Advanced Plus Security ErzCrz Security Config 2024

[ErzCrz]

I find myself doing what I said I wasn't planning to do and bouncing between WFC and CF which doesn't make much sense but what I seem to be doing. WFC will alert me of any new connection out CL will catch any 0-days and MD with DefenderUI is optimized. I need to go with the famous quote from @oldschool and stay safe not paranoid

P.S. Looking at Malwarebytes Browser Guard but I think that'd only make sense if I was using uBO Lite or Original untweaked.

 

[ErzCrz]

Just because I have the spare time, been comparing resource usage of CIS with CL and my current config

CIS = 64MB Ram
CL = 103MB Ram
Total = 167

vs

Microsoft Defender = 214MB Ram
DefenderUI = 17MB Ram
CL = 103MB Ram
WFC = 46MB Ram
Total = 380

About double the RAM with my current setup but not noticeable with my 16Gig Ram Laptop but useful to know what takes up what. I think if I did CIS full I'd have HIPS disabled if I'm running CL along with it. HIPS is a lot of hassle anyway. There's a lot of love and hate for Comodo and development is very slow but we'll see what's what when the 3rd Beta eventually surfaces.

Anyway, making use of my last working day off work before I officially return to work after 4 months on sick leave. Thankfully, I'm just working from home for a few weeks initially and then physically returning at some point in March.

 

[ErzCrz]

Checking MD Logs in DefenderUI and I have about a dozen of the below errors on the same day.

Time to look into it and remember what, if anything I did last Friday. DefenderUI in Recommended Settings.

Event 1 ID: 3002 - 2/17/2024 12:50:10 PM
Message: Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x80004005
Error description: Unspecified error
Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions.

 

[oldschool]

Checking MD Logs in DefenderUI and I have about a dozen of the below errors on the same day.

Time to look into it and remember what, if anything I did last Friday. DefenderUI in Recommended Settings.

Event 1 ID: 3002 - 2/17/2024 12:50:10 PM
Message: Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x80004005
Error description: Unspecified error
Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions.

Try uninstalling DefenderUI and then check MD. Personally, I find using it is unnecessary.

 

[jerzy601]

I also believe that if you have Cyber lock installed, Defender UI is unnecessary, that's my opinion.

 

[Shadowra]

I also believe that if you have Cyber lock installed, Defender UI is unnecessary, that's my opinion.

Yes and no.

DefenderUI Free lets you control Microsoft Defender with rules (as ConfigureDefender does), so you can add CyberLock on top.
DefenderUI Pro, on the other hand, does include CyberLock, so it's useless.

 

[jerzy601]

I understand that Defender UI Free controls MD.
And then Defender UI Pro is not needed, but you don't write that you have Defender Pro.

 

[ErzCrz]

I don't see a Pro version of DefenderUI though I have CyberLock installed. I'll just check through the logs when I get a minute and see if I can narrow it down.

Thanks @Shadowra @jerzy601 @oldschool and if it's DefenderUI related, opt for CD or without instead.

Was my first week back at work this week albeit working from home 4-5 hours a day so it's messed up the free schedule I was used to having while I was on sick leave for 4 months

 

[ErzCrz]

I worked it out. Was related to me trying to update my iPod Nano for podcasts and I ended up having to re-install iTunes and reconnect the iPod a number of times before it registered in the program so the error was MD trying to scan the attached device but not succeeding. I'd completely forgotten about that.

Anyway, it has prompted me to compare DefenderUI and CD which are much the same though CD doesn't require a separate running program..
Protection is similar though a few more things covered in CD in High config so I might use CD instead.

 

[ErzCrz]

After some research, sticking with DefenderUI, just works well and and the logs are easier to access.
Persevering with WFC though I miss a firewall showing active connections like CF.

Think I'll have a cat nap.

 

[ErzCrz]

Adjusted uBO Rules by removing overlap:
! Block third-party scripts and frames linking to top level domains and countries I never visit
||*$third-party,script,frame,to=~com|~info|~io|~eu|~net|~org|~uk|~ms|~gov

Added Netcraft & BD:TL extensions to Firefox and Edge. Edge used as primary but I've had to do some streaming over Firefox because of Edge handling some catchup sites banners still showing in full screen.

WFC still seems to affect network connection at times so revisiting CF but not committed to the change as of yet.

 

[ErzCrz]

Getting some network delays and lso triggers so swapped out WFC and controversially reverted to CIS .8012 and CyberLock which I know is some overkill/crossover but CL runs fine in background without issue and CIS very light on the system.
Been trying to swap over to FF as primary browser but Edge feels so much quicker at times but that might be a random occurrence.

 

[ErzCrz]

Trialling CIS Final Beta going okay. I still prefer the old UI. On testing these Firewall blocks I get, they are only consistent with the initial restart as it takes CF awhile to fully load and I'm not seeing any related firewall alerts showing with default Safe Mode setup.

Final stable being worked on. I am thinking using @Andy Ful 's Firewall Hardening might be useful for blocking LOLBin connections since Windows Firewall runs along side CF.

 

[ErzCrz]

Reverted to original config. Microsoft Defender, DefenderUI (Recommended) WFC with WFC Recommended rules kept and Windows default rules deleted.

CIS Beta went fine but this is a production machine and reverting config until CIS Stable/Update.

 

[ErzCrz]

Sticking with MD, DefenderUI and just swapped WFC for CF .8012 with CruelSister settings. There is partial overkill there but covers all the bases.

 

[ErzCrz]

Been trying to make Firefox my primary since I use Thunderbird for emails but some site stuff not working. E.g. posts elsewhere disappeared and some issues trying to purchase some things. Given that I'm using MD, it's just easier to stick with Edge.

 

[ErzCrz]

Using CIS FInal Beta with CyberLock which I am aware is overkill but no issues running both together. Edge freezes randomly so returned to Firefox as primary and then Edge for Video Streaming. AOMEI Backupper installed and now running system back up to external monthly.

 

[ErzCrz]

CIS Premium 2025 released today. Websites etc to be updated but found on this page if you scroll down a bit:
Download Free Antivirus Software | Get Complete PC Virus Protection

Spoiler: Comodo Internet Security 2025 Released

Installing and testing now.

 

[ErzCrz]

Half way through the year, just reviewing my changes for the year so far. Wow, 10 changes in 6 months when I'd planned for this to be one to stick with.

Given @Shadowra 's test of CIS 2025 it'll probably just be CF (@cruelsister tweaked) with CL & DefenderUI that I carry on with in the end. Less time to play around with setups. WFC is also a good option and not overkill but leaning more towards CF for containment.

Note to self: I don't actually need to create allow rules for firewall silent blocks after restart and ones I don't get alerts for.

Spoiler: Blocked Applications

Spoiler: Firewall Log

 

[ErzCrz]

Just experimenting with just blocking rather than virtualization while I have a spare minute. CruelSister displayed this option in early CF setup videos.