ConfigureDefender utility for Windows 10/11

[oldschool]

Had a look but I have no idea what these logs mean. But thanks for the idea. Unless Andy knows what's going on I'll have to try to figure it out by uninstalling Cyberlock and/or allowing Defender scanning again.

I pointed you to the wrong log. You want to check Developer.ServiceLog.Log. Check that and if you can't ID the culprit, then uninstalling VS is the way to eliminate it as the problem or not.

 

[simmerskool]

Had a look but I have no idea what these logs mean. But thanks for the idea. Unless Andy knows what's going on I'll have to try to figure it out by uninstalling Cyberlock and/or allowing Defender scanning again.

which version cyberlock, I've had one or 2 minor issues, sent CL log to Dan, he says he spotted it, and 7.62 coming soon.

 

[Andy Ful]

I thought it may have something to do with Defender updates also as the Cyberlock log shows Windows downloading and installing a delta patch at the same time as the CD event. I've changed the setting in Task scheduler to allow the scan and no change, I still get the Defender event. I get this popup when starting the computer, not sure why it says I'm using another av program.
View attachment 279814

Even if you installed another AV, Defender can still perform periodic scanning. You can disable it from Security Center.

 

[Digmor Crusher]

I pointed you to the wrong log. You want to check Developer.ServiceLog.Log. Check that and if you can't ID the culprit, then uninstalling VS is the way to eliminate it as the problem or not.

Yes, I looked there too, nothing looked funky but I really have no idea what to look for.

 

[Digmor Crusher]

which version cyberlock, I've had one or 2 minor issues, sent CL log to Dan, he says he spotted it, and 7.62 coming soon.

7.61

 

[oldschool]

Yes, I looked there too, nothing looked funky but I really have no idea what to look for.

In which case, uninstall VS and restart machine to check for alerts or errors. Or restore the scheduled task for Defender you disabled.

 

[Digmor Crusher]

Even if you installed another AV, Defender can still perform periodic scanning. You can disable it from Security Center.
View attachment 279815

Yes, but I'm not running another AV, maybe I'll try uninstalling CS tomorrow to see if that makes a difference.

 

[Digmor Crusher]

In which case, uninstall VS and restart machine to check for alerts or errors. Or restore the scheduled task for Defender you disabled.

I restored the task, makes no difference. I uninstalled CS, and viola, no alerts anymore. So it seems like CS was the culprit, very strange indeed.

 

[oldschool]

So it seems like CS was the culprit, very strange indeed.

As I suspected.

 

[Andy Ful]

What is CS?

 

[Digmor Crusher]

What is CS?

Brain cramp. I meant CL, Cyberlock.
Edit: And I'm a dummy, I did it twice.

 

[simmerskool]

Brain cramp. I meant CL, Cyberlock.
Edit: And I'm a dummy, I did it twice.

did you tell Dan that VS/CL 7.61 was the culprit, maybe he can tweak code before he releases 7.62...

 

[Digmor Crusher]

did you tell Dan that VS/CL 7.61 was the culprit, maybe he can tweak code before he releases 7.62...

Nope, I posted about an issue I was having with CL a few months ago in its thread and he didn't reply so I'm not going to bother this time.

 

[simmerskool]

Nope, I posted about an issue I was having with CL a few months ago in its thread and he didn't reply so I'm not going to bother this time.

depending on forum dynamics, I think he does not check MT every day, and he may miss a post, but my experience emailing support, he has always quickly responded, and then responds back after he has investigated. I emailed him my log.log several days ago, he said he figured out issue from my log, and thinks that fix will be incorporated into 7.62. (that's why I asked...)

 

[Digmor Crusher]

depending on forum dynamics, I think he does not check MT every day, and he may miss a post, but my experience emailing support, he has always quickly responded, and then responds back after he has investigated. I emailed him my log.log several days ago, he said he figured out issue from my log, and thinks that fix will be incorporated into 7.62. (that's why I asked...)

Yah, he's usually very good at responding to issues or requests. I'm not going to post though as I've uninstalled CL for now.

 

[Andy Ful]

ConfigureDefender ver. 4.0.0.0

https://github.com/AndyFul/ConfigureDefender/raw/master/ConfigureDefender.exe

Added mouse-wheel scrolling (requested on GitHub). No need to update.

 

[SeriousHoax]

Saw two new ASR rules which are currently in Preview:

Block rebooting machine in Safe Mode (preview)​

ASR rules reference - Microsoft Defender for Endpoint

Learn about each attack surface reduction (ASR) rule in Microsoft Defender for Endpoint, including OS support, deployment methods, alert behavior, and per-rule configuration details.

learn.microsoft.com

Block use of copied or impersonated system tools (preview)​

ASR rules reference - Microsoft Defender for Endpoint

Learn about each attack surface reduction (ASR) rule in Microsoft Defender for Endpoint, including OS support, deployment methods, alert behavior, and per-rule configuration details.

learn.microsoft.com

 

[Kongo]

Block use of copied or impersonated system tools (preview)

So does it basically block all files that have the same name as legitimate system files? Or does it go deeper?

e.g. explorer.exe

 

[SeriousHoax]

So does it basically block all files that have the same name as legitimate system files? Or does it go deeper?

e.g. explorer.exe

I was also wondering that. I think our MD expert @Andy Ful will be able to tell when he is able to test it or if there is any detailed info available about it online.

 

[Azazel]

Hello @Andy Ful ,
Can you add the low CPU priority setting.

Thanks