Advanced Plus Security Gandalf_The_Grey's laptop config for 2020

[Andy Ful]

Thanks Andy
This is the complete line in the log:
De beheerder heeft de toegang tot ...
\AppData\Local\Temp\7zS6ECF\FileExtractor.exe beperkt op locatie met de beleidsregel {1016bbe0-a716-428b-822e-3e544b6a3281} voor het pad C:\Users\*\AppData\Local\Temp\7z?????????\*.exe.

Your post was helpful to me.
Thanks to you I figured out how to avoid blocking software updates made via 7-Zip SFX installers. Simply, if one tries to run the executable from 7-Zip GUI, it is unpacked and executed in the temporary folder ...\AppData\Local\Temp\7zO....\ . But, when the application updates via SFX, it uses the folder ...\AppData\Local\Temp\7zS....\.
So the improved H_C rule should block only the first scenario by applying the SRP rule: ...\AppData\Local\Temp\7zO????????\*.exe

 

[Gandalf_The_Grey]

Your post was helpful to me.
Thanks to you I figured out how to avoid blocking software updates made via 7-Zip SFX installers. Simply, if one tries to run the executable from 7-Zip GUI, it is unpacked and executed in the temporary folder ...\AppData\Local\Temp\7zO....\ . But, when the application updates via SFX, it uses the folder ...\AppData\Local\Temp\7zS....\.
So the improved H_C rule should block only the first scenario by applying the SRP rule: ...\AppData\Local\Temp\7zO????????\*.exe

Great
That means there is no more block when extracting a fresh copy of HP Print and Scan Doctor in future versions of HC?
You're spoiling me

 

[LDogg]

Fantastic setup!

~LDogg

 

[Andy Ful]

Great
That means there is no more block when extracting a fresh copy of HP Print and Scan Doctor in future versions of HC?
You're spoiling me

Yes, if the blocked path was the issue. Please let me know when H_C will block any software updates.

 

[Lenny_Fox]

@Gandalf_The_Grey

I am not using Office365, so I don't know anything about Office365 ransomware protection. Does his ransomware protection works without Windows Defender (since you are using Ziggo's rebranded F-secure)?

@Andy Ful
With all the Office and Script Attack Surface Reduction rules available for Windows Defender, my guess is that Windows Defender is probably the best AV to companion Microsoft Office. What is your take on this assumption?

 

[Gandalf_The_Grey]

Yes, if the blocked path was the issue. Please let me know when H_C will block any software updates.

Of course, I will let you know

 

[Andy Ful]

...
@Andy Ful
With all the Office and Script Attack Surface Reduction rules available for Windows Defender, my guess is that Windows Defender is probably the best AV to companion Microsoft Office. What is your take on this assumption?

It is the best solution among free AVs. Some MS Office 365 subscriptions (Office 365 Enterprise E5, Office 365 Education A5, and Microsoft 365 Business) additionally include Advanced Threat Protection.

Office 365 Advanced Threat Protection service description - Service Descriptions

Microsoft Office 365 Advanced Threat Protection (ATP) is a cloud-based email filtering service that helps protect your organization against unknown malware and viruses by providing robust zero-day protection, and includes features to safeguard your organization from harmful links in real time.

docs.microsoft.com

Some paid AVs have also got dedicated protection for MS Office documents.
Most of the home users can simply tweak MS Office or use a configurator to block active content in documents, which also will provide strong protection.

 

[Gandalf_The_Grey]

@Gandalf_The_Grey

I am not using Office365, so I don't know anything about Office365 ransomware protection. Does his ransomware protection works without Windows Defender (since you are using Ziggo's rebranded F-secure)?

@Andy Ful
With all the Office and Script Attack Surface Reduction rules available for Windows Defender, my guess is that Windows Defender is probably the best AV to companion Microsoft Office. What is your take on this assumption?

