What is your take about not having a real time antivirus?

DesignHeaad9206 · Aug 11, 2024

Hi again!

So, this is new for me too. I always had an antivirus running. And since Defender became this good, it has been my choice: Defender in real time, Malwarebytes for manual scans.

Now, recently for several reasons I went into a quest to reduce all active processes that I don't absolutely need.
And I've been thinking. I never ever had a virus. Like, EVER. And I use Windows since 30 years.
I've always had my antiviruses set up so not to block things automatically and silently but to warn me of anything they would find. So I'm confident that I really never had a virus, not that I don't know because the antivirus got rid of it without telling me.
I simply have healthy internet habits.
Apart for not visiting shady websites and not clicking links in weird emails, I am equipped as follows:
- VPN with own DNS which block malware, phishing, tracking, etc.
- Firefox with the Enhanced Tracking Protection and all other protections in their maximum settings.
- AdGuard with all filters active.
- Router with a (simple, not configurable) firewall.
- Windows Firewall active (this always).
- I scan EVERYTHING that I download with both Defender and Malwarebytes before I do anything with it. Everything, not matter what.

In your opinion, is a real time protection always a must?
Atm I have disabled the real time protection and behavior monitoring of Defender, as also all Application Guard (Smart this and that) options. EDIT: But I left Core Isolation and Exploit Protection active.

Thanks

Ghot · Aug 11, 2024

DesignHeaad9206 said:
In your opinion, is a real time protection always a must?

No matter how careful you are... the answer to your question is YES!
Unless ofc, you never go online.

Berton · Aug 11, 2024

My take on a real-time/active anti-virus program running is to stop as many infections as possible before they can cause damage. Once a miscreant gets installed it can cause a lot of damage. Most infections now come when online but back-in-the-day with Shareware one could get infections embedded in the trial programs or on disks from other sources.

pseymour · Aug 11, 2024

I’ve never had a car accident, but I wear a seat belt. I imagine it’s a lot harder to put it on when I’m dangling out the windshield/windscreen.

TechnoMage2021 · Aug 11, 2024

The last time I was infected by a virus, was back in the days of DOS, before Windows.

Nowadays, the old Computer Virus is as much a thing of the past as a washboard or apple peeler.
The AV program of today is only meant to get your money, not save your PC.
Yes, that's my OPINION, and is based only on 40+ years of experience as a Computer Tech.

The most common problem today is the "Tracking Cookies" placed in your PC from almost every website you visit.
I can't even check my bank account balance, without getting a Tracking Cookie.
But, not to worry..... "Super Anti Spyware", either Pro or FREE, does a great job of finding and removing all those little Nasties. *
The advantage of the Pro version is that one can set it to update and scan every day at a prescribed time.
I have ten PC's, so I have the pro version of SAS on this PC, and the FREE version on the other nine, which I don't normally use for surfing the web.

* As a working PC tech, my worse case scenario with Tracking Cookies, was one little ladies' PC where I installed and ran Super Anti Spyware FREE, and it removed ~ 140,000 tracking cookies.

On my PC's where Windows Defender is installed and running, I never get warnings about "Virus Detected". It's just no longer a problem.

On my PC's running a Micro or Lite version of Windows, Windows Defender is not even installed. And I don't miss it!

Cheers Mates!
TM

PS: The last "Trojan Alert" I got from SAS, was a false positive. But it CAN, find and remove Trojans.

TairikuOkami · Aug 11, 2024

DesignHeaad9206 said:
In your opinion, is a real time protection always a must?

Not really since Vista thanks to UAC. People actually have to want to get infected.
AV can be exploited, since it runs as SYSTEM, some malware take advantage of it.
I would not advise anyone to run without AV, but default deny can protect PC.

Prevent Malware & Ransomware Infections on Windows PC | OSArmor

OSArmor is a Windows application that focuses on preventing malware and ransomware infections by blocking malware delivery methods and suspicious processes behaviors.

www.osarmor.com

I have not used AV since XP and in order not get infected, you simply disable malware.
I disable WSH (VBS) and I remove PowerShell, basically main attack vectors in Windows.

