- Jan 27, 2018
- 1,435
Hopefully the pissing match is over as I like both of these guys and both of their softs.
- Status
- Jun 14, 2011
- 1,884
- Dec 23, 2014
- 8,604
It is a very good setup.
This config would be good even without ConfigureDefender settings, especially for MT members. You can learn much from VS alerts and VS Pro will probably cover most of WD advanced settings except maybe Network Protection. Also, the number of false positives will be slightly smaller.
The ConfigureDefender settings are useful, when you use VS protection only for "out of the blue" events or unsafe applications, and usually bypass the VS alerts (via Allow button) while running your trusted applications.
Last edited:
- Mar 29, 2018
- 7,710
@Dan VS is still blocking svchost.exe and WD updates prior to scan in my latest test:
Edit: Tested with same result on W10 1909 & 2004.
Code:
[07-11-2020 10:21:54] [INFO ] - Process blocked by initial AntiExploit stage: c:\windows\system32\svchost.exe
[07-11-2020 10:21:55] [INFO ] - VoodooShield Blocked: c:\windows\system32\svchost.exe | "c:\windows\system32\\svchost.exe" |
[07-11-2020 10:22:34] [INFO ] - User Allowed: c:\windows\system32\svchost.exe | "c:\windows\system32\\svchost.exe" |Edit: Tested with same result on W10 1909 & 2004.
Last edited:
- May 31, 2017
- 1,742
So that is what you mean when you say you can bypass VS... the Allow button. Luckily VS already has a setting that mitigates that bypass...
Andy, EVERYONE (except maybe a small handful of people), including me, would be highly appreciative if you refrain from keeping the conversation going. Please show everyone that you are a good hedgehog and that you do not "keep negative emotions too long".
@JT, you might be right that "Microsoft has no intention of getting rid of AppLocker, which completely incorporates the older SRP", but I do not believe you are... I have not checked because that does not change the fact that SRP runs in user-mode, and honestly I could care less. Then again, if one somehow believes they are immune to enterprise attacks then it is a non-issue either way.
Maybe the answer is in the following link, but I am not going to waste time figuring it out.
Application Control for Windows
Application Control restricts which applications users are allowed to run and the code that runs in the system core.
docs.microsoft.com
Last edited:
- May 31, 2017
- 1,742
Hey OS, sorry, I have been busy working on some other stuff and have not had a chance to see what I need to do to fix this issue. As we discussed, the block is caused by the link you provided below, and hopefully I will have a chance to look at it this weekend.
For the other users, as long as you do not use the link above, VS should not block Windows Defender updates.
- May 31, 2017
- 1,742
We have had a request to add HIDS or NIDS capabilities to VS for SMB / Enterprise users. If anyone has any thoughts on SNORT, OSSEC, ect, I would love to hear them. Thank you!
- Dec 23, 2014
- 8,604
No comment. I appreciate that you read Hard_Configurator thread.So that is what you mean when you say you can bypass VS... the Allow button. Luckily VS already has a setting that mitigates that bypass...
View attachment 244100
Andy, EVERYONE (except maybe a small handful of people), including me, would be highly appreciative if you refrain from keeping the conversation going. Please show everyone that you are a good hedgehog and that you do not "keep negative emotions too long".
View attachment 244101
@JT, you might be right that "Microsoft has no intention of getting rid of AppLocker, which completely incorporates the older SRP", but I do not believe you are... I have not checked because that does not change the fact that SRP runs in user-mode, and honestly I could care less. Then again, if one somehow believes they are immune to enterprise attacks then it is a non-issue either way.
View attachment 244102
Maybe the answer is in the following link, but I am not going to waste time figuring it out.
Application Control for Windows
Application Control restricts which applications users are allowed to run and the code that runs in the system core.docs.microsoft.com
- May 31, 2017
- 1,742
In all fairness, you did post a link to your thread on the VS thread, but yeah, I try to read as many threads as I can and help out when I have time and there is an issue that I happen to be familiar with.No comment. I appreciate that you read Hard_Configurator thread.
