Advice Request How to whitelist HBit from Simple Windows Hardening ?

Please provide comments and solutions that are helpful to the author of this topic.

EascapenMatrix

Level 1
Thread author
Apr 25, 2022
40
I am unable to use HBit Uninstaller after turning on block unsigned executables on SWH , When I turn the option off it works , is there any way to use it without turning off that option .



I tried whitelisting the path of executable and even the full folder in SWH but unable to stop that issue from occurring again.

1653493838147.png
1653494359454.png
1653494606516.png
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
It is related to the option *Elevation of unsigned executables* set to Restricted. This is a non-default setting that should be used when the installed applications are digitally signed or come from Microsoft Store. If not then it is not especially convenient.

1653498150041.png


This Windows UAC feature does not support whitelisting. The blocked executable HiBitUninstaller.exe is blocked because it is unsigned and requires high privileges.
You can whitelist only blocks related to SRP and some blocks related to PowerShell. These blocks can be seen after using <View Blocked Events>.

Edit.
Whitelisting EXE files in SWH is not needed because all EXE files (and also MSI files) are already whitelisted by default. Whitelisting can make sense only for other file types. Before whitelisting it is good to use first the <View Blocked Events> (can save much time and effort).(y)
 
Last edited:

EascapenMatrix

Level 1
Thread author
Apr 25, 2022
40
It is related to the option *Elevation of unsigned executables* set to Restricted. This is a non-default setting that should be used when the installed applications are digitally signed or come from Microsoft Store. If not then it is not especially convenient.

View attachment 266936

This Windows UAC feature does not support whitelisting. The blocked executable HiBitUninstaller.exe is blocked because it is unsigned and requires high privileges.
You can whitelist only blocks related to SRP and some blocks related to PowerShell. These blocks can be seen after using <View Blocked Events>.

Edit.
Whitelisting EXE files in SWH is not needed because all EXE files (and also MSI files) are already whitelisted by default. Whitelisting can make sense only for other file types. Before whitelisting it is good to use first the <View Blocked Events> (can save much time and effort).(y)
Thanks , for the info . I hope that there is any way to whitelist for UAC . No problem !
 

Bot

AI-powered Bot
Verified
Apr 21, 2016
3,321
One option is to create a rule for HBit Uninstaller in the Blocking Rules section of Simple Windows Hardening. You can create a new rule by clicking on the "Add" button and then selecting the HBit Uninstaller executable. In the Rule Settings, you can set the action to "Allow" and then save the rule. This should whitelist HBit Uninstaller and allow it to run even with the block unsigned executables option turned on.

Alternatively, you can add the HBit Uninstaller executable to the Windows Defender whitelist. This should also allow the program to run even with the block unsigned executables option turned on. To add a program to the Windows Defender whitelist, you can follow the steps in this guide: How to exclude files and folders from Windows Defender Antivirus scans

I hope this helps! Let me know if you have any further questions.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top