Tutorial Simple tutorial to prevent the downloading virus payload and block non-signed programs

[trumpthatbitch]

Malwarebytes Windows Firewall Control (WFC)

You must be registered to see the links

 

[trumpthatbitch]

1. Should only receive notifications for applications non-digitially signed.

2. Can manually add exceptions to exes via a context menu

3. Although rare it is possible for viruses to be digitally signed. These settings are meant to keep prompts to a minimum

4. Setting up UAC properly will prevent settings being changed without elevation

 

[trumpthatbitch]

Malwarebytes recommends running the digital signing option at the beginning for a couple of hours and then switching over to display notifications. That seems like the better option to keep prompts to a minimum while providing maximum security.

 

[walkin]

Hello, Do you recommend turning off Kaspersky firewall for Malwarebytes?

 

[trumpthatbitch]

Hello, Do you recommend turning off Kaspersky firewall for Malwarebytes?

I am not familiar with Kaspersky Firewall, so I couldn't tell you which one is better. You should only have one firewall enabled at a time. In most cases, Windows will detect other firewall software as installed and will automatically disable the Windows firewall.

The only issue with Windows Firewall is it employs path rules and does not save the file hash of the exe that is being whitelisted, so it is unable to track changes, and the EXE will remain whitelisted regardless if it is replaced or updated. Malwarebytes really is just an interface for Windows Firewall, so it has the same issue. Of course it's also possible for the executable to not be infected at all and for the libraries to be infected, which is actually what is happening here with the current Ren'Py virus downloader, which runs from a separate Python file or Unity library and doesn't touch the actual exes. Still, it would be nice to have to limit the surface of attacks, and if I were to install another 3rd party software with a more advanced firewall, I would look for one that recorded and tracked file hashes of the whitelisted files and firewall rules and generated new prompts when it detects a change in the file hash.

This is really meant as a simple guide that anyone can use to protect themselves against the current form of the virus using free lightweight software.