Experience the Engineering and Function in Qihoo 360 Total Security

[AtlBo]

For those who are adventurous and would like a really fascinating experience working with Qihoo 360 in a nirvana experience of adlessness, I would like to explain ways to bring the program to its essential life. It's really a very good application at its heart, so this journey has been worth the effort for me. Not much in this for explaining the tools or settings. There is some mention and explanation, but this is mostly simply about actually seeing the program to be able to evaluate what it can do. That in mind, I present the scenario goal:

Run Qihoo 360 Total Security in limited rights account with no ads and no unwanted pop ups. Also, to make it possible to use 360 TS in the limited rights account, without the annoyance of any unannouced UAC pop ups from the main application GUI attempting to open itself to suggest a scan. This said, in order to run Qihoo 360 TS in a limited rights account yet have access to settings from inside the account, some accomodations must be made. These tweaks are to go along with the other tweaks recommended below for eliminating ads and improving program functionality. The resulting usability of the program, once Bitdefender and Avira engines are enabled, makes it possible to understand what a GOOD program 360 TS actually is where the security engineering is concerned.

List of tweaks:

Standard process block
1. Promoutil.exe
2. MedalWall.exe
3. cefUtil.exe (among other blocks, blocks population of Daily news pop up but not the pop up)
4. CleanHelper64.exe (blocks process from running constantly and asking if you would like to clean PC)

Program settings block
1. Program main->three bars top right->Settings->General->scroll down and uncheck Daily News if you like (Blocking cefutil.exe will block the internet connection anyway)
2. Scroll a little further to block User Experience Improvement Program (if desired)

Program settings enable (Important)
1. Turn on Bitdefender and Avira signature engines->Settings->Virus Scan->scroll down and choose to install each

Virus Scan menu enable (Important)
2. Enable Bitfender and Avira signature engines->Main Menu->Virus Scan->Bottom left hover over barely visible icons for each engine and look for the switch to activate to appear. Set each to on.

Set the following to "Run as Adminstrator" for all users in the 360 program folder (Program Files (x86)\360) to have full access to the settings and functionality of 360 TS in a limited rights account
Main Folder
1. QHSafeMain.exe
2. QHSafeScanner.exe
3. PatchUp.exe (Optional if you like the Patchup feature and would like to keep it enabled in the settings. You may need to also answer a UAC prompt for this to pop up during boot)

Use HIPs of some program to block the following (NVT Exe Radar Pro v4 may do this with a manual rule not sure)
1. Block QHWatchdog.exe from starting an executable (If using Comodo HIPs->custom rule->set "Run an executable" to ask. All the rest can be allows).

Generally, I allow 360 complete access to the system. I have all the processes set to allow, except the ones above. If you run into any issues like you still get the UAC prompt sometimes even with the QHWatchdog.exe HIPs block (or any other hassle), please let me know. I will be happy to get to the bottom of things with you. These are working for me for now.

I may have left some tweaks out. Been working with 360 Total Security for over 5 years now, so I'm not sure. If I notice something I will post it here. Also, if anyone else notices anything, please post it here or in another thread (Thx).

As can be seen in pics below, This is a beautiful program, once it's possible to get beyond the things that have attached themselves to the application. If you would like an effective (good) scanner with good real time defense and with a very useful sandbox, take a look at 360 Total Security this way. It's amazingly flexible, and the settings hit the spot for me.

In these pics, I chose the first free theme. It's the one I like the best. You can Google to see the default if you like, but this one is easier to see, which is what I was attempting to achieve. I use kind of high gamma for videos. Showed the sandbox set up to auto sandbox Microsoft Office applications to present its usefulness in that regard.

Happy viewing and please let me know what you think about the 360 experience...

 

[Rengar]

This should be pinned. Really nice job!

 

[jacemace]

Hi, need more info on these settings - I use qihoo and comodo.
What does blocking QHWatchdog.exe from starting an executable accomplish in descript terms?
In qihoo settings under active protection - system; should I monitor all files or executables and documents only?
How do you get bitdefender and avira definitions to update daily? Does it happen automatically? Are there offline updates?
Can I manually update bitdefender and avira definitions by clicking somewhere in qihoo settings?
Thanks for the info - any other tips appreciated.

 

[erreale]

It seems to me that was not said/written...
I would recommend setting the level of protection mode on "Security"

 

[AtlBo]

Hi, need more info on these settings - I use qihoo and comodo.
What does blocking QHWatchdog.exe from starting an executable accomplish in descript terms?
In qihoo settings under active protection - system; should I monitor all files or executables and documents only?
How do you get bitdefender and avira definitions to update daily? Does it happen automatically? Are there offline updates?
Can I manually update bitdefender and avira definitions by clicking somewhere in qihoo settings?
Thanks for the info - any other tips appreciated.

Good questions so I'll number the answers I have. These are to the best of my knowledge:

What does blocking QHWatchdog.exe from starting an executable accomplish in descript terms?

