Advanced Plus Security Deletedmessiah's 2021 configuration

[Deletedmessiah]

Nothing changed from the last one I had in 2020.

 

[silversurfer]

I cannot find on your config, you may already using any highly recommended tools from Windows Sysinternals:

Autoruns - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.

docs.microsoft.com

Process Explorer - Sysinternals

Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more.

docs.microsoft.com

 

[Gandalf_The_Grey]

I cannot find on your config, you may already using any highly recommended tools from Windows Sysinternals:

Autoruns - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.

docs.microsoft.com

Process Explorer - Sysinternals

Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more.

docs.microsoft.com

I see that you are recommending these tools every time now.
While I understand and use Autoruns I don't know what to use Process Explorer for.
Is there a tuturial somewhere or can you give some examples for how it is used?

 

[silversurfer]

While I understand and use Autoruns I don't know what to use Process Explorer for.
Is there a tuturial somewhere or can you give some examples for how it is used?

Understanding Process Explorer

This lesson in our Geek School series covers Process Explorer, perhaps the most used and useful application in the SysInternals toolkit. But how well do you really know this utility?

www.howtogeek.com

For me personally, one of the most important setting below, but must be enabled manually...

Verifying Application Identity​

One really useful option that we’re surprised isn’t enabled by default is found at Options -> Verify Image Signatures.

This option will check the digital signature for each executable file in the list, which is an invaluable troubleshooting tool when you are looking at some suspicious application that is running in the list.

The vast majority of reputable software should be digitally signed at this point. If something isn’t, you should look very carefully at whether you should be using it.

 

[Deletedmessiah]

Understanding Process Explorer

This lesson in our Geek School series covers Process Explorer, perhaps the most used and useful application in the SysInternals toolkit. But how well do you really know this utility?

www.howtogeek.com

This article will be useful

 

[ForgottenSeer 85179]

Also both ProcessExplorer and Autoruns provide this feature. Same like scanning all with Virustotal but sadly this is currently broken for most processes - at least for me.

 

[silversurfer]

This article will be useful

Here is another article from the same source, explained more details of Autoruns:

Using Autoruns to Deal with Startup Processes and Malware

Most geeks have their tool of choice to deal with processes that start up automatically, whether that is MS Config, CCleaner, or even Task Manager in Windows 8 — but none of them are as powerful as Autoruns, which is also our Geek School lesson for today.

www.howtogeek.com

Also both ProcessExplorer and Autoruns provide this feature. Same like scanning all with Virustotal but sadly this is currently broken for most processes - at least for me.

Same here, VT lookup is broken for the most of processes, weird as it was recently fixed for a few days been worked properly.

 

[Gandalf_The_Grey]

Thanks @silversurfer I have bookmarked those two links

 

[ForgottenSeer 85179]

Same here, VT lookup is broken for the most of processes, weird as it was recently fixed for a few days been worked properly.

Thanks for confirm this. So it's not my setup

Maybe the problem is not on Virustotal side but with the tools like new / invalid used API?
If someone use Twitter, this may be a good place to send Microsoft this as bug info.

 

[Gandalf_The_Grey]

Thanks for confirm this. So it's not my setup

Maybe the problem is not on Virustotal side but with the tools like new / invalid used API?
If someone use Twitter, this may be a good place to send Microsoft this as bug info.

VT lookup is working for me when running both programs as admin

 

[silversurfer]

VT lookup is working for me when running both programs as admin

Just tried once more here... Confirmed all works fine now on both Autoruns and Process-Explorer

But before it was really broken, I haven't taken any screenshot as it's useless to show the UI is partially in German

 

[Gandalf_The_Grey]

Thanks @silversurfer I have bookmarked those two links

I changed my bookmarks to this one: Using SysInternals Tools Like a Pro

Gives even more information and also talks about their other tools:

Sorry @Deletedmessiah for cluttering your config thread...

 

[Deletedmessiah]

I changed my bookmarks to this one: Using SysInternals Tools Like a Pro

Gives even more information and also talks about their other tools:

View attachment 252493
Sorry @Deletedmessiah for cluttering your config thread...

You can continue I don't really mind

 

[ForgottenSeer 85179]

Just tried once more here... Confirmed all works fine now on both Autoruns and Process-Explorer

But before it was really broken, I haven't taken any screenshot as it's useless to show the UI is partially in German

Sadly this doesn't change anything here.

 

[upnorth]

Just tried once more here... Confirmed all works fine now on both Autoruns and Process-Explorer

Confirmed the same.

 

[Gandalf_The_Grey]

Sadly this doesn't change anything here.

It still works (slowly, waiting for hash submitted) here.
Could there be something in NextDNS or something else in your config that is blocking the VT check?

 

[ForgottenSeer 85179]

It still works (slowly, waiting for hash submitted) here.
Could there be something in NextDNS or something else in your config that is blocking the VT check?

i check with Cloudflare but no change :/

 

[oldschool]

i check with Cloudflare but no change :/

Maybe your firewall hardening or other system protections you have in place?

 

[Deletedmessiah]

Added: Simple Windows Hardening.
I've used it for a while but forgot to mention.

Removed: h264ify since Enhancer for youtube includes the feature now.