This ransomware protection works without Windows Defender and is accessible through Windows Security Center:

 

[Gandalf_The_Grey]

To celebrate the comeback of @cruelsister I am using the combination of Windows Defender enhanced by @Andy Ful together with Comodo Firewall enhanced by @cruelsister
Q&A - What Browser Extensions are you using in 2020? made me install I don't care about cookies again.
By replacing Ziggo Safe Online and AdGuard with Windows defender and uBlock origin my browsing speed has improved.
Added Bitdefender TrafficLight to beef up the web protection of Edge and Windows Defender.

 

[Gandalf_The_Grey]

Controlled folder access is still a major pain in the ass... But like shown in the HUB tests done by @Solarquest necessary.

So far, I had to allow:
HP Officejet Pro 9015:
HPScan.exe
Comodo:
Autoruns.exe (not needed if you don't use that utility)
CCE.exe (not needed if you don't use that utility)
cis.exe
cmdagent.exe
Hitman Pro:
HitmanPro.exe
Windows:
svchost.exe
taskhostw.exe
WmiPrvSE.exe
TiWorker.exe

Hope I'm not punching too many holes in its protection

 

[SeriousHoax]

Windows:
svchost.exe
taskhostw.exe
WmiPrvSE.exe
TiWorker.exe

Are these really necessary? CFA never blocked anything related to these system processes on my PC.

 

[SeriousHoax]

To celebrate the comeback of @cruelsister I am using the combination of Windows Defender enhanced by @Andy Ful together with Comodo Firewall enhanced by @cruelsister
Q&A - What Browser Extensions are you using in 2020? made me install I don't care about cookies again.
By replacing Ziggo Safe Online and AdGuard with Windows defender and uBlock origin my browsing speed has improved.
Added Bitdefender TrafficLight to beef up the web protection of Edge and Windows Defender.

Now this makes me wanna try CF too I'll do a fresh install of my system when Windows 10 2004 releases on May 12 so this is a good time for me to do some experiments

 

[scorpionv]

I would wish well @Gandalf_The_Grey even if he did not use H_C.
In fact, he probably does not need it to be safe.

You shall not pass!

 

[Gandalf_The_Grey]

Are these really necessary? CFA never blocked anything related to these system processes on my PC.

I don't know, but it can be because I'm running Windows 10 2004 Release Preview now.
Will see after a clean install of Windows 10 2004 when it's officially released in May.

 

[Gandalf_The_Grey]

Now this makes me wanna try CF too I'll do a fresh install of my system when Windows 10 2004 releases on May 12 so this is a good time for me to do some experiments

Make sure you install the latest version 12.2.2.7036.
That's problem free, the one before had some nasty bugs.

 

[SeriousHoax]

12.1.0.6914

Make sure you install the latest version 12.2.2.7036.
That's problem free, the one before had some nasty bugs.

Are you using with or without HIPS?

 

[Gandalf_The_Grey]

12.1.0.6914

Are you using with or without HIPS?

Firewall Proactive
HIPS off
Auto-Containement, VirusScope and Website filtering enabled.
And please use 12.2.2.7036 and not the previous version12.1.0.6914.

 

[SeriousHoax]

Firewall Proactive
HIPS off
Auto-Containement, VirusScope and Website filtering enabled.
And please use 12.2.2.7036 and not the previous version12.1.0.6914.

Ok. Yes I'm trying version 12.2.2.7036.

 

[Back3]

I had Comodo Firewall at CS settings and Windows Defender with Configure Defender for nearly a year .A few days ago,I ditched Comodo for H_C. How do you like CF version 12.2 ? Any glitches?

 

[Gandalf_The_Grey]

I had Comodo Firewall at CS settings and Windows Defender with Configure Defender for nearly a year .A few days ago,I ditched Comodo for H_C. How do you like CF version 12.2 ? Any glitches?

I just ditched H_C for Comodo Firewall
But keep being interested in its development.

There are so many great programs to choose from...Windows Defender (with Andy's tools), Kaspersky Security Cloud Free, F-Secure Safe, Comodo Firewall, VoodooShield (and of course the complete Hard_Configurator package).

The latest version 12.2.2.7036 of Comodo Firewall works great and without any issues on my system