1. I'm still experimenting with this on 2 systems. The GUI wants to open with each boot if no full check has been performed for a while. So I thought maybe QHWatchdog.exe was attempting to start the GUI which is I believe part of QHSafeMain.exe. QHSM closes with the GUI, so I believe that part is correct. However, it could also be QHActiveDefense.exe or QHSafeTray.exe monitoring to see when the scan is out of date. On one testing system things seem to be fine so far after setting up one HIPs rule for QHWatchdog.exe to "Ask" if it wan'ts to start anything. No alerts from Comodo is the only thing, so idk. I'll update if anything new comes my way regarding this situation.

BTW, opening the GUI will bring 2 UAC prompts. I believe these are for QHSafeScanner.exe and QHSafeMain.exe. Enabling "run as administrator" for the processes (all users) will not stop this, but when the GUI opens, you will have access to all the elements, including the scanner and all settings and the Quarantine etc. I FORGOT to add that 360boxmain.exe should also be added to the list of processes to "run as admin...". This is to be able to use the application dialog and settings from the main GUI. You may run into others. Post here if you do, and I'll try to hunt down the process.

All the processes can be found with a quick search in the 360 folder no problem.

In qihoo settings under active protection - system; should I monitor all files or executables and documents only?

2. Five years with QH and I have been so busy I honestly can't tell you on this one. I know that Qihoo runs a quick scan every about 20 minutes from looking at Bouncer logs. So I am guessing that a longer scan might be added from time to time to those. Also, you will probably get longer scan times from normal scans, right click scans, and also from any scheduled scans that might run. Up to you. I am not huge on scans, just respect them, so I am scanning only executables and documents for now. I could change on this one if I had time to look over what happens in Bouncer or whatever. Sorry I don't know the whole story here on what is best.

How do you get bitdefender and avira definitions to update daily? Does it happen automatically? Are there offline updates?

3. Short on this one. I don't. Avira doesn't change very often. Bitdefender is updated fairly regularly, so at least that helps some.

It's a 96.8% scanner as things are, but the Qihoo cloud is I'm sure getting better with time. At any rate, I think QH is attempting to be in the ballpark of up to date with the Avira and BD sigs then counting on their own for the latest. Those need improvement, but there is one thing about this. It's actually a fairly smart plan I think they have. If the Avira list is soft of a hall of fame and the Bitdefender is a "recent news" blocker, then the 360 defs could fill in great with the absolute latest. But QH has to get their own sigs to a new level for this to work. Yet this is reason Ifor me to question whether it's a good bellweather to test the QH sigs apart from each other. That is if I am correct and they are paying for specific sig profiles from BD and Avira.

Can I manually update bitdefender and avira definitions by clicking somewhere in qihoo settings?

4. Don't think there is a way to do this other than to go to the bars top right->Check for updates. It will check for definitions, and I have had it download them more frequently. If you have task manager open so you can see all proceses (system space too), you might be able to see what process carries out the update routine. if it is separate from the GUI process, it should appear as QH... or 360... Actually, I just checked, and it looks like it is 360TsLiveUpd.exe it's here:

C:\Program Files (x86)\360\Total Security

Might want to create a shortcut for it and see what happens or run that on a schedule in Task Scheduler. Probably will also need to set the process "Run as admin..." and then set the task to run with highest privileges too. Funny, don't know it might start the BUI with its UAC prompts, so...

Hope this at least helps some...

 

[AtlBo]

It seems to me that was not said/written...
I would recommend setting the level of protection mode on "Security"

Nice one. Haven't tried this yet. I have been running Custom for so long I never noticed. I wonder what that does...

Oh, btw, another one to block is DriverUpdater.exe. You know this actually looks very good seriously and a good time to be updating drivers. I even trust QH with them. However, it's a fairly relentless prompt in an l/r account, so I prefer to straight block it for now. Not going to use it anyway. However, it is in the tools, so I suppose I could arrange to launch it that way if necessary. Thing is all these PCs are HPs, and they are really good with drivers...

 

[AtlBo]

The short of this thread is use Qihoo 360 Essentials. It has the sandbox and only a few of the hassles. This is what I have gone to and Bitdefender and Avira are still present along with all the BB monitoring...

 

[stolikat]

You just have to live with the fact that your PC will most likely be wide open to backdoors that the Chinese government most likely will have installed in that software. I will never use Chinese based software. No thanks.

 

[AtlBo]

This may be a valid point, but I feel safer allowing the Chinese to have access to information than anyone in the west.

Seriously, thanks for the comment. The only thing I could say is that 360 Security Essentials is not remotely similar to 360 Total Security. For me, it's a huge step up security-wise. I guess 95% of the junk is gone, although I still have to set some processes to run as Admininstrator in SUA and still have to block some processes. I would love to take a hard line, but I don't see how at this point...

 

[stolikat]

Frankly I would love to use it. I just can't get passed the fact that at some point the Chinese government may use my computer in some sort of cyber attack.

 

[AtlBo]

Yes, I can hear what you are saying. No easy answer, and I believe only international cooperation will be required at high levels of a large number of governments for user data to be guaranteed secure. Facebook is just the tiniest bit of this challenge.

