Advanced Plus Security ErzCrz Security Config 2024

[ErzCrz]

Its fine to try out different setups/configs, i do that often myself too

I meant to be referring on cruelsisters video where its easier to disable windows firewall by malware than comodo firewall, so i rather use comodo firewall over windows firewall if possible...but cf+cl+dui is maybe too much for someone ( if it works for you thats okay to keep it then )

Thanks. Although overkill CF with CL and DUI works fine together without issue. I was experimenting with full CIS but I'd rather have MD's detection alongside CF's containment. CL's really good and prevented Andy's test of disabling AV services cmd /dll bypass.

 

[ErzCrz]

No update at the moment, just been bouncing between CFW .8012 and WFC since Comodo certificate issue will take a further 1-2 weeks until the new installers come out. I have been looking around a bit at AVs all seems to be around the £30-39 rate with Emsisoft and Malwrebytes in the lower of that bracket but with CyberLock running and accompanied by DefenderUI there's no point moving to a different AV from MD. Reading some more into optimizing/hardening windows firewall (I can use @Andy Ful 's WFH of course) though with WFC not detecting those rules I might have to manually add them to WFC rules as WFC can override those.

 

[ErzCrz]

I decided today to renew Emsisoft Anti-Malware Home which served me well last year. It was just £30 which is right in my price range. I did debate about Emisoft but it's £15 more per year for the Premium and £5 more for the basic Eset protection. Emsisoft runs well and does what it does without hassle. Also controls WF and CyberLock is my backup 0-day which also creates WF rules for blocked files.

Emsisoft uses between 600 and 800mb RAM with memory optimization disabled. With my 16-gig ram and i5-12500H chip running a full screen game, 12 edge tabs open and Thunderbird in the background I still have 5-6 gig ram free and CPU only at around 35% so it's not affecting performance.

Anyway, thought it was time for a change and if I get super paranoid I can add CF .8012 again at some point though waiting on this certificate resolution is getting a bit long in the tooth.

Part of the reason not relying on MD is that I have Win 11 Home, I don't have Pro and don't have office 365 so I miss out on added protection from those and I'd rather pay the £30 to Emsisoft rather than £80+ to Microsoft for office and extra features.

Oh and I turn 50 this coming Monday so that's a thing

 

[oldschool]

Part of the reason not relying on MD is that I have Win 11 Home, I don't have Pro ... so I miss out on added protection

What added protection is that? All Defender advanced settings are still available, etc.

 

[ErzCrz]

What added protection is that? All Defender advanced settings are still available, etc.

I think it's things like ATP and Sandboxing but maybe that's all changed these days. I expect ConfigureDefender and this hardening programs cover those. I was just fancying a change. Emsisoft is constantly updated and hassle free which I'd had last year after winning a subscription so went with it again. I know MD is sufficient and CyberLock will catch what's missed whatever is use, just what I decided to go with for now.

 

[Pat MacKnife]

ATP latest

https://www.av-test.org/fileadmin/_...auertest_Privat_Endergebnis_EN_3acfa68d86.jpg

ATP endurance test: 31 security products for 6 months in the advanced Windows 10 test

Security products for consumer users and corporate users are faced with a formidable task. They have to protect systems around the clock and deal with the latest threats. Sometimes the products detect the attackers immediately – but sometimes only in a further defensive step. This is precisely...

www.av-test.org

 

[ErzCrz]

ATP latest

https://www.av-test.org/fileadmin/_...auertest_Privat_Endergebnis_EN_3acfa68d86.jpg

ATP endurance test: 31 security products for 6 months in the advanced Windows 10 test

Security products for consumer users and corporate users are faced with a formidable task. They have to protect systems around the clock and deal with the latest threats. Sometimes the products detect the attackers immediately – but sometimes only in a further defensive step. This is precisely...

www.av-test.org

@oldschool Thanks. I was too hasty in getting Emsisoft having slept on it so cancelled and got full refund. Time to just review my setup

 

[ErzCrz]

Back to the configuration I had at the start of the year, MD (DefenderUI), CyberLock, WFC. Got refunded for Emsisoft it's good but updates brought system to a crawl. I was debating between DefenderUI and ConfigureDefender but I'm using CL so the former made sense. Open to suggestion though. CF .8012 runs okay though not perfect and with certificate issue ongoing for 3 weeks now, I'm just holding off until that gets fixed before considering that again.

