Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

[Andy Ful]

I have had similar incidence when using WDAC with 3rd party AVs; it always block their AMSI dll components inspite of excluding the entire folder containing the dll.

I noticed this with Avast. Which other AVs get blocked AMSI DLL?

 

[Parkinsond]

I noticed this with Avast. Which other AVs get blocked AMSI DLL?

WDAC was blocking AMSI dll of K and SEP, in addition to Avast; for B, it was blocking some other component cannot recall its name.
WDAC plays nicely only with MD.

 

[Parkinsond]

he advised me to install Vivaldi on my hard drive

That is a good reason for not following my advice the next time

 

[Andy Ful]

WDAC was blocking AMSI dll of K and SEP, in addition to Avast; for B, it was blocking some other component cannot recall its name.
WDAC plays nicely only with MD.

Blocking the AMSI DLL is mainly unimportant when using WHHLight because it blocks scripts and restricts PowerShell to Constrained Language. It can be important when using MS Office with allowed macros.
I will check Bitdefender, if I find some time.

 

[Parkinsond]

Blocking the AMSI DLL is mainly unimportant when using WHHLight because it blocks scripts and restricts PowerShell to Constrained Language

Yes, it did not prevent Avast, K, or SEP from launching and scanning; I just noticed this block event, and tried to avoid by exluding the containing folder but with no success.

 

[piquiteco]

I had Vivaldi crashed a couple of times too, in addition to few bugs; I am back to Edge.

Vivaldi crashed once, and closed unexpectedly a few times, but I can't blame it, much less Windows Hybrid Hardening Light. @Andy Ful developed this tool to work with MD, not with third-party AVs. I asked him if he had any tips that might help. But I'm going to restore a backup image and find out together with MD.

 

[Andy Ful]

Vivaldi crashed once, and closed unexpectedly a few times, but I can't blame it,

It will not be affected by WHHLight if properly whitelisted.

 

[piquiteco]

That is a good reason for not following my advice the next time

I know, it wasn't your fault. Just because you recommended Vivaldi and it caused problems doesn't mean you're to blame. It was my mistake.

 

[ProblematicPions]

@ProblematicPions,

I downloaded the ver. 1.102.3 (as in your post):

https://vscode.download.prss.microsoft.com/dbazure/download/stable/488a1f239235055e34e673291fb8d8c810886f81/VSCodeSetup-x64-1.102.3.exe

Next, I applied MAX settings for ConfigureDefender + FirewallHardening, and almost MAX settings for WHHLight:

View attachment 290245

View attachment 290246

There were no problems with installation and running the application. Did you investigate the possible issue?

I haven't changed anything in the SWH 'left menu' and ConfigureDefender I haven't touched either. But nevertheless, it CAN work and that is good news

Maybe I will start from 'scratch' and change one setting at a time (though in ConfigureDefender - 1 profile at a time )

Also, it's not enought to just set WDAC to OFF. I need a reboot also.

EDIT: Maybe my PC is f***ed. It IS old. But since I'm collecting installation updates and leave them for a few days to be sure my AV catches any misfits I can simply, as mentioned earlier, turn OFF WDAC, install all the updates, turn WDAC back ON and then I'm good. Also, if I CAN'T install anything, then no one else would be able to as well. A little twisted thought of security

 

[ProblematicPions]

EDIT2: Getting more confused by the minute so it's time to turn my brain off in front of the TV.

2 programs in a folder that is NOT whitelisted. 1 starts and 1 gives the contact your admin screen

I really hope I can get 0Patch to work (for updates) because I can't afford at new computer any time soon

And what I'm saying is - just let it be - the problem is cleary HERE.

 

[Andy Ful]

2 programs in a folder that is NOT whitelisted. 1 starts and 1 gives the contact your admin screen
...
And what I'm saying is - just let it be - the problem is cleary HERE.

Are OO AppBuster and OO SutUp10 the problems, or do you have problems with those apps when using WHHLight?

 

[ProblematicPions]

Are OO AppBuster and OO SutUp10 the problems, or do you have problems with those apps when using WHHLight?

No, sorry for spamming the thread, was very tired. Was rambling. I just thought it was weird that they could run without the path being whitelisted (or that one could run and the other not).

 

[Andy Ful]

EDIT2: Getting more confused by the minute so it's time to turn my brain off in front of the TV.

2 programs in a folder that is NOT whitelisted. 1 starts and 1 gives the contact your admin screen

...

And what I'm saying is - just let it be - the problem is cleary HERE.

View attachment 290259

Understand. Those two applications are not whitelisted, but one is allowed. That is normal behavior if the application has sufficient reputation in Microsoft ISG or SmartScreen.
0Patch (free version) works with no issues.

 

[rashmi]

@Andy Ful, Could you please clarify why the "Run as administrator" context menu option isn't configurable in WHHLight, like in H_C, or am I overlooking a setting?

 

[Andy Ful]

@Andy Ful, Could you please clarify why the "Run as administrator" context menu option isn't configurable in WHHLight, like in H_C, or am I overlooking a setting?

In H_C, EXE files are restricted by SRP, mainly configured to allow local Administrators (except when run with "-p" switch).
In WHHLight, EXE files are restricted by WDAC, which also blocks Administrators (no need to hide "Run as administrator").

 

[rashmi]

In WHHLight, EXE files are restricted by WDAC, which also blocks Administrators (no need to hide "Run as administrator").

But users can bypass WDAC restrictions using "Run as administrator," right? At least, this is what I see when I try to run WDAC-blocked EXE files using "Run as administrator."

 

[Andy Ful]

But users can bypass WDAC restrictions using "Run as administrator," right?

No, it will be blocked. In WHHLight, WDAC can be bypassed intentionally by the user via "Run By SmartScreen".

At least, this is what I see when I try to run WDAC-blocked EXE files using "Run as administrator."

Can you share this EXE? It should be blocked by WDAC.

 

[rashmi]

Can you share this EXE? It should be blocked by WDAC.

I have Comodo IS Offline Installer 12.3.4.8162 saved, which I tried to run; WDAC blocked it, but Run as admin allowed it.

http://download.comodo.com/cis/download/installs/9070/standalone/cispremium_installer.exe

 

[Andy Ful]

I have Comodo IS Offline Installer 12.3.4.8162 saved, which I tried to run; WDAC blocked it, but Run as admin allowed it.

http://download.comodo.com/cis/download/installs/9070/standalone/cispremium_installer.exe

It is allowed by WDAC in WHHLight.
WDAC ISG can initially block some executables and then allow them after some time. However, this has nothing to do with "Run as administrator".
Similar behavior can be seen with SAC.

 

[rashmi]

It is allowed by WDAC in WHHLight.
WDAC ISG can initially block some executables and then allow them after some time. However, this has nothing to do with "Run as administrator".
Similar behavior can be seen with SAC.

What do you mean by "It is allowed by WDAC in WHHLight"?

I tried it, and I also downloaded the installer again. WDAC blocked it, but "Run as admin" allowed the installer; i.e., the installer started extracting.