Malware Attacks Surge 30% in First Half of 2024

SonicWall observed a surge in malware attacks in H1 2024, with strains becoming more adept at defense evasion

www.infosecurity-magazine.com

DesignHeaad9206 said:
VPN with own DNS which block malware, phishing, tracking, etc.

Note that every DNS is different, just like AV, DNS can block 0% of malware or up to 99%.
I block 95% TLDs and NRDs, that effectively blocks almost all phishing, malware and C&C.

neemobeer · Aug 11, 2024

The TLDR answer is yes, you should have some type of real-time endpoint protection software. The premise is that malware is software and computers (operating systems) run software. The only different is the intent. To @TechnoMage2021 malware is still a very real and growing/evolving problem. Home users are a far more enticing target due to people with your mindset. You don't even need to know how to make malware these days, you can simply find a MaaS (malware as a service) or RaaS (ransomware as a service) outfit and buy ready to use malware/ransomware kits for deployment, phishing/smishing campaigns designed to push people to waterholes and you've likely hit 20-40% of your targeted victims. Even if you opt for a free version that's still better than nothing although when it's free your (the user) data is often harvested and sold off, so if you don't care about privacy by all means. Example case Avast fined $16.5 million for ‘privacy’ software that actually sold users’ browsing data

DesignHeaad9206 · Aug 11, 2024

pseymour said:
I’ve never had a car accident, but I wear a seat belt. I imagine it’s a lot harder to put it on when I’m dangling out the windshield/windscreen.

I saw that coming the moment I typed that sentence

I know what you mean but you also know what I mean, I suppose.

neemobeer · Aug 11, 2024

@TairikuOkami yeah LOLBins are common vectors of exploitation, yet plenty of malware don't rely on them.

pseymour · Aug 11, 2024

DesignHeaad9206 said:
I saw that coming the moment I typed that sentence
I know what you mean but you also know what I mean, I suppose.

I do know what you mean, and I know you're interested in preserving resources, based on your latest posts. On the machine I'm using to type this, Defender is using fewer resources than Windows Explorer. And neither can hold a candle to the resources consumed by the browser I'm using. You can run without anti-malware protection, sure, but if I were interested in making a Windows machine more efficient, I'd look elsewhere.

DesignHeaad9206 · Aug 11, 2024

TairikuOkami said:
I disable WSH (VBS) and I remove PowerShell, basically main attack vectors in Windows.

Malware Attacks Surge 30% in First Half of 2024

SonicWall observed a surge in malware attacks in H1 2024, with strains becoming more adept at defense evasion

www.infosecurity-magazine.com

Note that every DNS is different, just like AV, DNS can block 0% of malware or up to 99%.

I use Windscribe, in case that tells you anything.
Plus I have also the DNS filter of AdGuard active although I forgot to ask the guys @ Windscribe if that creates conflicts with their DNS.

I have no idea what WSH/VBS are, but I guess I'll find the answer in the link you provided?
And about removing Powershell, how do you do it, and do you also remove windows terminal and leave only the basic cmd?

DesignHeaad9206 · Aug 11, 2024

pseymour said:
I do know what you mean, and I know you're interested in preserving resources, based on your latest posts. On the machine I'm using to type this, Defender is using fewer resources than Windows Explorer. And neither can hold a candle to the resources consumed by the browser I'm using. You can run without anti-malware protection, sure, but if I were interested in making a Windows machine more efficient, I'd look elsewhere.

Absolutely, Firefox uses MUCH more resources than Defender. And I have tried to address that at least in part by going back to uBlock Origins which had always been my to-go choice, as I have noticed that with uBlock my fans get triggered less, but there are things that it doesn't block as well as AdGuard. That where I started looking elsewhere and pointed fingers at Defender.

But foodle it, I guess I will activate it again and hope in the best with the BIOS tweaks that I implemented recently.

