Advanced Plus Security oldschool's 2020 laptop setup

Last updated
Dec 12, 2020
How it's used?
For home and private use
Operating system
Windows 10
Log-in security
Security updates
Allow security updates and latest features
User Access Control
Always notify
Real-time security
AVG Internet Security v. 20.10.3157
Firewall security
Microsoft Defender Firewall
About custom security
Default settings + Hardened Mode
Periodic malware scanners
Hitman Pro (paid)
Malware sample testing
I do not participate in malware testing
Browser(s) and extensions
Brave/Brave Nightly --> Brave Shields + ClearURLs + LocalCDN
Edge Chromium --> Strict Tracking Protection + ClearURLs + LocalCDN
Maintenance tools
Windows built-in
File and Photo backup
Copy/Paste --> Free Agent drive
System recovery
Aomei Backupper Pro --> image monthly or as needed
System protection --> restore points as needed @ app or data changes
Risk factors
    • Browsing to popular websites
    • Browsing to unknown / untrusted / shady sites
    • Working from home
    • Streaming audio/video content from trusted sites or paid subscriptions
    • Streaming audio/video content from shady sites
Computer specs
Lenovo L340 i3 8145U CPU @ 2.10 GHz 2.300 GHz 8GB DDR4 RAM 1 TB HDD
Notable changes
5/3/20 --> Removed Bitdefender and back to Windows Defender --> Updated RunBySmartscreen
May 2020 ---> various small changes
3 June, 2020 --> updated to W10 2004
7 June 2020 --> rolled back to 1909
23 August 2020 --> Added LocalCDN to browsers
27 August 2020 --> Removed µBO in Edge
31 August 2020 --> Removed Bitdefender Free
--------------------> Reverted to Windows Defender
--------------------> Removed Trafficlight and added Malwarbytes Browser Guard
7 September 2020 --> Removed Malwarebytes Browser Guard
Later in September --> Enabled Google SafeBrowsing in Brave
Have you find
Back3 said:
I will try this challenge. I have WD+ Configure Defender. I'll uninstall SpyShelter Premium and join your club! I feel so brave!
Click to expand...
Here's your certificate. Now you're officially brave 😎
brave.png
 
  • Like
  • HaHa
Reactions: Nevi, amico81, Venustus and 7 others
oldschool,
The RunBySmartScreen tool can be used to open any new/untrusted file, so the user cannot be fooled by a spoofed file extension. If he/she thinks that the file is a photo, then it will not be opened (via RunBySmartScreen) when it is a script with a photo icon. But, I am not sure if it is a common way of using RunBySmartScreen. What do you think?
 
  • Like
  • Applause
Reactions: Venustus, toto_10, Step 1 and 7 others
Andy Ful said:
oldschool,
The RunBySmartScreen tool can be used to open any new/untrusted file, so the user cannot be fooled by a spoofed file extension. If he/she thinks that the file is a photo, then it will not be opened (via RunBySmartScreen) when it is a script with a photo icon. But, I am not sure if it is a common way of using RunBySmartScreen. What do you think?
Click to expand...

I'm not sure if it's a common way to use it either. I've only used it for installers myself so far.
 
  • Like
  • Applause
Reactions: Nevi, Venustus, toto_10 and 8 others
oldschool said:
I'm not sure if it's a common way to use it either. I've only used it for installers myself so far.
Click to expand...
Ha, ha. It seems, that most users apply only one half of RunBySmartScreen. :)
RunBySmartScreen works like on-demand "SRP + Forced SmartScreen" (although it does not use SRP). So, when the user opens a file by pressing Enter or the left-mouse--click, the file is opened normally. When he/she uses the right-mouse-click and chooses RunBySmartScreen, the file opening is restricted and the alert is displayed (for unsafe files). In this way, the user can apply two security setups by simply choosing between normal file opening and opening it via the right-mouse-click RunBySmartScreen entry.
If you open in MS Office or Adobe Reader a document from a flash drive, then it will not be opened in Protected view. If you will do it via RunBySmartScreen, then the MOTW is added and MS Office or Adobe Reader will open the document in Protected view (as if it was downloaded by the web browser).

MT members usually pay attention to file extensions and do not open files with unsafe or unknown extensions. So, they can use only one half of RunBySmartScreen.:)(y)
 
Last edited:
  • Like
  • Applause
  • +Reputation
Reactions: Nevi, oldschool, plat and 14 others
Exploit Protection settings for browsers (thanks to @Umbra). These haven't broken anything yet, e.g. extensions crashing.

- for Brave, Edge and Firefox:

Block low integrity images - ON
Block remote images - ON
Block untrusted fonts - ON
Control flow guard (CFG) - ON
Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED
Disable extension points - ON
Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED
Randomize memory allocations (Bottom-up ASLR) - ON
Validate exception chains (SEHOP) - ON
Validate handle usage - ON
Validate heap integrity - ON
Validate image dependency integrity - ON

ADD for Edge Chromium only:

Code integrity guard - ON (with or without Also allow images signed by M$ Store CHECKED)
 
Last edited:
  • Like
  • +Reputation
Reactions: Nevi, sirius777, Parsh and 8 others
oldschool said:
Exploit Protection settings for browsers (thanks to @Umbra). These have broken anything yet, e.g. extensions crashing.

- for Brave, Edge and Firefox:
Block low integrity images - ON
Block remote images - ON
Block untrusted fonts - ON
Control flow guard (CFG) - ON
Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED
Disable extension points - ON
Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED
Randomize memory allocations (Bottom-up ASLR) - ON
Validate exception chains (SEHOP) - ON
Validate handle usage - ON
Validate heap integrity - ON
Validate image dependency integrity - ON

ADD for Edge Chromium only:
Code integrity guard - ON (with or without Also allow images signed by M$ Store CHECKED)
Click to expand...
Exactly mine :) These settings were the most practical without breaking the chromium browser. Helpful to an extent to avoid common exploit techniques.
I just could not enable 'Code Integrity Guard' as it messed up ESET's protection.
A chrome-specific DLL eplgChrome.dll and the Safe Banking monitoring DLL are signed by ESET itself. Hence blocked, raising multiple error dialog boxes everytime.
 
  • Like
Reactions: Nevi, [correlate], Venustus and 6 others
Parsh said:
I just could not enable 'Code Integrity Guard' as it messed up ESET's protection.
A chrome-specific DLL eplgChrome.dll and the Safe Banking monitoring DLL are signed by ESET itself. Hence blocked, raising multiple error dialog boxes everytime.
Click to expand...
Yes this is expected from almost every AV except Emsisoft and some others maybe.
 
  • Like
Reactions: Nevi, [correlate], Venustus and 8 others
You must log in or register to reply here.

You may also like...