App Review Microsoft Defender Antivirus with Andy Ful WHHLight

[Shadowra]

Content source

https://odysee.com/@Shadowra:f/Microsoft-Defender-Antivirus-with-WHHLight:a

Microsoft Defender has been the standard antivirus provided by Microsoft since Windows 8.
On Windows 10, Microsoft considerably improved its antivirus, and continued with Windows 11.
In this test, I've been asked to add @Andy Ful WHHLight with settings predefined by the editor.
I'm also adding MSOffice anti-exploit and FirewallHardening, which blocks all connections by Trojans using system processes (LOLBins).
SWH adds more rules later.



User interface :

Microsoft Defender's interface is well integrated into Windows, making it part of Windows.
It's very clear and detailed, I love it!

Web protection: 10/10

For the URL test, I deliberately disabled Edge's Web filtering to be in the best conditions to provoke Microsoft Defender's detections.

Well, I'm very surprised. Microsoft Defender reacted correctly to my URL test, blocking all infected downloads!

Fake crack : 1/1

Microsoft Defender won't let me extract the fake crack by detecting it directly! The only antivirus that does this for me! Congratulations!

Malware Pack : Remaining 9 out of 309 threats. (Windows shows 10 but Defender blocks 1 more when I access the folder)

Microsoft Defender's engine has really improved, and for me it's one of the best on the market!
WHHLight adds an extra layer of protection by prohibiting scripting.
Congratulations!

Final scan :
Microosft : 0
NPE : 0

Final opinion:

Microsoft Defender really surprised me.
Microsoft has done a lot of work on the detection side, and it can compete with the big names in free and even paid antivirus!
WHHLight provides a good layer of protection by strengthening the system.
Recommended protection.

@oldschool , @ZeroDay and @simmerskool request

 

[Jengo]

Avast has a good scanner, and is even very fast.
Surprisingly, Avast refused to process any threats outside the video! I had to restart a scan with automatic deletion...

But I've also noticed that the Avast lab is less reactive than before. It lets several Trojans through. Even if IDP managed to block some infections, as well as CyberCapture.
The machine is partially infected, but can still be saved.

Final scan :
Avast: 0 (detection comes from AtlasOS, I don't know)
NPE: 5
KVRT: 5

Final opinion: Avast is an antivirus recommended for cautious surfers.
However, it is not suitable for small PCs, as Avast often consumes a lot of resources.
There's still work to be done on unknown detections.

Avast @Shadowra ? I think you mixed the text a bit :-D

 

[Shadowra]

Avast @Shadowra ? I think you mixed the text a bit :-D

Ups... Fixed

 

[WhiteMouse]

Avast @Shadowra ? I think you mixed the text a bit :-D

"Can I copy your homework?"
"Yeah just change it up a bit so it doesn't look obvious"
"Ok"

 

[Shadowra]

"Can I copy your homework?"
"Yeah just change it up a bit so it doesn't look obvious"
"Ok"

To go faster, I'm using a text I've already done on my own, and I'm just changing the name and my comments.
I didn't realize I'd forgotten a part, so I've just corrected it

 

[Digmor Crusher]

Nice. Not surprised by the results, its the exact combo I"m using on my desktop now.

 

[Andy Ful]

Thanks a lot for this nice test-review.
Microsoft Defender detected all EXE samples in ConfigureDefender HIGH settings, so the WDAC security layer in WHHLight had no work.
Generally, it is not easy to find dangerous EXE malware (non-Adware and non-PUA) that could bypass popular AVs.
Of course, it is possible that in another test Microsoft Defender could be bypassed and then we might probably see WDAC in action.

 

[Shadowra]

Thanks a lot for this nice test-review.
Microsoft Defender detected all EXE samples in ConfigureDefender HIGH settings, so the WDAC security layer in WHHLight had no work.
Generally, it is not easy to find dangerous EXE malware (non-Adware and non-PUA) that could bypass popular AVs.
Of course, it is possible that in another test Microsoft Defender could be bypassed and then we might probably see WDAC in action.

Yes, I did have other exploits but Defender deleted them too
WHH also played its part! It prevented VBS from launching

 

[simmerskool]

great test! great music, great background graphics. A joy to watch.

 

[Bombus]

Hi, Shadowra. Thank You for Your tests. Could You please say the name of this musical group?

 

[ErzCrz]

Awesome that combination does so well!
I'm using MD, Cyberlock, DefenderUI and WFC at the moment so not sure WHHL/CD/FWH fits in with that unless I drop DefenderUI and WFC but may be something worth experimenting with

 

[Shadowra]

Hi, Shadowra. Thank You for Your tests. Could You please say the name of this musical group?

Hello
Here

And the musical style I use is called Synthewave

 

[simmerskool]

as a sidenote to the test: I tried a few of the URLs you tested, and here they were blocked in Firefox by ublock orgin as malicious. This probably means that malware info is getting widely distributed pretty quickly...

 

[ZeroDay]

Great test and video. Thank you for taking the time to make and share it. I might switch from Kaspersky Plus to this config.

 

[Andy Ful]

Yes, I did have other exploits but Defender deleted them too
WHH also played its part! It prevented VBS from launching

WDAC could block VBScript files, but I forbade it in WHHLight:
https://malwaretips.com/threads/whh...-for-windows-home-and-pro.128274/post-1073915

So the block was done via SWH.

 

[ZeroDay]

Anyone know of an good software updaters. Because I'm going to switch from Kaspersky to this config I could do with a software updater because Kaspersky usually does all that for me. I'm very happy with Kaspersky. This is just a lighter config. And I Love the fact that it's all Windows based.

 

[Andy Ful]

Anyone know of an good software updaters. Because I'm going to switch from Kaspersky to this config I could do with a software updater because Kaspersky usually does all that for me. I'm very happy with Kaspersky. This is just a lighter config. And I Love the fact that it's all Windows based.

Which Kaspersky edition?
If you have the edition with Application Control, then you do not need WHHLight (use @harlan4096 settings).
If not (and when you like Kaspersky very much), then you can use the WHHLight package with Kaspersky (skip ConfigureDefender).

 

[Sandbox Breaker]

We use this setup plus Xcitium containment for the hell of it

 

[Andy Ful]

We use this setup plus Xcitium containment for the hell of it

Xcitium + WHHLight?

 

[Sandbox Breaker]

Xcitium + WHHLight?

Hard Configurator + Xcitium. You saved me thousands on Microsoft Defender for Endpoint man! The Xcitium installer I have works on unlimited endpoints. I've got windows, mac (containment now stable) and Linux agents