TairikuOkami · Aug 11, 2024

DesignHeaad9206 said:
I have no idea what WSH/VBS are

Windows Scripting Host. When people say that malware runs by itself, that is what it uses. You can basically disable malware. :lmao:

Code:

reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\WOW6432Node\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f

MS has recently disabled at least VBS in Windows, thus malware moved to PowerShell instead.

https://www.bleepingcomputer.com/news/security/microsoft-to-kill-off-vbscript-in-windows-to-block-malware-delivery/

DesignHeaad9206 said:
And about removing Powershell, how do you do it

Note that by default Windows includes old and vulnerable PowerShell 5, though there is already version 7.
Removing version 5 can break some apps and some features, but it is well worth it. You can also restrict it.

Code:

reg add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Restricted" /f
reg add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy" /t REG_SZ /d "Restricted" /f
reg add "HKLM\Software\WOW6432Node\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy" /t REG_SZ /d "Restricted" /f
reg add "HKLM\Software\Policies\Microsoft\PowerShellCore" /v "EnableScripts" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v "EnableScripts" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\WOW6432Node\Policies\Microsoft\PowerShellCore" /v "EnableScripts" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\WOW6432Node\Policies\Microsoft\Windows\PowerShell" /v "EnableScripts" /t REG_DWORD /d "0" /f
reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "__PSLockDownPolicy" /t REG_SZ /d "4" /f

taskkill /im PowerShell.exe /f
taskkill /im PowerShell_ISE.exe /f
taskkill /im pwsh.exe /f
takeown /s %computername% /u %username% /f "%ProgramFiles%\WindowsPowerShell" /r /d y
icacls "%ProgramFiles%\WindowsPowerShell" /inheritance:r /grant:r %username%:(OI)(CI)F /t /l /q /c
rd "%ProgramFiles%\WindowsPowerShell" /s /q
takeown /s %computername% /u %username% /f "%ProgramFiles(x86)%\WindowsPowerShell" /r /d y
icacls "%ProgramFiles(x86)%\WindowsPowerShell" /grant:r %username%:(OI)(CI)F /t /l /q /c
rd "%ProgramFiles(x86)%\WindowsPowerShell" /s /q
takeown /s %computername% /u %username% /f "%WinDir%\System32\WindowsPowerShell" /r /d y
icacls "%WinDir%\System32\WindowsPowerShell" /grant:r %username%:(OI)(CI)F /t /l /q /c
rd "%WinDir%\System32\WindowsPowerShell" /s /q
takeown /s %computername% /u %username% /f "%WinDir%\SysWOW64\WindowsPowerShell" /r /d y
icacls "%WinDir%\SysWOW64\WindowsPowerShell" /grant:r %username%:(OI)(CI)F /t /l /q /c
rd "%WinDir%\SysWOW64\WindowsPowerShell" /s /q

DesignHeaad9206 said:
do you also remove windows terminal and leave only the basic cmd?

Yes, replacing this shortcut with CMD's shortcut gives me CMD in the start menu.

Code:

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

DesignHeaad9206 · Aug 13, 2024

TairikuOkami said:
MS has recently disabled at least VBS in Windows, thus malware moved to PowerShell instead.

Note that by default Windows includes old and vulnerable PowerShell 5, though there is already version 7.

So, the first script you gave was to remove VBS? But is it still needed if MS disabled it?

And the second long script does what exactly? Uninstall Powershell? Disable it?
Btw, if I install Powershell 7, would powershell 5 automatically be overwritten? And would PS7 be safe enough?
Or is it better to just remove/disable powershell completely, 5, 7 and whatever?

What about Windows Terminal? Is it a coven for malware too? Can it be uninstalled?

pseymour · Aug 13, 2024

VBScript isn't disabled or removed. It's only deprecated. It becomes a Feature on Demand (FoD) in 24H2, but will still be enabled by default. A couple of years from now, the FoD will be off by default. Eventually, they'll remove it entirely. There is way too much existing VBScript code out there for Microsoft to just turn it off now. This is the latest info I've seen: VBScript deprecation: Timelines and next steps

If you're not using VBScript for anything, my suggestion would be to disable Windows Script Host and stop there.

PowerShell 7 does not automatically replace PowerShell 5 (which is known as Windows PowerShell really). They are two separate things really, with a lot of common features.

