Advanced Plus Security Gandalf_The_Grey's Security Config 2021

[Andy Ful]

* @Andy Ful I have seen you posting about SWH and CD protecting against some in the wild malware. Is above statement still valid (MD with your tools is top notch protection on typical M$ setup)?

Yes, if by the "top notch protection" one understands the support for the AV and SmartScreen to block all threats in the Advanced Threat Protection Test made by AV-Comparatives Lab. Of course, I assume that these threats are reused in the widespread attacks on home users.

The term "top notch protection" is rather relative. SWH + H_C hardening tools is an optimal Windows 10 built-in setup for home users, if one considers both usability and protection. This setup was not found out by me - this was the collective work of several MT members.
If one likes even stronger protection for some reason, then the second optimal would be H_C in the Recommended Settings and several predefined setting profiles (depending on the required security level).

SWH + H_C hardening tools are secure, because the average user cannot simply click the alert (that he/she do not understand) and infect the system. The cons are that the person who is a "home administrator" has more work and has to listen to some complaints when something has been blocked.

 

[ForgottenSeer 92963]

Yes, if by the "top notch protection" one understands the support for the AV and SmartScreen to block all threats in the Advanced Threat Protection Test made by AV-Comparatives Lab. Of course, I assume that these threats are reused in the widespread attacks on home users.

Yes, but more specifically I referred to the ASR rules MD has specially for Office Programs, scripts and browser. On top of that when people are using MD as AV, they can add Code Integrity Guard to the mix*. Defender free AV with Configure Defender, Documents Anti-exploit, Simple Windows Hardening and Firewall Hardening should be top-notch.

* Ever considered adding Code Integrity Guard for Office and Edge to Configure Defender?

 

[Andy Ful]

Yes, but more specifically I referred to the ASR rules MD has specially for Office Programs, scripts and browser. On top of that when people are using MD as AV, they can add Code Integrity Guard to the mix*. Defender free AV with Configure Defender, Documents Anti-exploit, Simple Windows Hardening and Firewall Hardening should be top-notch.

* Ever considered adding Code Integrity Guard for Office and Edge to Configure Defender?

https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/post-964760

 

[ForgottenSeer 92963]

https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/post-964760

Okay answered you in that thread.

 

[Gandalf_The_Grey]

Testing/running DefenderUI Free with the latest VoodooShield beta.
More info:

New Update - VoodooShield CyberLock 7.0

Hey Guys, Here is the first VoodooShield 7.0 beta. The new Contextual Engine is almost 100% complete, but there will be a few blocks, so please let me know if you experience any unwanted blocks. Overall you should see a significant reduction in blocks, but I am certain that I am missing a few...

malwaretips.com

 

[ForgottenSeer 92963]

Don't want to upset your security config, but ... VS got the new engine which works with any AV, so why fallback to Defender when you also like Ziggo (rebranded F-Secure) and Kaspersky?

 

[Gandalf_The_Grey]

Don't want to upset your security config, but ... VS got the new engine which works with any AV, so why fallback to Defender when you also like Ziggo (rebranded F-Secure) and Kaspersky?

It's your fault, you got me thinking about the ASR rules...
Still liking F-Secure and Kaspersky... maybe some time I will switch again and again

 

[Gandalf_The_Grey]

It's your fault, you got me thinking about the ASR rules...
Still liking F-Secure and Kaspersky... maybe some time I will switch again and again

@Kees1958 Did you try Ziggo Safe Online recently?
My laptop feels much more responsive and even boots faster with it.

Tried the latest AdGuard beta extension, but with uBlock Origin browsing is still faster and the ads and trackers get blocked by both extensions.

Depending on the needs and skills of the family member I'm using a passive (Simple Windows Hardening) or active (VoodooShield) config.
All configs have KPN Veilig or Ziggo Safe Online by F-Secure as antivirus and uBlock Origin as adblocker in Microsoft Edge or Google Chrome.

 

[ForgottenSeer 92963]

@Gandalf_The_Grey

No I have not. Are you returning the favour to tempt me into trying another setup

 

[Gandalf_The_Grey]

@Gandalf_The_Grey

No I have not. Are you returning the favour to tempt me into trying another setup

Doing my best

 

[Gandalf_The_Grey]

Was a bit disappointed that I must wait again before Ziggo updates Ziggo Safe Online to the latest F-Secure Safe release 18.2 and bored with the prompts from VoodooShield so I decided to go back to windows built-in security enhanced with the tools of Andy Ful.

Being spoilt with the little performance impact of Ziggo safe Online by F-Secure I decided to optimize my system with programs I already used or had a license from:

I used O&O ShutUp10++ and O&O AppBuster to optimize Windows privacy and uninstall apps that i don't use or need.

Samsung Magician 7.0.1 now has a Full Performance Mode:


Installed Bitsum Process Lasso Pro with ProBalance enabled:

ProBalance Optimization Algorithm

Betanews on ProBalance: Process Lasso’s headline technology is ProBalance, a smart tool which monitors running processes and intelligently adjusts the priority of resource hogs as they appear.…

bitsum.com

 

[Kongo]

Was a bit disappointed that I must wait again before Ziggo updates Ziggo Safe Online to the latest F-Secure Safe release 18.2 and bored with the prompts from VoodooShield so I decided to go back to windows built-in security enhanced with the tools of Andy Ful.

