a\MftRcrd-master\LICENSE.md
C:\crp4\a\MftRcrd-master\MFTRCRD.au3
C:\crp4\a\MftRcrd-master\MFTRCRD.exe
C:\crp4\a\MftRcrd-master\MFTRCRD64.exe
C:\crp4\a\MftRcrd-master\readme.txt
6 file(s) moved.
C:\crp4\a\MftRcrd-master>cd ..
C:\crp4\a>rmdir /s MftRcrd-master
MftRcrd-master, Are you sure (Y/N)? y
C:\crp4\a>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
02/10/2016 04:37 PM <DIR> .
02/10/2016 04:37 PM <DIR> ..
02/10/2016 04:37 PM 1,517 changelog.txt
02/10/2016 04:37 PM 1,114 LICENSE.md
02/10/2016 04:37 PM 163,563 MFTRCRD.au3
02/10/2016 04:37 PM 755,712 MFTRCRD.exe
02/10/2016 04:37 PM 792,064 MFTRCRD64.exe
02/10/2016 04:37 PM 0 readme.txt
6 File(s) 1,713,970 bytes
2 Dir(s) 7,346,503,680 bytes free
C:\crp4\a>MFTRCRD.exe
C:\crp4\a>copy MFTRCRD.exe mftrcrd_original.exe
1 file(s) copied.
C:\crp4\a>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
02/10/2016 04:38 PM <DIR> .
02/10/2016 04:38 PM <DIR> ..
02/10/2016 04:37 PM 1,517 changelog.txt
02/10/2016 04:37 PM 1,114 LICENSE.md
02/10/2016 04:37 PM 163,563 MFTRCRD.au3
02/10/2016 04:37 PM 755,712 MFTRCRD.exe
02/10/2016 04:37 PM 792,064 MFTRCRD64.exe
02/10/2016 04:37 PM 755,712 mftrcrd_original.exe
02/10/2016 04:37 PM 0 readme.txt
7 File(s) 2,469,682 bytes
2 Dir(s) 7,345,741,824 bytes free
C:\crp4\a>"\Program Files (x86)\AutoIt3\SciTE\SciTE.exe"
C:\crp4\a>del mftrcrd.exe
C:\crp4\a>dir mftrcrd.exe
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
File Not Found
C:\crp4\a>:: opened mftrcrd.au3, done tools..compile
C:\crp4\a>
C:\crp4\a>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
02/10/2016 04:40 PM <DIR> .
02/10/2016 04:40 PM <DIR> ..
02/10/2016 04:37 PM 1,517 changelog.txt
02/10/2016 04:37 PM 1,114 LICENSE.md
02/10/2016 04:37 PM 163,563 MFTRCRD.au3
02/10/2016 04:40 PM 1,222,656 MFTRCRD.exe
02/10/2016 04:37 PM 792,064 MFTRCRD64.exe
02/10/2016 04:37 PM 755,712 mftrcrd_original.exe
02/10/2016 04:37 PM 0 readme.txt
7 File(s) 2,936,626 bytes
2 Dir(s) 7,345,045,504 bytes free
C:\crp4\a>>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
'C?0x100000' is not recognized as an internal or external command,
operable program or batch file.
C:\crp4\a>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
Access is denied.
C:\crp4\a>head -n 1 mftrcrd.au3
#RequireAdmin
C:\crp4\a>notepad.exe MFTRCRD.au3
C:\crp4\a>:: removed that line
C:\crp4\a>del mftrcrd.exe
C:\crp4\a>dir mftrcrd.exe
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
02/10/2016 04:40 PM 1,222,656 MFTRCRD.exe
1 File(s) 1,222,656 bytes
0 Dir(s) 7,345,041,408 bytes free
C:\crp4\a>del mftrcrd.exe
C:\crp4\a\MFTRCRD.exe
Access is denied.
C:\crp4\a>dir mftrcrd.exe
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
File Not Found
C:\crp4\a>:: tools..compile
C:\crp4\a>dir mftrcrd.exe
Volume in drive C has no label.
Volume Serial Number is B411-D580
Directory of C:\crp4\a
02/10/2016 04:43 PM 1,222,656 MFTRCRD.exe
1 File(s) 1,222,656 bytes
0 Dir(s) 7,345,041,408 bytes free
C:\crp4\a>MFTRCRD C?0x100000 -d indxdump=off 4096 -s
C:\crp4\a>
adicionado -
removing that #RequireAdmin line and doing '"C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe" /in MFTRCRD.au3 /console' both as Rik suggested, and I reproduce what Rik gets.