Windows Defender

I know WD isn't popular here on Wilders but I wanted to share this anyway. I just found out you can use Windows Defender as a HIPS program WITHOUT being a member of their spynet community.

Everyone that I have talked to in the past have said that you must be a member of this spynet community to fully unleash its potential. I have unchecked the spynet box and am still using it's full HIPS functionality. After I unchecked this box....I had to go to options and check off the HIPS part as deregistering as a member deactivated some features of the HIPS part.

 

Yes...this is what I mean.

I don't see a difference in terms of HIPS functionality being a spynet member or not.

 

What's wrong with SpyNet? Every single other product forces you to use their version. At least MS lets you disable it and even warn you about it instead of hiding it away in a EULA or whatever. SpyNet is a good thing.

 

Who said anything is wrong with Spynet?....I sure didn't. I'm referring to what people have stated in the past about Spynet improving HIPS functionality. I'm only pointing out that it makes no difference if you are a member or not.

 

Alright, could you show me an example/screenshot of it's HIPS functionality in action?

 

MBAM loads its drivers and is allowed to do so as it's whitelisted under WD:

 

This kind of HIPS is a part of the new MSE too right? Atleast I think I saw options for SpyNet... Does it deliver a lot of prompts or is it still very seamless? Does it consider what's trusted (and not) before prompting the user?

 

Not sure - sorry

MS really does a great job whitelisting apps. When I installed the latest version of MBAM, it took MS just a few days to whitelist the app. No more prompts.

Regarding trusted and non-trusted apps, you choose how WD should notify you. You could set it to notify on both. (like I have it set to)

Also, WD is absolutely amazing at detecting trojans. Noone mentions it on Wilders but please test it for yourself. It is quite impressive.

 

There is no HIPS in MSE. Whether Microsoft will have Windows Defender in windows 7 for the HIPS component is unclear to me. SpyNet isn't the HIPS component, that's just the statistical component to help improve detection.

 

I'll give WD a go again Toby. Any recent tests on its performance/detection?

 

I'm not familiar with any documented tests but I test it myself quite often. Go to the 1 site that has tons of malware (ya know the 3 letter abbreviation) and test it there.

Make sure you have all of the boxes ticked like in my above screen shot.

Happy Testing!

Toby

 

As far as I know, WD uses the exact same signatures as MSE.

 

Interesting. I guess that's why it disables windows defender when it installs.

Wouldn't windows defender be much lighter? Found WD uses under 10MB of ram.

Toby, you might have to PM that site, my brain is dead today, so can't think which one you're referring to!

 

I did have it installed and in my sig.

Seems like a very interesting HIPS alternative. Could I as well run it alone on my AM front together with my sandbox?

 

Oh right, and will WD always be available even when they release the final version of MSE, being an alternative HIPS?

 

Testing it out now alongside MSE, seems alright. WD doesn't appear to have any anti-malware real-time protection (where MSE comes in) it appears to use the current definitions as part of identifying processes for it's HIPS function. Signed up to advanced SpyNet for both.

edit: Is there something I can do to test the popups? I've had none so far as I told it not to interfere with known trusted apps.

edit2: I actually just noticed the above URL is working for me now. I can only assume they will add in the extra WD functionality in a later MSE beta, but then, why would they be bundling WD in windows 7? Guess only time will tell...

 

elapsed, I've yet to see a detection popup, but have been notified to review actions. See below when hitman pro is run.

 

Did it stop that action from happening in the first place, or is it permitting it and then ask you later? - cause if it's the latter, it's obviously failing completely in case of real, new malware and other threats.

 

Permitting then asking you during. If you don't respond, the action continues.

I thought I'd select 'deny' this time, and the following prompts were available. Hitman Pro still finished its scan after deny was selected. Whether the updated driver is prevented from installing, won't know until restart.

 

From what I can tell, after restart, driver reports it was last modified when Hitman Pro was last run. Loaded Hitman Pro, and it runs just fine. Anything else WD would have done?

 

Most likely the drivers no longer loads . Check with MS Autoruns.

 

Interesting, thank you.