Being spoilt with the little performance impact of Ziggo safe Online by F-Secure I decided to optimize my system with programs I already used or had a license from:

I used O&O ShutUp10++ and O&O AppBuster to optimize Windows privacy and uninstall apps that i don't use or need.

Samsung Magician 7.0.1 now has a Full Performance Mode:
View attachment 263033

Installed Bitsum Process Lasso Pro with ProBalance enabled:

ProBalance Optimization Algorithm

Betanews on ProBalance: Process Lasso’s headline technology is ProBalance, a smart tool which monitors running processes and intelligently adjusts the priority of resource hogs as they appear.…

bitsum.com

I am soon upgrading to a Samsung 980 and didn't know about Samsung Magician. Do you have Full Performance Mode enabled all the time or is it not recommendable for SSD health?

 

[Gandalf_The_Grey]

I am soon upgrading to a Samsung 980 and didn't know about Samsung Magician. Do you have Full Performance Mode enabled all the time or is it not recommendable for SSD health?

I have Full Performance Mode enabled all of time.
Because it used DRAM as cache it (called RAPID mode) it is probably better for SSD health.

More on RAPID mode (part of the Full Performance Mode) here:

Samsung's Rapid Mode Is Underrated but You Should Use It

RAPID mode is paired exclusively with Samsung 840 EVO (Aug '13 or newer) SSDs and available as a feature of the accompanying Samsung SSD Magician Software Toolset (version 4.2 and later). RAPID mode analyzes all system traffic, leveraging extra system resources such as DRAM/CPU to dynamically...

www.pugetsystems.com

And I followed TweakHound's advice here:

Tips:
– It is not necessary to have Magician running in the system tray. Right-click on the tray icon and remove from startup.
– It is not necessary to have the SamsungMagicianSVC service running all the time. Set it to Manual:
press the Windows + S key > type services > scroll down to SamsungMagicianSVC and double-click it > change it to Manual (optionally stop it too) > click Apply
– I typically check for updates via Magician every month or so, or when it comes to mind.
– Simply running Magician will let you know if there are updates.
– Standard warning: Firmware updates can go wrong…blah, blah, backup, blah blah. In all these years I’ve never had BIOS or firmware updates go wrong and I’ve done too many to count. RTFM

I only keep the Samsung RAPID Mode Service at automatic.

Updating Firmware on Samsung SSDs - TweakHound

Optimize your computing experience, Performance, Tweak, Tweaker, Tweaking Windows, Tweak Guides, Tweakguides, Privacy, Security, Computer How-to, fix computer, Computer news and information, Windows Xp, Windows 7, Windows 10, Linux

www.tweakhound.com

 

[Kongo]

I have Full Performance Mode enabled all of time.
Because it used DRAM as cache it (called RAPID mode) it is probably better for SSD health.

More on RAPID mode (part of the Full Performance Mode) here:

Samsung's Rapid Mode Is Underrated but You Should Use It

RAPID mode is paired exclusively with Samsung 840 EVO (Aug '13 or newer) SSDs and available as a feature of the accompanying Samsung SSD Magician Software Toolset (version 4.2 and later). RAPID mode analyzes all system traffic, leveraging extra system resources such as DRAM/CPU to dynamically...

www.pugetsystems.com

And I followed TweakHound's advice here:

I only keep the Samsung RAPID Mode Service at automatic.

Updating Firmware on Samsung SSDs - TweakHound

Optimize your computing experience, Performance, Tweak, Tweaker, Tweaking Windows, Tweak Guides, Tweakguides, Privacy, Security, Computer How-to, fix computer, Computer news and information, Windows Xp, Windows 7, Windows 10, Linux

www.tweakhound.com

Thanks a lot

 

[Gandalf_The_Grey]

The only two non-Microsoft Services I have running are:
Process Lasso Core (Process Governor)
Samsung RAPID Mode Service

 

[Sorrento]

Don't have rapid mode available as Gandalf? Dire warnings to enable full performance mode? 980 Pro running @ PCIe 4.x4 - Latest magician

 

[ItsReallyMe]

Are you using ProcessLasso ProBlanace? Is there any noticeable difference when you use it?

 

[Kongo]

Don't have rapid mode available as Gandalf? Dire warnings to enable full performance mode? 980 Pro running @ PCIe 4.x4 - Latest magician

Maybe its not available on Laptops if you are using one. Just a guess tho.

 

[Sorrento]

No it's a Ryzen 5600X Desk, anyway..

 

[Gandalf_The_Grey]

RAPID is working fine on my laptop with an 850 EVO M.2 SATA SSD on Windows 11.
No idea why it doesn't work for you @Sorrento ...
Do you have the latest version 7.0.1 ?
Perhaps an incompatibility with AMD Ryzen?

@ItsReallyMe Process Lasso ProBalance makes my old laptop running great again.
No more issues with freezes in Excel or icons not or very delayed showing in Explorer with Microsoft Defender Antivirus.
IMO it is a program not really needed on powerful hardware, but it sure helps on an Acer laptop from 2015.

For me, the combination of Samsung Magician Full Performance Mode and Process Lasso ProBalance works great