ConfigureDefender utility for Windows 10/11

[ForgottenSeer 823865]

Just saying, malware testing shouldn't be done in any virtual system. You will never get fully legit result because of various factors like malware recognizing the environment and acting differently, etc...
Buy a cheap computer, or test on another system drive.

 

[SeriousHoax]

This issue with ShadowDefender should be solved by leaving the ShadowMode, setting WD with ConfigureDefender, checking/correcting the settings in WD Security Center, restarting the computer, and entering the ShadowMode again.

This seems quite a hassle. I'll see what I can do.

 

[SeriousHoax]

Just saying, malware testing shouldn't be done in any virtual system. You will never get fully legit result because of various factors like malware recognizing the environment and acting differently, etc...

This is true but most of the samples tested in the hub here are not environment aware so this is not a huge issue. The hub tests give user a basic idea of how effective a product might be against relatively new samples. For absolute professional grade testing there are other sources out there.

 

[Mjolnir]

Where's Andy - we have a new problem - New bypass disclosed in Microsoft PatchGuard (KPP) | ZDNet

 

[oldschool]

Where's Andy - we have a new problem - New bypass disclosed in Microsoft PatchGuard (KPP) | ZDNet

Relax. These articles are meant to excite/incite as much as inform. M$ offers explanations and the usual PR BS about the bounty program rules. A patch may or may not come. Sensible users are in no immediate danger.

 

[Mjolnir]

No worries Bro, I'm cocked, locked, and ready to rock!!! - https://i.pinimg.com/originals/6e/9a/6a/6e9a6a673710b0d8411db4c81937e2a3.jpg

 

[Andy Ful]

Where's Andy - we have a new problem - New bypass disclosed in Microsoft PatchGuard (KPP) | ZDNet

Ha, ha. I cannot repair the Windows kernel.
The only way to avoid this bypass (in the home environment) is preventing the elevation of the unsafe processes, or even better avoiding to run/open unsafe files. I know some software that can do this well.

 

[ForgottenSeer 823865]

I'm amazed by MS duality... they dismiss the issue saying it need admin rights but at same time when everyone install Windows, the default account is the admin one...and few will know or even create SUA.
99% of the windows users I know, just use Admin account for daily use and the few who use SUA is because they setup it for family members, not for security purposes...

 

[ErzCrz]

I always get more paranoid about security this time of year. Currently running H_C on Recommended settings with ConfigureDefender set to High Protection Level and H_C recommended FirewallHardening rules only enabled (should I be using the others as well?). I'm thinking of maybe moving ConfigureDefender up to Max Settings but is that necessary? Any advice if I do swap over to Max?

Thanks,

Erz

 

[Aggravatorx]

wow very nice work thank you Andy

 

[Andy Ful]

I always get more paranoid about security this time of year. Currently running H_C on Recommended settings with ConfigureDefender set to High Protection Level and H_C recommended FirewallHardening rules only enabled (should I be using the others as well?). I'm thinking of maybe moving ConfigureDefender up to Max Settings but is that necessary? Any advice if I do swap over to Max?

Thanks,

Erz

You have already very strong and restrictive protection. Please, try to live with it for a couple of weeks to see if it is not too restrictive for you. Look from time to time at H_C, ConfigureDefender, and FirewallHardening Logs to see if something was blocked. Some software updates may be blocked with this default-deny setup.
After that, you can think about changing ConfigureDefender or FirewallHardening settings, or add some H_C advanced settings. But, this is not recommended, except when you use not updated Windows or vulnerable/unpatched software.
Please let me know if you will encounter problems with default-deny setup.

 

[ErzCrz]

You have already very strong and restrictive protection. Please, try to live with it for a couple of weeks to see if it is not too restrictive for you. Look from time to time at H_C, ConfigureDefender, and FirewallHardening Logs to see if something was blocked. Some software updates may be blocked with this default-deny setup.
After that, you can think about changing ConfigureDefender or FirewallHardening settings, or add some H_C advanced settings. But, this is not recommended, except when you use not updated Windows or vulnerable/unpatched software.
Please let me know if you will encounter problems with default-deny setup.

Thanks @Andy Ful I think I just needed reassurance what I'm currently using is sufficient to protect me. I've had it for a number of weeks and so far no issues with anything being blocked.

Cheers,

Erz

 

[Bryan320]

This is a very great tool thanks so much for creating this!!!

 

[Andy Ful]

This is a very great tool thanks so much for creating this!!!

Thanks. Be safe.

 

[Pat MacKnife]

A bad result for WD online banking how come it score so poor ?

https://avlab.pl/PDF_avlab/AVLab-Test-of-software-for-online-banking-protection.pdf

 

[oldschool]

A bad result for WD online banking how come it score so poor ?

https://avlab.pl/PDF_avlab/AVLab-Test-of-software-for-online-banking-protection.pdf

Please see this Test results in context and other posts by @Andy Ful in the same thread. No need to get nervous, my friend. You have good protection.

Edit: Use Netcraft in your browser if you're still concerned. Protects against phishing and CSS attacks.

 

[Pat MacKnife]

Please see this Test results in context and other posts by @Andy Ful in the same thread. No need to get nervous, my friend. You have good protection.

Edit: Use Netcraft in your browser if you're still concerned. Protects against phishing and CSS attacks.

Ok didn't follow this other thread explains allot.

 

[South Park]

I decided to add Configure Defender (set to High) alongside OSA on W10 1903. Tested w/ AMTSO PUP file, blocked as it should be. So far all is running smoothly.

 

[Bryan320]

please excuse me if im missing it on the configure utility but anyway to have windows defender check for updates more then the default selected? anyway for the application to check for updates every 1 hours? I'm currently using F secure but set windows defender up on family computers with the utility. just wondering if I can set WD up to updates it's signatures more.

 

[oldschool]

please excuse me if im missing it on the configure utility but anyway to have windows defender check for updates more then the default selected? anyway for the application to check for updates every 1 hours? I'm currently using F secure but set windows defender up on family computers with the utility. just wondering if I can set WD up to updates it's signatures more.

You can via powershell > Set MpPreference but you don't really need to. WD's main protection comes from cloud lookup, which is more up to date than local sigs. I wouldn't bother.

If you insist, then look here Set-MpPreference