Windows Defender Shill Config

[Windows Defender Shill]

Ever since the Windows 10 Fall Creators update my machine has been using more recourses. So Webroot, (which I've always liked) became an appealing AV choice to lower my resource usage.

 

[Nightwalker]

I really like your setup, I am trying something similar for a while and it has been a good experience.

 

[Deleted member 178]

Simplicity is efficiency.

 

[Nightwalker]

Simplicity is efficiency.

I was sure that you would like this setup

 

[Deleted member 178]

The only "weak point" on this config is its exposure to fileless malwares (those using memory vectors), but the chance a safe habit's user will encounter those are more than minimal.

 

[shmu26]

Good concept.
To round out your native Windows security config, you could use a standard users account (maybe you already do), and use Windows Hard_Configurator to disable Windows script host, Powershell, and anything else that catches your fancy.

 

[frogboy]

Looks good to me, nothing to add here.

Thanks for sharing with us here at MT.

 

[brod56]

You are perfectly fine. Make sure to upload unknown files to VT since you have no anti-exe.
Thanks for sharing

 

[Ink]

How do you store your login credentials and do you use 2-Factor Authentication for Web accounts?

We have 2FA for your MalwareTips account.

 

[Deletedmessiah]

Great config. Thanks for sharing. What software you use to make system backups?

 

[Windows Defender Shill]

You are perfectly fine. Make sure to upload unknown files to VT since you have no anti-exe.
Thanks for sharing

I like to think the allow from Windows store only option in app settings is effectively an anti exe.

But when i need a file from the internet, I always check it against VT

Great config. Thanks for sharing. What software you use to make system backups?

just windows restore points.

 

[frogboy]

I would like to suggest creating system images with either Macrium Reflect or Aomei Backupper both have a free and reliable version.

 

[Windows Defender Shill]

How do you store your login credentials and do you use 2-Factor Authentication for Web accounts?

We have 2FA for your MalwareTips account.

I store login credentials in a real life notepad.

I would like to suggest creating system images with either Macrium Reflect or Aomei Backupper both have a free and reliable version.

ok thanks

The only "weak point" on this config is its exposure to fileless malwares (those using memory vectors), but the chance a safe habit's user will encounter those are more than minimal.

"File-less malware attacks evade detection by avoiding the drop of malicious files in favor of methods such as storing information in system memory, leveraging PowerShell or Windows registry, or using malicious macros."

Is there any simple solution to prevent those?

 

[Deleted member 178]

Is there any simple solution to prevent those?

Yes,

- using Software Restriction Policy applications (Appguard, Hard Configurator, etc...), they will not block the attack but will stop the dropped files.
- using memory protection softwares (MemProtect, etc...)
- using HIPS/BB

if you really afraid of this kind of attacks, based on your config, SRP is your best bait.

 

[Ink]

just windows restore points.

System Restore points are not Backups. It cannot be used to restore lost data or damage by malware, only system changes.

 

[Rengar]

Add HTTPS Everywhere to Chrome.
ZAM to on demand
Nice setup

System Restore points are not Backups. It cannot be used to restore lost data or damage by malware, only system changes.

If you get damaged by malware you can use safe mode to restore your system. If safe mode isnt working then you are scr**ed...

 

[Ink]

If you get damaged by malware you can use safe mode to restore your system. If safe mode isnt working then you are scr**ed...

In malware removal I have seen the helpers suggest to the user to delete all system restore points before proceeding with removal. Restore Points may also fail when they conflict with 3rd party software. So it's not a real solution for a backup.

 

[brod56]

I like to think the allow from Windows store only option in app settings is effectively an anti exe.

But when i need a file from the internet, I always check it against VT

Kind of. Remember many ransomware comes from js files or office macros and Windows blocking mode won't protect you from those.
Anyways if you check every unknown file with VT you will probably never get infected.

 

[JM Safe]

Good config.

It is really simple but efficient, just follow the important suggestions about the backups and add HTTPS Everywhere.

Thanks for sharing.

 

[Exterminator]

just windows restore points.

I would suggest some type of system backup solution.
Nice config! Thanks for sharing it with us