Basic Security Moonhorse's config 2018

[Moonhorse]

I don't think so. It's been around for a while. But why would you?

Ransomoff doesnt have and syshardener is just to disable scripts so im missing anti-exploit right? And do windows defender really do anything there?

I can set up OSA wich have anti-exploit section, but how is syshardener even equal to that

Windows file protection, but is that an anti-exploit at all sorry im so lost right now

Its kinda funny as it blocks process, it marks it as ransomware instead of threat or something

Question 2:
- is this an default deny? And if so how effective

 

[oldschool]

First, are you using ConfigureDefender? It's the only way I would use WD to make the most of its capabilities, in which case you don't need RansomOff. Then I would consider what you are comfortable using along side WD. I prefer Hard_Configurator as it's user-friendly in Defaul-Deny setup the way Andy has it configured. Some prefer SysHardener. MBAE will give you browser and application protection. If you wish to use OSA with SysHardener then go to those threads and seek advice on how to best combine them for your needs.

 

[Moonhorse]

First, are you using ConfigureDefender? It's the only way I would use WD to make the most of its capabilities, in which case you don't need RansomOff. Then I would consider what you are comfortable using along side WD. I prefer Hard_Configurator as it's user-friendly in Defaul-Deny setup the way Andy has it configured. Some prefer SysHardener. MBAE will give you browser and application protection. If you wish to use OSA with SysHardener then go to those threads and seek advice on how to best combine them for your needs.

I dont use configuredefender.

I have disabled everything in syshardener
I have complete lockout with ransomoff
Anti-exploit from malwarebytes
Windows defender as basic antivirus

Currently it feels its me whos dominating the computer and decide what it will run or not to. Untrusted files it will automatically block so i just add everything i need to trusted files and rest are locked

For me it seems everything is perfect for now, tomorrow maybe not...welll see

Weird thing; had to manually add chrome to MBAE

 

[Deleted Member 3a5v73x]

Weird thing; had to manually add chrome to MBAE

MBAE 1.12.1.124 has removed default Chrome shield.

Chrome decides it wants to remove MB Anti Exploit

 

[Moonhorse]

MBAE 1.12.1.124 has removed default Chrome shield.

Chrome decides it wants to remove MB Anti Exploit

This explains alot, after reboot the MBAE will reset chrome shields that you had added

 

[Moonhorse]

Update:
- removed ransomOFF ( its too complicated, bit buggy. Even in simple mode it will block most installers and its too complicated to create those rules )
- Removed MBAE (redundant)
+ added RE:hips free back ( disabled chrome isolation) + running in learning mode

So my setup is just WD+Syshardener (max) + Re:hips from now.

+ also added brave browser, since they allow extensions from chrome webstore, its probably best chrome alternative and has decent privacy protection aswell

 

[oldschool]

Nice. Thanks for sharing!

 

[Moonhorse]

Actually i just updated my conf:
+ windows defender replaced with forticlient
+ brave is buggy, rather use firefox nightly as privacy browser
+ duckduckgo as searchengine

- removed malwarebytes ( false positives on finnish goverment sites)
- removed bitwarden ( realized i only sign in to MalwareTips)

 

[LDogg]

Change more software then I change clothes, I like it

~LDogg

 

[oldschool]

Change more software then I change clothes, I like it

~LDogg

My head is spinning! I can barely keep up with @Moonhorse!

 

[LDogg]

My head is spinning! I can barely keep up with @Moonhorse!

I know mate. It's good to see him change though and see what goes well.

~LDogg

 

[Moonhorse]

Update:
- Removed forticlient + free:hips ( probably conflicted)

Added
+Windows defender ( sandbox)
+Syshardener ( max )
+Osa (default+ some ruleblocking)

This is probably the most simple setup

Chrome as mainbrowser
- nano adblocker
- nano defender
- netcraft

Safety first > probably no need to be scared about privacy when using google services

Only thing im wondering is adding bitdefender trafficlight

This is permanent setup for now,

Some pictures:

Only thing i really didnt disable is just hidden files + prefetch service

 

[Nestor]

Update:
- Removed forticlient + free:hips ( probably conflicted)

Added
+Windows defender ( sandbox)
+Syshardener ( max )
+Osa (default+ some ruleblocking)

This is probably the most simple setup

Chrome as mainbrowser
- nano adblocker
- nano defender
- netcraft

Safety first > probably no need to be scared about privacy when using google services

Only thing im wondering is adding bitdefender trafficlight

This is permanent setup for now,

Some pictures:

View attachment 200608View attachment 200609View attachment 200610

Only thing i really didnt disable is just hidden files + prefetch service

That's a good config but I would choose instead of WD ,KFA.I don't trust WD, even nowadays, instead KFA seems to be the safest choice.

 

[LDogg]

Sensible changes. Always best to remove things or change settings that conflict.

~LDogg

 

[Moonhorse]

Update: Swapping Windows defender to Kaspersky free antivirus ( cloud probably has bugs fixed but kfa probably more stable choise)

That's a good config but I would choose instead of WD ,KFA.I don't trust WD, even nowadays, instead KFA seems to be the safest choice.

KFA is probably the best standalone antivirus choise, and the web filter of kaspersky will save me from installing more extensions. On malwarehub its indeed performing best so i think im gonna install it instead of WD as you request. Cruel aswell 'recommends' it

Sensible changes. Always best to remove things or change settings that conflict.

~LDogg

I think ransomOFF remnants and the uninstalling process caused many problems there aswell. Re:hips is nice, but as umbra said its only worthy over OSA with isolation feature that i dont have when im using google chrome.

 

[oldschool]

Head still spinning... ! Good luck!

 

[Moonhorse]

Head still spinning... ! Good luck!

Cheers and kaspersky gotremoved and replaced with windows defender

I just remember why did i uninstalled kaspersky before, because of the rootkit scanning thats running all the time
Also the threat removing of false positive took an year. And the brave fp has existed for month it seems

 

[harlan4096]

You can disable rootkit scanning just with 1 click in Performance settings...

 

[LDogg]

Wonder what the next change is going to be hehe

~LDogg

 

[Moonhorse]

Wonder what the next change is going to be hehe

~LDogg

This

Not sure would i benefit any of this or just get annoyed

Syshardener = firewall rules, script blocking, disable un-used windows services
OSA = anti-exploit , post protection
Comodo = default deny+ sandbox ^ Cruel said theres no benefit from using OSA along with cf, but CCAV only has browser protection, i dont think theres any problem running OSA with any sw