ConfigureDefender utility for Windows 10/11

[Vitali Ortzi]

Is running Voodoshield along side WD on Configure Defender High Protection Level , compatible in the sense that it might catch things smart screen may miss?

Technically it is possible but unlike as most malware is poorly made and exploit kits / signed malware isn't common.

 

[oldschool]

Is running Voodoshield along side WD on Configure Defender High Protection Level , compatible in the sense that it might catch things smart screen may miss?

If you are talking about VS's VT scoring component, then probably not. Smartscreen is very strong on its own with the size of the M$ network.

OTOH, VS is a perfect companion because it will block scripting attacks but this strength is user-dependent --> if the user allows it then "game over." If the user follows the VS Golden Rule and only allows things they are intending to to run, then no problems.

 

[Andy Ful]

Is running Voodoshield along side WD on Configure Defender High Protection Level , compatible in the sense that it might catch things smart screen may miss?

Technically it is possible but unlike as most malware is poorly made and exploit kits / signed malware isn't common.

WD (ConfigureDefender HIGH settings) + VS is OK. SmartScreen ignores the files without MOTW, so adding VS is acceptable. Other possibilities like malware with stolen reputable certificates, archives containing legal & signed EXE + DLL (DLL hijacking), etc., can also pass by SmartScreen protection, but they are too rare and rather expected in targeted attacks.
As @oldschool mentioned, VS also adds some anti-scripting protection.

 

[oldschool]

SmartScreen ignores the files without MOTW, so adding VS is acceptable.

Thanks, I forgot about this in my post.

 

[Andy Ful]

The new version of portable ConfigureDefender (3.0.0.0):

ConfigureDefender/ConfigureDefender.exe at master · AndyFul/ConfigureDefender

Utility for configuring Windows 10 built-in Defender antivirus settings. - AndyFul/ConfigureDefender

github.com

What is new?

Version 3.0.0.0
	1. Corrected a bug related to the error when "Defender Security" Log is empty.
	2. Removed events Id=1117 and Id=5007 from Defender Security Log.
	3. Extended the maximal number of entries in the Log to 300.
	4. Extended the "Cloud Time Check Limit" in HIGH Protection Level from 10s to 20s.
	5. Added DLL hijacking protection - 64-bit and 32-bit installers are wrapped into one installer by NSISS.
	6. Corrected some minor bugs.

 

[ForgottenSeer 85179]

The new version of portable ConfigureDefender (3.0.0.0):

I guess this is included in next H_C update?

 

[Dave Russo]

I guess this is included in next H_C update?

Same Question (I think) Do I have to reinstall to get the update?

 

[Andy Ful]

I guess this is included in next H_C update?

Same Question (I think) Do I have to reinstall to get the update?

The new ConfigureDefender will be included in the upcoming H_C stable version. Most changes are included in the H_C beta 5.0.1.1 which will be available after a few days.
The portable version of ConfigureDefender 3.0.0.0 can be used alongside the current stable version of H_C (5.0.0.0) - the only difference is that it cannot be run directly from H_C's main window, because the executable names are different (ConfigureDefender.exe, and ConfigureDefender_x64.exe or ConfigureDefender_x86.exe).

 

[DSD27]

Believe me, few people know Avast like me.

For a long time, I 've been consistently having 55 fps average as result when running the benchmark mode of Assassin's Creed Odyssey. Now that I've switched to Avast, with Do not disturb mode and enabling the "suspend all non-gaming processes" from the geek:area, I now get 61 fps. That's a 6 fps improvement, not only at average, but also minimum and maximum.
I don't know exactly how they suspend non-gaming processes, but looks like it works.

 

[oldschool]

The new version of portable ConfigureDefender (3.0.0.0)

Thanks @Andy Ful. The best keeps getting better for simple, effective protection!

 

[imuade]

The new version of portable ConfigureDefender (3.0.0.0):

ConfigureDefender/ConfigureDefender.exe at master · AndyFul/ConfigureDefender

Utility for configuring Windows 10 built-in Defender antivirus settings. - AndyFul/ConfigureDefender

github.com

What is new?

Version 3.0.0.0
	1. Corrected a bug related to the error when "Defender Security" Log is empty.
	2. Removed events Id=1117 and Id=5007 from Defender Security Log.
	3. Extended the maximal number of entries in the Log to 300.
	4. Extended the "Cloud Time Check Limit" in HIGH Protection Level from 10s to 20s.
	5. Added DLL hijacking protection - 64-bit and 32-bit installers are wrapped into one installer by NSISS.
	6. Corrected some minor bugs.

Just tried, bu I got an error message (see attached picture). Is it related with SysHardener settings?

 

[Andy Ful]

For a long time, I 've been consistently having 55 fps average as result when running the benchmark mode of Assassin's Creed Odyssey. Now that I've switched to Avast, with Do not disturb mode and enabling the "suspend all non-gaming processes" from the geek:area, I now get 61 fps. That's a 6 fps improvement, not only at average, but also minimum and maximum.
I don't know exactly how they suspend non-gaming processes, but looks like it works.

Please bear in mind that this thread is not about Avast. Let's do not expand the Avast details here.

 

[Andy Ful]

Just tried, bu I got an error message (see attached picture). Is it related with SysHardener settings?

View attachment 238706

The issue comes probably from blocking PowerShell command-lines, but SysHardener settings do not block them. Something else blocks PowerShell, maybe some advanced OSArmor settings?

You can check the event IDs = 4100, 4101, 4102, 4103, and 4104 in Windows Event Viewer.
(Applications and Service logs > Microsoft > Windows > PowerShell / Operational)
You can also use NirSoft FullEventLogView to identify the issue (Options >> Advanced options >> Show only the specified event IDs (comma-delimited list) >> put the 4100, 4101, 4102, 4103, 4104.

 

[oldschool]

I am getting apparently harmless blocks of CD by ASR rule "Block executables unless they ..."



... but I also got a separate, one-time system notification that NSIS was blocked or failed to install.

 

[Andy Ful]

I am getting apparently harmless blocks of CD by ASR rule "Block executables unless they ..."

View attachment 238721

... but I also got a separate, one-time system notification that NSIS was blocked or failed to install.

The ASR block comes from not updated WD signatures (you use MAX or custom CD settings). Did you manage to install CD?

 

[JohnR]

Also had a one time NSIS which I am pretty sure stated 'error launching installer'. CD did however install and appears fine on high setting

 

[oldschool]

Also had a one time NSIS which I am pretty sure stated 'error launching installer'.

That was it! Thanks.

Did you manage to install CD?

Yes. I'll check sigs.

 

[Andy Ful]

Also had a one time NSIS which I am pretty sure stated 'error launching installer'. CD did however install and appears fine on high setting

The installer was probably blocked by WD, because the fresh signatures were not downloaded yet.

 

[oldschool]

The ASR block comes from not updated WD signatures (you use MAX or custom CD settings).

Modified High settings. Just checked sigs and they're up to date.

 

[Andy Ful]

Modified High settings. Just checked sigs and they're up to date.

Is the installer still blocked or run with error?