微软卫士阻止微软激活脚本 (MAS) 可能是正确的
乍听之下，这似乎是一起典型的 IT 安全故障。一些网站报道说，微软 Defender 突然开始阻止最初的 "微软激活脚本"（MAS）。错误信息"Trojan:PowerShell/FakeMas.DA!MTB "表明，微软的安全软件将这个合法的开源工具误认为是市场上流通的恶意软件拷贝之一。由于 MAS 是一个用于激活 Windows 和 Office 的社区解决方案，而不是微软的官方产品，因此许多人立即怀疑它是故意为之--可以说是后门封锁。
However, we examined the situation more closely using the latest Defender updates on January 9, 2026, and were unable to reproduce the error. During our tests on multiple laptops, the original script executed via the known command irm https://get.activated.win | iex was processed through without Defender producing warnings. Our test network was preconfigured to use Cloudflare's DNS server at 1.1.1.1. Furthermore, we also tested slightly older Defender versions via VM backups done during the last three days. All of them passed without any false detections. This gives room for a different perspective. If Defender remains silent for us but flags the script for other users, explicitly warning of a "FakeMas" variant, the detection logic might actually be working exactly as intended.
我们怀疑这不是微软方面的错误，而是受影响用户的网络出现了问题。一个合理的解释是 DNS 错误，甚至是有针对性的 DNS 攻击（DNS 欺骗）。如果这些用户的域名解析被篡改，尝试访问所谓的合法地址实际上会将他们引向一个提供恶意 "伪造 "版本的服务器。在这种情况下，卫士警告并不是误报，而是一种合法的、最后一分钟的救援措施。某些网站建议的解决方案--暂时禁用 Defender--会为恶意软件或木马大开方便之门。
The fact that reports seem clustered in specific regions supports this theory. ISP-specific DNS issues or local redirections could be causing users to be unwittingly redirected to malware sites. Therefore, instead of hastily accusing Microsoft of negligence, affected users should urgently check their DNS settings. The script can also be retrieved by enforcing a specific DNS server. To do this, enter the following command: iex (curl.exe -s --doh-url https://1.1.1.1/dns-query https://get.activated.win | Out-String). If this resolves the issue, a faulty DNS configuration is likely the culprit.
资料来源
