Using Defender as your first line of defense

[Andy Ful]

...
What VS will add? nothing much, so basically wasting resources and offering surface attacks.

That is right. Using both H_C and VS can hardly be recommended, for many reasons.
Anyway, many users will choose VS (over SRP/H_C) because it seems more user-friendly. Windows built-in SRP blocks some processes silently, so the user who is not trained/accustomed to security Logs can have a problem to see if something was blocked and what concretely was blocked.
It is much easier with H_C because it uses NirSoft FullEventLogView (with custom config) to see the blocked entries, but it is still easier with VS because the info about the blocked process can be seen in the VS alert.
On the other side, some users will prefer SRP, if they do not like too much prompting about things they already know.

 

[RoboMan]

It is a simple real-time scanner with some cloud capabilities, what did you expect?
Take all the 3rd party vendors AVs, remove every components except the real-time scanner, i bet maybe only ESET or Kaspersky would do well.
WD was made to offer basic, decent, free protection to ALL Windows' users without any hassle or setup to do.

This. Just imagine Defender offering Application Control or SRP capabilities directly from the antivirus GUI. That would lead to thousands of novices breaking their systems or worse, Defender breaking everything in an attemp to protect retar** users.

 

[Andy Ful]

This. Just imagine Defender offering Application Control or SRP capabilities directly from the antivirus GUI. That would lead to thousands of novices breaking their systems or worse, Defender breaking everything in an attemp to protect retar** users.

That is true for SRP/AppLocker/ApplicationControl in their current form. But, Microsoft could easily introduce something similar to H_C profiles, which can safely apply/remove the complex security settings via one mouse click.

 

[blackice]

That is true for SRP/AppLocker/ApplicationControl in their current form. But, Microsoft could easily introduce something similar to H_C profiles, which can safely apply/remove the complex security settings via one mouse click.

What a beautiful world that would be. I would appreciate it, but I don’t expect it to happen.

 

[plat]

The irony .

As-is with no install or set-up, Defender is the easiest to use.

For maximum effectiveness and efficiency, Defender is the most complicated and obscure. By far.

 

[Andy Ful]

What a beautiful world that would be. I would appreciate it, but I don’t expect it to happen.

It will not happen as a free solution.

 

[blackice]

The irony .

As-is with no install or set-up, Defender is the easiest to use.

For maximum effectiveness and efficiency, Defender is the most complicated and obscure. By far.

The other funny thing. For most users, with decent online hygiene, default is probably all they need, maybe increased time for cloud lookup. It’s the happy clickers who need the advanced settings, and they’re the most likely to be on default.

 

[Andy Ful]

The other funny thing. For most users, with decent online hygiene, default is probably all they need, maybe increased time for cloud lookup. It’s the happy clickers who need the advanced settings, and they’re the most likely to be on default.

Most average users even do not know that they are happy clickers.

 

[blackice]

Most average users even do not know that they are happy clickers.

Maybe I am a happy clicker, I mean I do like to click it makes me smile.

 

[Andy Ful]

Maybe I am a happy clicker, I mean I do like to click it makes me smile.

You are not an average user, so you can probably smile safely.
People are twice as safe just by reading MT forum.

 

[oldschool]

People are twice as safe just by reading MT forum.

This is the bottom-line value of MT, even without diving deep into the water of tech security.

 

[Venustus]

I am a happy clicker

I use a touch screen so I guess I'm a "Happy Toucher"??

 

[blackice]

I use a touch screen so I guess I'm a "Happy Toucher"??

I almost exclusively use MT on mobile, so maybe I am as well...

 

[RoboMan]

I use a touch screen so I guess I'm a "Happy Toucher"??

I wouldn't let any happy touchers near my daughter

 

[Mjolnir]

At default settings can Defender protect against this - New Phoenix Keylogger tries to stop over 80 security products to avoid detection | ZDNet

 

[Andy Ful]

At default settings can Defender protect against this - New Phoenix Keylogger tries to stop over 80 security products to avoid detection | ZDNet

Yes in some cases, and No in some cases. This will be true for most AVs. The AV has a chance to stop it when executed from disk, like in malware tests. But not necessarily, if it will be loaded into memory by another malware/exploit on the already infected system, which probably will be the case in the wild. Many Phoenix samples do not try to obtain persistence and can detect a virtual machine environment. So, Phoenix will be hard to detect by the AV.
The better chances have security solutions based on NIDS, that can monitor network traffic.
Such malware cannot magically appear on your computer. It has to be delivered, usually via phishing + exploits. The best method to avoid it, will be updating Windows and installed software.

"Delivery Method

By default, Illusion supplies the Phoenix keylogger to their buyers as a stub. The buyer must use their own methods to deliver the stub to the target machine. The majority of Phoenix infections we observe originate from phishing attempts that leverage a weaponized rich text file (RTF) or Microsoft Office document. These deliveries do not use the more popular malicious macro technique, but instead use known exploits. Most commonly, they exploit the Equation Editor vulnerability".

Phoenix: The Tale of the Resurrected Keylogger

Nocturnus is tracking a new keylogger called Phoenix, packed with a myriad of information-stealing features extending far beyond logging keystrokes.

www.cybereason.com

 

[Mjolnir]

Thank you for the response Andy.....Keyloggers are my biggest concern when it comes to Defender - it always seems to rate weak in that area in testing.

 

[ForgottenSeer 823865]

Thank you for the response Andy.....Keyloggers are my biggest concern when it comes to Defender - it always seems to rate weak in that area in testing.

People seems to forget all the side security features of Win10, which supposed to cover this: SmartScreen, UAC at max , etc...

 

[RoboMan]

Thank you for the response Andy.....Keyloggers are my biggest concern when it comes to Defender - it always seems to rate weak in that area in testing.

You shouldn't worry about keystroke grabbing if malware doesn't execute at all. Try pairing Defender with H_C or VoodooShield

 

[South Park]

In my experience, a content blocker like uBO or Nano blocker is even more important than an antivirus. I've had a few warnings and blocked pages from content blockers when seemingly trustworthy sites tried to redirect me to suspicious places. That said, I feel confident using Defender and the built-in Exploit Guard in Windows 10 (plus a NVT product on the side).

In the 15 years that I've used Windows Defender, its forerunner MSE, and Avast free on various computers, I've never had an infection as determined by a second-opinion scanner. The only time I got infected was while using Norton in 2003, and I once picked up an inert Java RE virus when using the now-defunct CA antivirus.