Virus protection

[genet]

Google found the following link: How to make a disallowed-by-default Software Restriction Policy

 

[visruth]

A perfect combination in my opinion that I have implemented except for SRP for which I seek guidance are as follows:

1. Windows Defender or any of the free Av
2. MBAM Premium
3. EMET

Last but not the least login as Standard User

Also your first line of defense should be a completely patched system not limited to OS only but all installed programs

Though not an Antivirus but excellent to have WinPatrol

I have WinPatrol Plus.
It gives good info on files you are unsure of.

Only 1 AV at a time.

I use Avast Internet Security.
My computer is virus & adware & malware free.

Good surfing habits help a lot.{no porn or torrents, etc.}

I have Kaspersky, MBAM free, EMET now in my system.
What does WinPatrol do, that none of the previous ones doesn't? I haven't heard about it till now, noob in this area too

Torrenting is widely prevalent here, though I don't do it mainly because of security concerns.

 

[visruth]

except for SRP for which I seek guidance

I don't mean to hijack this thread Admins/Mods please delete if it's infringement

Someone please give good pointers or step-by-step tutorial

Thank you

So after going through what genet found out, I understand that SRP is same as Parental control, correct?

There are lots of autorun worms flying around here. Earlier days, almost all of my flash drives & EHDDs were filled with them hidden. It'll come back even if you delete it that time. I didn't have any success with any of the top antivirus solutions in getting it off from them (probably because my system too had it then in those days ). Will activating parental control taker care of that?

 

[David Bailey]

WinPatrol gives info---



It also alerts one about various attempted changes.
Like plugins,homepage, startup programs, etc.

The free version is good.

 

[visruth]

It also alerts one about various attempted changes.
Like plugins,homepage, startup programs, etc.

The free version is good.

Means it'll give real time notification while you're on your work in Windows?

 

[David Bailey]

It also alerts one about various attempted changes.
Like plugins,homepage, startup programs, etc.

The free version is good.

Means it'll give real time notification while you're on your work in Windows?

Yep.
Real time protection.
All future updates to it are free.

edit--- WinPatrol - Ruiware, LLC

 

[visruth]

It also alerts one about various attempted changes.
Like plugins,homepage, startup programs, etc.

The free version is good.

Means it'll give real time notification while you're on your work in Windows?

Yep.
Real time protection.
All future updates to it are free.

edit--- WinPatrol - Ruiware, LLC

Will give this a try, hope it doesn't hog the resources..
Thank you David

 

[David Bailey]

I've used it for years.
It doesn't slow down my computer.

 

[visruth]

Downloaded WinPatrol. Is there something I should configure after installing it? Or let it do its work?

 

[David Bailey]

Downloaded WinPatrol. Is there something I should configure after installing it? Or let it do its work?

You might want to look at Options & all the rest too.
It helps to click on all the tabs & get used to it.

 

[visruth]

Thanks for that David. It's all configured now.

 

[David Bailey]

Thanks for that David. It's all configured now.

I think you like it.

 

[gaming]

Also your first line of defense should be a completely patched system not limited to OS only but all installed programs

I should have mentioned Secunia PSI

 

[visruth]

Also your first line of defense should be a completely patched system not limited to OS only but all installed programs

I should have mentioned Secunia PSI

I had Secunia earlier, but had to uninstall it completely because Kaspersky found some vulnerability in it

 

[arachnaut]

Second thing, can EMET be installed in my PC - it already has KIS & MBAM free. Will there be any conflicts , resource hog? (I've SSD already in my lap as boot drive)

Thank u very much

This will depend on how you set it up. I have not noticed any resource issues or real-time problems. But I have noticed a few programs that need to be tweaked - usually older stuff or the big bundled packages.

I set it up for extreme checking:



I volunteer in a local Senior Center PC lab where we have 10 PCs running Windows 7, 8, Mac, Linux and Chromebox.

On the PCs we ran the Live Essentials (or Defender) and Malwarebytes. We encountered a serious trojan infestation recently and switched to Kaspersky AV because it detected and fixed the problem, but the older ones didn't. We've intercepted a few viruses on user USB thumb drives since then.

 

[visruth]

Second thing, can EMET be installed in my PC - it already has KIS & MBAM free. Will there be any conflicts , resource hog? (I've SSD already in my lap as boot drive)

Thank u very much

This will depend on how you set it up. I have not noticed any resource issues or real-time problems. But I have noticed a few programs that need to be tweaked - usually older stuff or the big bundled packages.

I set it up for extreme checking:

View attachment 51539

I volunteer in a local Senior Center PC lab where we have 10 PCs running Windows 7, 8, Mac, Linux and Chromebox.

On the PCs we ran the Live Essentials (or Defender) and Malwarebytes. We encountered a serious trojan infestation recently and switched to Kaspersky AV because it detected and fixed the problem, but the older ones didn't. We've intercepted a few viruses on user USB thumb drives since then.

Okay, I've changed it to extreme checking. How can I tweak the programs & how will I know which programs are to be tweaked?

Also, I don't see any processes marked "green" under running EMET in mine when I compare mine with the above screenshot.

 

[arachnaut]

You have to add the processes you want monitored one-by-one.
Then you have to select what things you want it to monitor.
You should read the documentation to figure out what has to be done. It's not a simple tool.

Check the event viewer for EMET logs (you can make a custom filter).

After you add a process to EMET you will need to restart that process to see if it works or not.

If it doesn't work - either don't monitor it or try different settings on the monitor.

 

[visruth]

You have to add the processes you want monitored one-by-one.
Then you have to select what things you want it to monitor.
You should read the documentation to figure out what has to be done. It's not a simple tool.

Check the event viewer for EMET logs (you can make a custom filter).

After you add a process to EMET you will need to restart that process to see if it works or not.

If it doesn't work - either don't monitor it or try different settings on the monitor.

Thanks for that Jim. I got a headache (no offence intended) , while configuring each process one-by-one and I still dont know what the different mitigations still does to each app.

In some I'm getting an error (something like C:\Windows\explorer.exe conflicts with c:\windows\explorer.exe) everytime I try to configure. I did apply all the mitigation in one or two without any problems.

But, in some other while applying them, get another windows asking for module name and something like that.

While applying to some other, a message came asking for stopping the process automatically.

Now, my doubt is that, I could see EMET also listed in the processes - can i apply all mitigations to it too? Next, can i apply all to Kaspersky, Adobe , iexplorer, explorer.exe just like that?

 

[arachnaut]

You may have a process, like Explorer, running several instances. So when you make the second entry, you get that message.
I have taken the default settings on everything that runs normally, except for my antivirus scanner - Kaspersky, which I excluded.
I included EMET in the settings.

I did get a few problems with some things - they would not run or I got an error.

Sometimes this would happen long after I made the entry so I forgot that EMET may be involved.

Now, if I see an issue with something, I disable EMET to see if it goes away.

For the most part, it appears to be well-made and only some of the older software had problems.

When you install EMET you should use the pre-built list of exceptions and then add to it.
That list includes Office and many other common software programs.
Not every exploit mitigation is checked for each program.

Basically, you want to cover the common ones, because it would be rather rare to encounter an exploit for a little-used application.

 

[visruth]

What do you mean by 'default settings' - is it all mitigations applied or not change the mitigations already 'checked'?

What do you mean by 'exceptions'? Should I not apply all mitigations to these exceptions?