Advanced Plus Security sypqys configuration 2024

[sypqys]

What do you mean by vb codes? Are they related to VBA features of MS Office (Macros, Add-ins, etc.)?
Do the original documents work differently after disabling H_C restrictions?



Most people infected via MS Office thought that the downloaded files were safe. Most of them were infected via MS Office macros or MS Office Add-ins. There are many other ways that can be adopted by the attackers in the near future to bypass the AV protection by using MS Office.
I do not have a convenient solution for you. Most security applications that protect MS Office use parent-child process monitoring, which is insufficient when you allow macros. I can only advise what I already posted:

1. Use a safe application as the default program to open documents. So when you open the document, template, Add-in, etc., from the Desktop or Explorer (file explorer) it is not opened/installed via MS Office.
   This can be done by the custom configuration of default applications via Windows Settings >> Apps & features >> Default apps >> Set defaults by app. Next, choose MS Office Word, Excel, PowerPoint, and change the default application that can open the listed file types to a safe application.
2. You can still open your documents by opening the MS Office application and using File >> Open from the application menu.
3. If you must edit an unsafe document, then do not do it at once. Check it online and if it looks clean, then open it in MS Office after one or more days.
4. You can additionally use Defender with ASR rules or anti-exploit solutions related to MS Office.
5. Harden your firewall to block LOLBins' connections or use H_C to block popular LOLBins.
6. Learn to recognize phishing attempts.

Be safe.

for example a VB code, but when I applies, and open my document, this type of VB codes don't work anymore...
I have to make a copy one to restore that primary restore the values on H_C.

 

[Shadowra]

Free

So your box has a firewall, so you can select what @silversurfer has put

 

[sypqys]

I have correct this entry yet.

 

[M4RT1NE2]

You are using Revo to remove programs.
Also try the free HiBit Uninstaller. It is much better in my opinion.
I use it myself and it cleans up residue well

HiBit Uninstaller

 

[Back3]

You are using Revo to remove programs.
Also try the free HiBit Uninstaller. It is much better in my opinion.
I use it myself and it cleans up residue well

HiBit Uninstaller

I use the portable version. Excellent

 

[sypqys]

I use the portable version. Excellent

I have downloaded on portable version

 

[Andy Ful]

View attachment 266027
for example a VB code, but when I applies, and open my document, this type of VB codes don't work anymore...

Please answer my question.
The code is related to the VBA project (VBA = Visual Basic for Applications).
I understand that your code did not work with H_C restrictions. It is normal because H_C can block the VBA interpreter, so your code could not be processed.
But, this does not mean that this code was deleted from the original file. It should be still there.
Did you check that the code was really removed from the original file?

 

[sypqys]

Please answer my question.
I understand that your code did not work with H_C restrictions. It is normal because H_C can block the VBA interpreter, so your code could not be processed.
But, this does not mean that this code was deleted from the original file. It should be still there.
Did you check that the code was really removed from the original file?

No I think on my souvenir my memory it will be delete all but I'm not sure. The part of VB code was unclickable since my memory... I prefer use that VB code... I protect my computer otherwise with the other options of H_C with LOLBins rules for my Windows 10 firewall. It's not a problem, because I'm not front of my computer right now. Maybe I made an error when I wrote there are delete all my codes from my Excel sheet.

 

[sypqys]

The UAC disturb me. Because when I launch a legitimate program whose I know as secure, he attempt me. There is a possibility to class program at legitime in order to UAC warn me on program not classed ?

 

[M4RT1NE2]

The UAC disturb me. Because when I launch a legitimate program whose I know as secure, he attempt me. There is a possibility to class program at legitime in order to UAC warn me on program not classed ?

That's what UAC is for, to warn you.
That is the job of the UAC.

 

[sypqys]

That's what UAC is for, to warn you

But also in program which I know as a legitimate program. Firewall class but not with UAC. What a shame !

 

[sypqys]

(I have upload my configuration)

 

[sypqys]

i have update my configuration

 

[harlan4096]

Can You announce here the changes? thanks.

 

[sypqys]

I have update my configuration !

 

[sypqys]

Config' uptaded ...

 

[Ink]

Config' uptaded ...

Can you create your own rules in the free version of Portmaster? Feature comparison is vague.

Safing Portmaster - Pricing

Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.

safing.io

Is ScreenWings free?

ScreenWings - Anti-screenshot - schiffer.tech UG (haftungsbeschränkt)

ScreenWings is an anti-screenshoting software that prevents (malicious) software from capturing your screens.

schiffer.tech

Would Ghostpress not serve a better purpose than ScreenWings?

Ghostpress - Anti-keylogger - schiffer.tech UG (haftungsbeschränkt)

Ghostpress is an anti-keylogging software that prevents malicious software from capturing your keyboard presses.

schiffer.tech

 

[sypqys]

Yes ScreenWings is free see on Softpedia.
I have create rules I thing if im right on Portmaster Free version...
Ghostpress I don'k know, I use it, but I prefer ScreenWings...

 

[sypqys]

Ghostpress don't protect screen capture protection, I cannot apply this check box...

 

[harlan4096]

I just tried also Ghostpress and even can't end the initial configuration, it can't recognize Spanish accents in vowels in Verification step...