Either way, thank you, and I genuinely appreciate and admire that you at least acknowledge this is a limitation of SRP instead of blaming the user for not tailoring their product correctly.
Have a great weekend, let’s catch up in 2-4 years, deal?
- Dec 23, 2014
- 8,604
@danb,
I think that you can ask the moderator to delete all posts related to my test and to our discussion. The test results are not important to VS development and other posts only bloat this thread.
I think that you can ask the moderator to delete all posts related to my test and to our discussion. The test results are not important to VS development and other posts only bloat this thread.
- Dec 23, 2014
- 8,604
No problem. You should probably read more posts from the H_C thread (old post about legacy SRP):
https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/post-804884
But, it does not hurt to recall this from time to time.
Anyway, it is an interesting question, which software will survive longer in current hard time - 3rd party small business product or legacy SRP? For MT members it will not be a problem - they simply choose another application. I wish we both will catch up on our threads in 2-4 years.
Last edited:
- May 31, 2017
- 1,742
If it is okay, I would STRONGLY prefer to leave the conversation just as it is.@danb,
I think that you can ask the moderator to delete all posts related to my test and to our discussion. The test results are not important to VS development and other posts only bloat this thread.
- May 31, 2017
- 1,742
We certainly will see, I am guessing sooner than laterAnyway, it is an interesting question, which software will survive longer in current hard time - 3rd party small business product or legacy SRP? For MT members it will not be a problem - they simply choose another application. I wish we both will catch up on our threads in 2-4 years.
.
- Dec 23, 2014
- 8,604
- Dec 23, 2014
- 8,604
@danb,
Why are you interested to keep alive the SRP topics in the VS thread? Is it important for the VS development? There are some other threads where you can post, too.
Why are you interested to keep alive the SRP topics in the VS thread? Is it important for the VS development? There are some other threads where you can post, too.
- May 31, 2017
- 1,742
This will be my last post on this subject.@danb,
Why are you interested to keep alive the SRP topics in the VS thread? Is it important for the VS development? There are some other threads where you can post, too.
The main reason is because I took the time to explain a few elements and components of the inner workings of VS, which I rarely do. There is a lot of great info in the posts, and I do not want to spend the time writing the posts if they are just going to be erased.
That, and a lot of times when threads are edited, it is almost impossible to see what really happened. Have a great weekend!
- Dec 23, 2014
- 8,604
- May 31, 2017
- 1,742
Hopefully Poland has better politicians than the USA, they are terrible here... all of themThanks. It will be an interesting weekend in Poland due to the presidential election.
.BTW, I downloaded SWH and it is super cool! And actually, a SWH + VS would be an amazing super lightweight "bulletproof" combo that would make a heck of a lot of sense to a lot of people. I won't go into details why I think it is a great combo because I think most MT users will understand why it is. For now I just tested SWH on a VM, but I am thinking of combining it with VS on my actual computers. If this combo happens to become popular on MT, just remember I get the credit for thinking of the combo, hehehe
.Also, you probably already know this minor bug, but the VM I tested SWH on was Windows 8.1, and it worked but displayed a message that SWH only worked on Windows 10.
- Dec 23, 2014
- 8,604
SWH should work well with VS. If you will notice any problem, then I can work on compatibility with VS.
SWH should work well on Windows 8+, but I have to rethink if this is a good idea.
- Apr 16, 2017
- 2,797
fwiw, I tried to download update VS to
VS 5.78
https://voodooshield.com/Download/InstallVoodooShield578.exe
SHA-256: bd84b6649d73bd8ebd2005c2008fb43c5e521d3d424aa17d5c98936195bcb485
and I get a 404 (sunday 12jul7 @2200 edt)
VS 5.78
https://voodooshield.com/Download/InstallVoodooShield578.exe
SHA-256: bd84b6649d73bd8ebd2005c2008fb43c5e521d3d424aa17d5c98936195bcb485
and I get a 404 (sunday 12jul7 @2200 edt)
- Status
Similar threads
- Question
