App Review Windows Defender vs GandCrab Ransomware: video review

[Local Host]

And everyone definately needs Windows Defender pushed by Microsoft with defaults settings as seen by this video, yep users are protected.

You are protected,

 

[Eddie Morra]

Local Host... you made me rofl a lot with that one

What film is the original clip from?

 

[Local Host]

Local Host... you made me rofl a lot with that one

What film is the original clip from?

Unfortunately it's a commercial, LifeLock TV Commercial, 'Bank'

 

[Eddie Morra]

Unfortunately it's a commercial, LifeLock TV Commercial, 'Bank'

Awwwwwww

 

[KonradPL]

Yes you`re correct. It is sad becouse its realy good piece of software.
Maybe marketing is not the best maybe people want to a simple solution...
We can not mention about MKS_Vir/Arcabit. Their product is really top class.
But these are topics for another thread
Thanks for sharing a bit of your story with me.

 

[Eddie Morra]

We can not mention about MKS_Vir/Arcabit. Their product is really top class.

I noticed they do really well in tests sometimes... I do not have enough XP with them to comment much. What are your thoughts on them? If not here, you could make a thread discussion about it, I'm sure some others would have some info to chime in on them too. Interested in hearing people's thoughts on MKS_Vir/Arcabit.

 

[KonradPL]

good idea, I will try to share my thoughts in a separate new thread in the near future

 

[DeepWeb]

To think Microsoft could protect so many people from malware if they simply turned off interpreters by default.... smfh. I just can't understand what is going on in the minds of the Windows team. Some very little out of the box tweaks can kill 99% of all malware.
-Turn off interpreters by default
-Only allow signed executables to run
-Turn on PUA detection in Windows Defender by default to improve heuristics.

But noooo.

 

[KonradPL]

exactly...

 

[RoboMan]

To think Microsoft could protect so many people from malware if they simply turned off interpreters by default.... smfh. I just can't understand what is going on in the minds of the Windows team. Some very little out of the box tweaks can kill 99% of all malware.
-Turn off interpreters by default
-Only allow signed executables to run
-Turn on PUA detection in Windows Defender by default to improve heuristics.

But noooo.

• Most @Andy Ful 's tweaks should be on by default
• Interpreters should be off by default
• Vbs and js files should require a separate program (should be downloaded from MS site) to even run
• Poweshell and CMD should be at least not so powerful for regular users

I tested this very same scenario with SysHardener enabled and it was funny because the js couldn't even execute because no program could open it.

 

[Andy Ful]

• Most @Andy Ful 's tweaks should be on by default
• Interpreters should be off by default
• Vbs and js files should require a separate program (should be downloaded from MS site) to even run
• Poweshell and CMD should be at least not so powerful for regular users

I tested this very same scenario with SysHardener enabled and it was funny because the js couldn't even execute because no program could open it.

SysHardener simply disassociates the .js extension from interpreters: wscript.exe and cscript.exe and additionally can block those interpreters like one of Hard_Configurator options. So, it works somewhat similarly to Software Restriction Policies (but using another technology).

 

[RoboMan]

SysHardener simply disassociates the .js extension from interpreters: wscript.exe and cscript.exe and additionally can block those interpreters like one of Hard_Configurator options. So, it works somewhat similarly to Software Restriction Policies (but using another technology).

I like the idea of final users not even being able to execute scripts hehe

 

[Local Host]

To think Microsoft could protect so many people from malware if they simply turned off interpreters by default.... smfh. I just can't understand what is going on in the minds of the Windows team. Some very little out of the box tweaks can kill 99% of all malware.
-Turn off interpreters by default
-Only allow signed executables to run
-Turn on PUA detection in Windows Defender by default to improve heuristics.

But noooo.

Cause then people would whine Microsoft is not giving the users a choice, and broke things. Scripts are used even by Microsoft itself, during normal System Maintenance.

It doesn't make much sense, but is how people react every time Microsoft acts that way, the same way they force Updates (cause people negligent to Update Windows) then whine they have problems.

Microsoft focused instead on trying to detect malicious scripts, rather than block them all (we all know how that turned out).

 

[shmu26]

Not only are scripts used by Microsoft during automated maintenance, but they are also used when they provide support.
For instance, I had a problem a couple months ago with Office 365, I was on my 30 days free trial, and the MS support rep made a remote session with me, in the course of which the rep tried to run a script that used wscript. Maybe it was VBS, I don't remember.
I tried frantically to turn off my advanced protection, and reassociate the relevant file type, but the rep just gave up and told me to reinstall Office LOL.
So the moral of the story is that scripts, including powershell scripts, are quite convenient to MS. I don't think they want to give that up so quick, especially since they can sell script protection to businesses and make money.

 

[Deleted Member 3a5v73x]

I tried frantically to turn off my advanced protection, and reassociate the relevant file type, but the rep just gave up and told me to reinstall Office LOL.

This is just sad, that means they don't know how their own made system works and what settings needed to change to solve the problem. If some still blame Windows users for their own problems after updates/upgrades, I'm gonna just report lol, it's all Microsofts fault.

 

[shmu26]

This is just sad, that means they don't know how their own made system works and what settings needed to change. If some still blame Windows users for their own problems after updates/upgrades, I'm gonna just report lol, it's all Microsofts fault.

A bottom-level MS support rep will know, at best, how to follow the instructions given in their training course, and has zero understanding of or patience for the complications caused by security geeks.

 

[Deleted Member 3a5v73x]

A bottom-level MS support rep will know, at best, how to follow the instructions given in their training course, and has zero understanding of or patience for the complications caused by security geeks.

If he was to come at my home, spend hour trying to solve problem with my Office, and in the end tell me I need to reinstall it and still take 100$ of me, I swear to God I would punch him.

People need to educate themselves with Windows, learn and read. I don't know about Microsoft support, but local IT "proffesionals''' are sucking dry people around globe every day, even as for some simple installing/uninstalling programs or removing annoying toolbars in browsers.

 

[shmu26]

what happens if you enable some ASR rules?

The answer is yes and no: Q&A - ConfigureDefender utility for Windows 10