I'm generally in favor of reducing attack surface, but I think removing PowerShell is a bridge too far. Especially Windows PowerShell (v. 5), so many thing rely on it, you're just asking to break something. In environments I've been where they were concerned about ransomware abuse of PowerShell, which is a legit concern by the way, I've blocked PowerShell processes from getting to the Internet. That's really all you need to do. PowerShell will still continue to function for local systems management tasks, but if a ransomware spaghetti tries to use it to download a payload or something, the firewall would prevent that communication. If you're on a Pro version SKU or higher, I would use Group Policy to setup these firewall rules, as rules you just configure in the firewall management console can be disabled by jerk-face ransomware miscreants.

Edit: I didn't say "ransomware spaghetti." I used a four letter word for feces that starts with T and ends with D. Tip of the hat to whatever system edited out that word but let me say jerk-face. :winkt:

DesignHeaad9206 · Aug 18, 2024

pseymour said:
If you're on a Pro version SKU or higher, I would use Group Policy to setup these firewall rules, as rules you just configure in the firewall management console can be disabled by jerk-face ransomware miscreants.

Yes I have Pro.
I never got much into Windows Firewall because I find it quite complicated and as you see I have the tendency to dive too deep in anything that I start, so I tend to postpone starting new things until I really have to, sometimes even contradicting all the effort that I put on enhancing privacy (as it would make sense that with such concern I prioritize learning what rules to create and what to delete in WF).
But your recommendation seems reasonable.
I used Chris Tech GitHub Windows tweak utility to default PowerShell 7 once. As you say, it doesn't uninstall the 5.
Would PowerShell 7 be safer against Ransomware? And would it be enough that it's the default, even if the 5 remains in the system?
Could you share how you prevented PowerShell from interacting with the internet?

pseymour · Aug 18, 2024

I wouldn't say PowerShell 7 is safer than 5. They both have features that can be turned on to make them safer, features that are usually not turned on.

Here is a guide from a few governments about keeping PowerShell while making it safer to have around.

As for the firewall rules, I create an outbound rule to block the program (see below). For the remote IP address, choose "Predefined set of computers," and select Internet from the drop-down box.

As for the program to block, I create rules for these. In almost all cases, these can be safely blocked. Exceptions need to be made sometimes in large environments, but in most cases, these do not need access to the Internet, and they are abused by ransomware folks.

Code:

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

%ProgramFiles%\PowerShell\7\pwsh.exe

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell_ise.exe
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

%SystemRoot%\System32\regsvr32.exe
%SystemRoot%\SysWOW64\regsvr32.exe

%SystemRoot%\System32\rundll32.exe
%SystemRoot%\SysWOW64\rundll32.exe

%SystemRoot%\System32\cscript.exe
%SystemRoot%\SysWOW64\cscript.exe
%SystemRoot%\System32\wscript.exe
%SystemRoot%\SysWOW64\wscript.exe

DesignHeaad9206 · Aug 18, 2024

pseymour said:
As for the program to block, I create rules for these. In almost all cases, these can be safely blocked. Exceptions need to be made sometimes in large environments, but in most cases, these do not need access to the Internet, and they are abused by ransomware folks.

So, these that you listed are the programs that you block in Windows Firewall?
Or is it a code to run in CMD to block them? It says code, that's why I ask, sorry if it's a stupid question.

pseymour · Aug 18, 2024

Those are the paths to programs I block. I put them in a code block because they're paths to files; old habit, sorry. :)

DesignHeaad9206 · Aug 18, 2024

pseymour said:
Those are the paths to programs I block. I put them in a code block because they're paths to files; old habit, sorry. :)

Oki, thanks, will disable all those now when I install Win in my new SSD.
But I've read the PDF which you linked. Not in depth, but still, I've read it and it seems like most if now all the reasons they give not to uninstall Powershell are for networking in business, like for remote control by administrators.
What about one single system, no network, not even HomeGroup?
Which apps/programs/services would not work if I remove PowerShell and Windows Terminal and leave just the classic cmd?