Update ConfigureDefender utility for Windows 10

[Andy Ful]

Microsoft finished analyzing configuredefender_1.0.0.1.zip
No malware (see attachment).
@Daniel Keller, @Av Gurus, please check if Defender still recognizes it as dangerous. If so, I have to alert Microsoft (that happened to me once with Hard_Configurator installer).

 

[Av Gurus]

I have add configuredefender to Allow list in WD so now (and before) there is no alert from WD.

 

[Windows_Security]

@Andy Ful

Thx for implementing the add controlled access folders.

 

[boredog]

Why would anyone want to enable power shell these days?
That is why I use Appguard.

 

[Andy Ful]

Why would anyone want to enable power shell these days?
That is why I use Appguard.

You can allow PowerShell for a moment to Configure Defender settings.
AppGuard is great, but it cannot replace antivirus/antimalware.
Anyway, Defender default + AppGuard is better than Defender highest without AppGuard.

 

[Andy Ful]

@Andy Ful

Thx for implementing the add controlled access folders.

View attachment 178252

I simply listened to your advice.

 

[shmu26]

OSArmor in default settings does not block PowerShell actions in ConfigureDefender, so they can work together.

Do you see any possible conflicts between Defender high settings and OSArmor? Would you recommend such a setup?

 

[Andy Ful]

Do you see any possible conflicts between Defender high settings and OSArmor? Would you recommend such a setup?

Both overlaps in some areas. I will test this possibility.

 

[Av Gurus]

Do you see any possible conflicts between Defender high settings and OSArmor? Would you recommend such a setup?

I would recommend OSA with WD.
I think those two are very nice to complement.

 

[Daniel Keller]

@Daniel Keller, @Av Gurus, please check if Defender still recognizes it as dangerous. If so, I have to alert Microsoft (that happened to me once with Hard_Configurator installer).

@Andy Ful : No Virus warning any more...

 

[Andy Ful]

@Andy Ful : No Virus warning any more...

Thanks. This time Microsoft analysis was really quick.

 

[boredog]

@Andy Ful : No Virus warning any more...

Huh?

The 32 bit version gets FP by 8
64 bit onlt FP by 1

 

[Andy Ful]

Huh?

The 32 bit version gets FP by 8
64 bit onlt FP by 1

View attachment 178257 View attachment 178258

Yes. It is normal for Virustotal detection of such applications. For example, Excubits Bouncer (bouncer_demo.exe) has detection 30/65 , even though is signed by EV Code Signing CA (SHA2) ????
I also noticed that 32-bit versions usually have a greater number of detections as compared to 64-bit.

 

[boredog]

Yes. It is normal for Virustotal detection of such applications. For example, Excubits Bouncer (bouncer_demo.exe) has detection 30/65 , even though is signed by EV Code Signing CA (SHA2) ????

I will have to ask Dan if when we submit a FP to VS, does it go to all the venders on VT or just VS.

 

[shmu26]

I put WD at high settings, downloaded the latest build of OSArmor, and tried to open Windows File Explorer. It was super slow to display contents. What went wrong?

EDIT: Just to clarify, I did not actually install OSArmor, I just downloaded it.
I am wondering which Defender setting causes a delay in File Explorer. Is it maximum heuristics, or maximum time for cloud lookup, or what?

 

[Spawn]

Am I beating a irrelevant horse, or should everyone using Windows Defender also set Application Settings to (Allow from the Windows Store only).

Users can set a Warning (or Allow) instead of restricting to Store only. However Blocking may be a good approach as part of Parental control or restricting users to certain applications.

Many 3rd Antivirus users end up getting Infected with Malware / Ransomware. Don't take cheap jabs aimed at Windows Defender users. As an Antivirus / Security solution is only as effective as their end-user.

At least Windows 10, version 1607 (Anniversary Update):
Block At First Seen.

@Andy Ful "Block At First Sight"

 

[Andy Ful]

Users can set a Warning (or Allow) instead of restricting to Store only. However Blocking may be a good approach as part of Parental control or restricting users to certain applications.
View attachment 178259
Many 3rd Antivirus users end up getting Infected with Malware / Ransomware. Don't take cheap jabs aimed at Windows Defender users. As an Antivirus / Security solution is only as effective as their end-user.

@Andy Ful "Block At First Sight"

Microsoft uses DisableBlockAtFirstSeen parameter to configure this feature via PowerShell.
They cannot decide about the name.

 

[Spawn]

Microsoft uses DisableBlockAtFirstSeen parameter to configure this feature via PowerShell.
They cannot decide about the name.

It's more confusing to use whatever bts parameter. Based on gpedit.msc (ie. Local Group Policy Editor) and (if not all) How-To Guides on the Internet, all call refer it as Block at First Sight, and hence is my suggestion to change the name to Block At First Sight.

Google "block at first seen" and you'll find very little or no information, other than docs(dot)microsoft(dot)com

 

[Andy Ful]

It's more confusing to use whatever bts parameter. Based on gpedit.msc (ie. Local Group Policy Editor) and (if not all) How-To Guides on the Internet, all call refer it as Block at First Sight, and hence is my suggestion to change the name to Block At First Sight.

Google "block at first seen" and you'll find very little or no information, other than docs(dot)microsoft(dot)com

I think that 'block at first seen' was the primary working name for this feature, and next, they changed it to 'block at first sight' (maybe looks better in English). I checked this also in Microsoft articles and 'block at first sight' seems to be actually the better name.

 

[Andy Ful]

I put WD at high settings, downloaded the latest build of OSArmor, and tried to open Windows File Explorer. It was super slow to display contents. What went wrong?

EDIT: Just to clarify, I did not actually install OSArmor, I just downloaded it.
I am wondering which Defender setting causes a delay in File Explorer. Is it maximum heuristics, or maximum time for cloud lookup, or what?

I have no idea. I also configured 'Defender high settings' and even installed OSArmour (default). Everything is normal. But except OSArmor, I do not use another non-Microsoft security.
.
Edit.
Please, check it after some minutes, because Windows can slow down when updating Windows Store, performing some scheduled tasks, etc.