An approach for configuring Defense+ for many fewer alerts

[Guest]

[petrossa]

tnx for pointing me in the right direction. I made new predefined security policy called: Unprotected.
Gave it all access and no protection. Gave the dll this policy. Sofar no hook warnings.

[aditya_dmj]

In my opinion D+ is heavily loading the system . it is also adding the numerous keys under HKLM\System\....
everyone agrees that system hive is very critical for booting & its size should not be increased.

there are two solution move Hips or Firewall settings to disk as registry keys are  files on disk too.

second solution is to reduce the numbers of checks in D+ they should be limited only to Protected registry keys, Com and Interprocess memory access.

As by blocking Interprocess memory acess we can block program like google updater which does not connect directly to internet to download instead piggyride on svchost to download files.

Regards

Adi

[Tags:]