Oh and it's my 50th Birthday today

 

[ErzCrz]

Removed DefenderUI to test out an issue where laptop camera not detected. A hard reset resolved it but a strange anomoly and not sure if related to DefenderUI or not. Anyway, taken it off for now and see if it's something else causing it. Also reset CyberLock Whitelist which was over 900 files. I should schedule some reminder or it might be cool to have the option in CL to reset every so many days. @danb

I've also taken WFC also off temporarily while I update to 24H2. Feel like stripping things back and maybe just adding @Andy Ful 's FirewallHardening and ConfigureDefender.

We'll see how 24H2 install goes and then see.

 

[ErzCrz]

Update went smoothly. I ended up uninstalling CyberLock before update finished for smooth of process. Re-installed now that update completed

Camera issue isn't DefenderUI related. Not really sure what the cause is, just have to do a hard reboot when not detected.

 

[ErzCrz]

The camera issue I did have hasn't resurfaced.

Tested out updated CIS 2025 which work smoothly though not committed to it consistently. I'd love to find a workaround for the currently discussed issues here but hardening windows along side CiS/CF is overkill. CL does block that cmd script test when I tested with a similar style test AntivirusDefender10 but probably something for Comodo to fix as and when that happens. Still keeping an eye out for real world examples of malware abusing lolbins in this way but I'm sure some actual testers will have far more of a clue than I do. I do think the solution is windows hardening or CL in the interim.

Firefox and Edge keeps being swapped out as primary. Firefox just faster at times and I like that I can still use uBO

Currently, just staying with pinned post setup for the moment though CD runs fine with CL, you just have to allow the cmd script and CL will eventually remember the allow. WFH does work with CL but in the case of WFC, it's not picked up so I'll be manually adding those at some point, even if to save them as a file which I'll upload here once done.

 

[Gandalf_The_Grey]

Please correct your operating system.
Due to a forum issue Windows 11 disappeared and was replaced by macOS 15 Sequoia.
But now Windows 11 is back on the dropdown list.

 

[ErzCrz]

Please correct your operating system.
Due to a forum issue Windows 11 disappeared and was replaced by macOS 15 Sequoia.
But now Windows 11 is back on the dropdown list.

Thanks. I hadn't spotted that. Fixed now

 

[ErzCrz]

Okay, was a little tedious but manually added the WindowsFirewallHardening list to WFC. I had to go into each folder and select them and with Shell Integration enabled, right clicked what I had of them and blocked. I might put the saved rule file somewhere for people who want it but just as easy to do it yourself if you have the spare time.

 

[ErzCrz]

Just a small update to WFC, Added AndyFul's WFH recommended rules and Enabled Documents Anti-Exploit Tool

WFC - Medium Filtering, Notifications Enabled. (Manually added FWH Rules as WFC can overwrite FirewallHardening Tool implemented rules
FirewallHardening Tool - Recommended H_C Rules
Documents_Anti-Exploit Tool - ON/ON2/ON/ON

Do do continue to bounce somewhat between setups experimenting with CIS or CF. As we're in the latter part of the year not sure if much will change with the coming year. I have a further year of CL already which I enjoy using so we'll see what layers with that are to come. I kind of like the ideal of CL / DefenderUI and CF though overkill Comodo will probably always feature in my setup in some form now and then.
WFC has caused some net lag from time to time but not consistently so still identifying if the issue. there are other firewalls and even CF has been popping back into the picture and I can still have the WFH rules that work and no issue with anti-exploit addition. Another possibility is just using Windows Firewall as WFH covers LOLbins and CL is set to create block rules for Unsafe files.

Anyway, enough rambling. Was just doing a minor tweak this week.
*Edits just to tweak wording*

 

[ErzCrz]

Since I was goign down the FWH, Documents AntiExploit and even CD over DefenderUI, I'm trialing H_C, CD, FWH with CL even though there's a H_C overlap with CL and putting Defenderui and WFC on the back burner for this test. So far, quick and smooth without issue. Just fancied trying it out to check for any conflicts while I was in between other things today. Hard to find the perfect solution and no solution is 100%.

EDIT: It is overkill and I should just pick H_C or CL if I'm using this setup rather than CIS or paid product like Emsisoft.

 

[ErzCrz]

Swapped out DefenderUI for ConfigureDefender and dropped WFC possibly just temporarily but with CL creating Firewall rules for unsafe files and FWH blocking LOLBins I think WFC not necessary with this setup. We'll see how it holds up but smooth and fine so far.

DefenderUI works fine, just trying out various options ahead of the year end and not sure whether WFH and Anti-Exploit is overkill with CL. Anyway, just a bit of a change.

 

[ErzCrz]

Just returned to the setup I started with this year. CyberLock works really well, DefenderUI pairs best with it, for me and WFC gives me that firewall control I need. It's still the best compromise of security and usability as well as being lightweight and very effective.

I have tested latest CIS but waiting on further development but happy to assist those who use it.