Advice Request Windows Defender - Pro's and Con's

Please provide comments and solutions that are helpful to the author of this topic.

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,593
...
Kinda stupid question, but are those well known signed files more trusted by WD than some uncommon ones, wich would affect into scanning speed?
...
If this is a stupid question, then I am stupid too.:giggle::unsure:
See the Lockdown, Evjl's Rain and my posts about WD (free AV) cons. Some things are probably known only to AI that makes the final decision.
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,593
Avast Free and Malwarebytes Free.

Why ?

Because it was recommended to them and it's free.

Everywhere I go, one thing I can count on... is to find Avast Free and Malwarebytes Free.

/s
Be careful. Some MT readers can overlook a hidden joke.:giggle:
Anyway, I used this setup some years ago. It was OK.
 

Bikeman0I17

Level 1
Verified
Sep 22, 2017
48
I still use Avast and Malwarebytes Free here on most systems? is it not a good thing? Trying out Defender and Malwarebytes Free on main Desktop, just hoping it's same protection as I had with Avast for last 10 or more years, and not worst protection
 

Windows_Security

Level 24
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Mar 13, 2016
1,298
I have put Windows 10 Pro on my desktop to replace Windows 7 Enterprise. Setup is simple, hardening through GPO, UAC denies elevation of unsigned, risky commands are disabled except PowerShell through WD Exploit Protection (WD EP). Office is hardened though GPO and WD EP using Andy;s excellent Configure Defender, Protected Folders is on and SRP default deny implemented.

Nice thing of WD that it reports from time to time what it has done: I am proud to announce that the PC officially was infected :). Notice the sneaky location (browser cache). Does someone know whether it is possible to see whether WD found it during on demand disk access (write) or on execution? Would be interesting to know whether it was executed (meaning it had escaped Chrome sandbox).

On the 29th I ran with Chromium stable V71 (I updated to V72 Yesterday). I remember on the 29th in the morning I was collecting information for a blog (of a customer for which I am ghostwriter) and I had to enable scripts for HTTP://* websites (which I have disabled by default in Chrome content settings) to view the content. Chrome Safe browsing and BitDefender Traffic Light did not throw a warning

1548936718872.png
 

dash

Level 4
Verified
Well-known
Dec 15, 2018
158
I have put Windows 10 Pro on my desktop to replace Windows 7 Enterprise. Setup is simple, hardening through GPO, UAC denies elevation of unsigned, risky commands are disabled except PowerShell through WD Exploit Protection (WD EP). Office is hardened though GPO and WD EP using Andy;s excellent Configure Defender, Protected Folders is on and SRP default deny implemented.

Nice thing of WD that it reports from time to time what it has done: I am proud to announce that the PC officially was infected :). Notice the sneaky location (browser cache). Does someone know whether it is possible to see whether WD found it during on demand disk access (write) or on execution? Would be interesting to know whether it was executed (meaning it had escaped Chrome sandbox).

On the 29th I ran with Chromium stable V71 (I updated to V72 Yesterday). I remember on the 29th in the morning I was collecting information for a blog (of a customer for which I am ghostwriter) and I had to enable scripts for HTTP://* websites (which I have disabled by default in Chrome content settings) to view the content. Chrome Safe browsing and BitDefender Traffic Light did not throw a warning

View attachment 207614
Yeah, sounds "simple".
 

TairikuOkami

Level 37
Verified
Top Poster
Content Creator
Well-known
May 13, 2017
2,685
Windows Defender ... causes ... issues
That is pretty much, what comes to my mind, whenever someone mentions WD, that makes me hard to recommend it. It either works or not.

WD is outstanding, when it comes to the detection, though not perfect, but the problem are bugs. It is made by hundreds of people all over the world. Literally: the left hand doesn't know what the right hand is doing - causing various issues, sometimes too serious. It is just made on the go.
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
I have put Windows 10 Pro on my desktop to replace Windows 7 Enterprise. Setup is simple, hardening through GPO, UAC denies elevation of unsigned, risky commands are disabled except PowerShell through WD Exploit Protection (WD EP). Office is hardened though GPO and WD EP using Andy;s excellent Configure Defender, Protected Folders is on and SRP default deny implemented.

Nice thing of WD that it reports from time to time what it has done: I am proud to announce that the PC officially was infected :). Notice the sneaky location (browser cache). Does someone know whether it is possible to see whether WD found it during on demand disk access (write) or on execution? Would be interesting to know whether it was executed (meaning it had escaped Chrome sandbox).

On the 29th I ran with Chromium stable V71 (I updated to V72 Yesterday). I remember on the 29th in the morning I was collecting information for a blog (of a customer for which I am ghostwriter) and I had to enable scripts for HTTP://* websites (which I have disabled by default in Chrome content settings) to view the content. Chrome Safe browsing and BitDefender Traffic Light did not throw a warning

View attachment 207614
If your computer is infected then there is no hope for the rest of us. Sounds like an FP to me. Yesterday when I installed ReHIPS, and it made an isolated environment for Chrome (this entails copying some files from Appdata) Windows Defender told me that it wants to upload something for inspection. I repeated the process of installing ReHIPS, and Windows Defender repeated the inspection of my Chrome data.
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,593
By the way, it is possible for advanced users to adopt no-AV setup, based on SmartScreen + default-deny (SRP and Windows policies) + process monitoring (drivers, script engines, and not whitelisted applications).
The process monitoring, including the kernel drivers, can be easily adopted on every Windows 10 machine via applying WD Application Control (SIPolicy.p7b file):
Discuss - Application Control on Windows 10 Home

Sorry - my post seems to be a counterpart of the topic.:emoji_innocent::giggle:
 
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top