Qihoo's privacy policy is simple and straightforward, but I guess at this point only Qihoo knows what is collected and then for what purpose.

 

[brambedkar59]

The short of this thread is use Qihoo 360 Essentials. It has the sandbox and only a few of the hassles. This is what I have gone to and Bitdefender and Avira are still present along with all the BB monitoring...

Last year I was wondering about whether to use 360TS or 360TSE. Then I found this on the YT channel of Cruelsister.
Read the comments below the YT video by "Kuldeep".

Reply by CruelSister:
"K- it actually surprised me, but if you google "Qihoo 360 changelog" (which can be seen here: https://www.360totalsecurity.com/en/version/360-total-security/ ) Switch between Total Security and Security Essentials and you can see that TS is updated much more frequently that SE, plus the main engine for SE is still version 8 versus version 9 for TS. It seems that the difference here is in mechanistic detection; please compare the results from this video with the companion video here: YouTube Personally I would prefer Qihoo TS if that was my main defense if only for the really nice Startup Manager (the Seed Up function is also cool, and the user can shut it off and put it back on easily). I consider having one of these on every system (I use WinPatrol myself)"


Kuldeep:
Just got official reply from Qihoo customer support and I quote "In terms of protection, TSE and TS is the same if you're using the same version. E.G. 8.8TS v.s. 8.8TSE. => Same"

So yes there is some difference in both of the products in terms of protection as well, but is it worth the hassle of dealing with bloatware/ads included in 360TS? I don't know.

 

[AtlBo]

True and a good point. Development has apparently stalled for QSE. I guess the biggest difference would be in the BB (system guard).

I installed, QSE, because I can't handle the relentless nature of 360 TS after 5 years now. My hope at this point is that Qihoo will go back to QSE and add the meaningful improvements. If not, I admit, I will be stuck and I guess headed over to avast most likely.

BTW, I am getting definitions updates every day...basically once a day which I think is kind of in line with what I was used to from 360 TS. 360's sigs aren't really the zero day stoppers, although the company does seem to participate in the world-wide alerts and I suppose roll out emergency updates from time to time. Not sure, but they do find ways to keep users up to date with the latest security threats who are willing to search out their latest blog posts. Maybe they release emergency updates too.

 

[jacemace]

@AtlBo


Hey, thanks for the detailed reply in post 5 - and the continuing posts.

and I agree the chinse are spying with this - it was just said in the news - pick your spy - I would prefer none - incidentally I am just now using a program I downloaded called destroy windows spying - to block miscrosoft from spying on my computer - it blocks lots of hosts and does other things. I may uninstall qihoo 360 as I have been using umbra's first settings of Appguard NVT OSA ReHIP- even before reading about the set ups umbra posted - plus I have spyshelter and comodo, and use eek and hmp - I may also try hmpa, but it was hard on my computer - that was an older version - I also use adguard. As has been said, real time antivirus scanners are reactive - they react to malware already there - yes they can do some blocking - from a download or something.

 

[Sunshine-boy]

backdoors

Where's your proof?
They have a privacy!I for one trust them more than any USA tech companies.
You just need to disable the web filtering so China won't know which website you visit+disbale user experience improvement program.
360 is the Lightest AV out there!
Avira browser extension is a good extension to have if someone wants to use 360.

 

[Moonhorse]

Avira browser extension is a good extension to have if someone wants to use 360.

Why avira? Seems 360 have their own browser and extensions aswell

 

[Mahesh Sudula]

Why avira? Seems 360 have their own browser and extensions aswell

360 is not that good at anti phishing..it improved a bit though and have its own problems as well
Avira is good to combine with 360
360 gets delayed Avira signs may be once/rarely twice a day..That may keep the pc at risk if there are no 3rd party extensions
Fact of 360 : Their Cloud engine is superb...Always among the top 5 to pick up zero days

 

[stefanos]

360 is not that good at anti phishing..it improved a bit though and have its own problems as well
Avira is good to combine with 360
360 gets delayed Avira signs may be once/rarely twice a day..That may keep the pc at risk if there are no 3rd party extensions
Fact of 360 : Their Cloud engine is superb...Always among the top 5 to pick up zero days

That is right . It has 3 days that I uninstalled the 360 to test Kaspersky. The Cloud signatures are one of the best in the past three months when the kihoo upgraded the product. It's very light. Avira and Bitdefender signatures do not delay as old. The last month only Bitdefender one two times the month at weekend. But anti phishing protection is zero. I conbine it with malwarebytes or avira at Opera and with google because is more secure i used windows defender extesion

 

[stefanos]

Why avira? Seems 360 have their own browser and extensions aswell

Qihoo browser is only for china users. And is better to stay away from this browser. 360 extesion is good only for secure payment, banking and etc

 

[imuade]

I've just installed 360 Total Security Essential and I have found out this:

It looks like, even if 360TSE is on v.8.8.0.1096, some modules are on v.9 or even v.10... so, probably the different version compared with 360TS is just for a marketing purpose