Advanced Plus Security Divine_Barakah's PC Security Config

[Divine_Barakah]

Under my local user account, I created a folder called (App Data) in which I store the portable apps such as Hard Disk Sentinel.

Now when I tried to run HDS, OSArmor blocked it and adding HDS to exclusions did not fix the block.

The rule that blocked HDS was "Block processes located in suspicious folders"

And the parent process was explorer.exe

To correctly exclude HDS I had to create a manual rule in exclusions [%PROCESSNAME%: HD Sentinel.exe] [%SIGNER% Janis Mathe].

What this rule basically does is add a process to exclusions regardless of its path.

Now step by step I am building my rules and I am experimenting. I am installing my apps and J am monitoring how OSA reacts.

Now I realised that I should not use to rule to exclude an app if it is not digitally signed. The absence of %SIGNER% creates a vulnerability.

Instead, one should use the %PROCESS% followed by the app storage path to add it to exclusions.

I am using ABDownloadManager which is an open source download manager that is not digitally signed. It was blockes by OSA and I added it to exclusions using the %PROCESS% rule.

 

[Divine_Barakah]

I am using Peazip as the main archiver. Whenever I unzip a file using Peazip, it triggers a block in OSA.

When you extract and archive using Peazip, it creates a temporary working directory inside your user profile. Once it finishes processing, PeaZip attempts to quietly clean up after itself.

To wipe out those temporary folders, PeaZip spawns a native Windows command string:

cmd /c rmdir "C:\Users\USER\AppData\Local\Temp\peazip-tmp\.pztmp\" /s /q

 

[Divine_Barakah]

Ditched Floorp and Zen Browser and installed Waterfox. Neither Floorp nor Zen offer mobile apps, but Waterfox does.

In my opinion, Waterfox is the most stable, highly-maintained Firefox fork out there.

 

[Divine_Barakah]

Updated list of installed Applications:

***Security***
- Webroot Internet Security Plus
- OSA Personal
- Cryptomator
- Adguard VPN

***Productivity***
- Microsoft Office 2024 Standard LAST
- Betterbird
- Onlyoffice
- Swifdoo PDF
- Wondershare PDFelement 11
- ABDownloadManager
- Xyplorer
- Cyberduck
- Koofr

***Browsers***
- Vivaldi
- Helium
- Waterfox

***System Maintenance***
- Bleachbit
- Hard Disk Sentinel Pro Portable
- Smarty Uninstaller
- Patch My PC
- AOMEI Backupper

***Password Managers***
- Password Boss
- Enpass Pro

***Other Tools***
- Musicbee
- Peazip

***Extensions***
- Webroot Web Shield
- Password Boss

 

[Divine_Barakah]

Been watching the WRData folder closely and its size grew to 700 MB. I opened the WRlog.log and found the culprit. The PDFEngine.exe process (part of Swifdoo PDF) was monitored by Webroot. I changed the process status from monitored to allowed and everything is running as intended now.

 

[Szellem]

x-change is the best pdf app hands down

Sorry, but which app is this? Can you provide a link?

 

[Khushal]

Sorry, but which app is this? Can you provide a link?

PDF-XChange Co Ltd :: Downloads for PDF-XChange Editor

This page contains a list of download options for the PDF-XChange products

www.pdf-xchange.com

 

[Szellem]

PDF-XChange Co Ltd :: Downloads for PDF-XChange Editor

This page contains a list of download options for the PDF-XChange products

www.pdf-xchange.com

Thank you very much.

 

[Divine_Barakah]

Removed the extension of Password Boss after reading the following link.

Now I manually copy and paste my credentials from within Enpass Desktop app

DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft

DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft | Read more hacking news on The Hacker News cybersecurity news website and learn how to protect against cyberattacks and software vulnerabilities.

thehackernews.com

 

[Parkinsond]

Whenever I unzip a file using Peazip, it triggers a block in OSA.

Peazip installer and even after installation, get flagged and blocked by MD; I suspect the built-in scripts for extra tasks such as secure deletion.

 

[Divine_Barakah]

Peazip installer and even after installation, get flagged and blocked by MD; I suspect the built-in scripts for extra tasks such as secure deletion.

No that's not the case. MD blocks newer versions of Peazip because of the absence of a digital signature. It even warns you when you download the installer.

 

[Parkinsond]

No that's not the case. MD blocks newer versions of Peazip because of the absence of a digital signature. It even warns you when you download the installer.

It get blocked after being released by more than two weeks!
7zip get whitelisted after few days.

 

[Divine_Barakah]

It get blocked after being released by more than two weeks!
7zip get whitelisted after few days.

You can report the FP to MS and they will remove the detection but it will come back when a new version of Peazip is released.

 

[Parkinsond]

You can report the FP to MS and they will remove the detection but it will come back when a new version of Peazip is released.

I choose the easier way; 7zip can do the same task.

 

[Divine_Barakah]

I choose the easier way; 7zip can do the same task.

That's what I used to do. I believe Leo from TPCSC talked about this.


Edit:

TPCSC on Peazip

 

[Divine_Barakah]

It seems my current config does not cause any major conflicts or issues. Updated windows successfully without any issues. I also installed 15 driver updates in Dell Command update without any issues.

 

[Divine_Barakah]

One more update:

It seems OSA does not rely on digital signature only to verify if the app should be trusted or not. I have just installed MusicBee and it is not digitally signed, but OSA allowed the installation without interruptions.

 

[SHvFl]

OSA can provide different degrees of security based on your settings. Go through the setting and trusted vendors and decide on your balance of usability and security.

 

[Divine_Barakah]

OSA can provide different degrees of security based on your settings. Go through the setting and trusted vendors and decide on your balance of usability and security.

Yes I indeed did enable many rules. Over the last day I have been experimenting with rules and I believe I managed to achieve the perfect balance between securrity and usability.

 

[Dave Russo]

Yes I indeed did enable many rules. Over the last day I have been experimenting with rules and I believe I managed to achieve the perfect balance between securrity and usability.

Any chance you can share your list? If not public maybe message me?