3 more things i can do to harden my system?

[JohnCoder]

What are 3 doable things i can do to further harden my Windows 7 Ultimate 64 system? nothing too complicated even though i am a geek of many decades. This is for a personal PC, not a server. I already have a separate Superuser account so I can daily use a regular user account, strong passwords, Avast antivirus for realtime security as well as Windows Firewall on and Malwarebytes for additional scanning. Firefox has addons like DoNotTrack, Better Privacy, Ghostery. My email has Spamassassin. I don't open emails claiming to be from banks etc wanting account info, I do not open attachments that look suspicious (sometimes I have saved attachments to then scan just for fun to see they are indeed malware, then I shred them). I copy+paste usernames/passwords off a usb stick into forms on known financial accounts rather than type to avoid keystroke logging malware if it was on my system.

So, are there a few pretty simple things I could do to further harden my system?

 

[Tookeri]

Javascript can access the clipboard, so to use a good Password Manager would be safer than copy+paste.

My favorite Firefox security addon is NoScript. If you do not have it, at least check it out.

Sandboxie is a great protection, especially for browsers.

You could use an anti-exploit software. The easiest ones to use are not free for example Malwarebytes Anti-Exploit, and the great free one EMET (Microsoft) might be difficult to configure so it's compatible with all you programs. I don't mind a perhaps difficult configuration as long as the product is free.

 

[JohnCoder]

I will add NoScript to Firefox. I know nothing about Sandboxie, will have to look at that.

I am not a fan of paid subscription software, can be hard to stop a software or service subscription sometimes depending on the vendor, etc.; unless using a disposable credit card. I love free software so I will take a look at EMET and if i can not figure it out I might get a disposable credit card for MB's Anti-Exploit software.

 

[1PW]

Hello JohnCoder:

1. Backups, backups & backups. Update, update & update.
2. If not done already, upgrade Malwarebytes' Anti-Malware to the fully enabled premium version. Prevention is always better than cure.
3. Install, update, and keep current: Brightfort's free SpywareBlaster®.
4. Populate your system's HOSTS file with http://***********.mvps.org/hosts.htm. Installing the free HostsMan - abelhadigital.com automates this nicely.
5. Uninstall all current & past versions of Oracle's Java with the free JavaRa - SingularLabs.
6. If you use Adobe's Flash Player plug-ins/extensions, try to update them the same day they are updated.

Do any three you wish. Then do the other three...

HTH

 

[JohnCoder]

... EMET (Microsoft) might be difficult to configure so it's compatible with all you programs. I don't mind a perhaps difficult configuration as long as the product is free.

Installed!

 

[Tookeri]

Congrats

I wrote a short description of Sandboxie here: http://www.sevenforums.com/system-security/342986-trying-secure-my-computer.html#post2865134

 

[Tookeri]

About EMET I should add that it's when you try to start programs protected by EMET you might experience problems. Usually EMET alerts with a message of which mitigation wasn't compatible with a program. You can then go into Apps in EMET and uncheck that mitigation for the specific program. Then restart the program that crashed to see if it works.

 

[JohnCoder]

About EMET I should add that it's when you try to start programs protected by EMET you might experience problems. Usually EMET alerts with a message of which mitigation wasn't compatible with a program. You can then go into Apps in EMET and uncheck that mitigation for the specific program. Then restart the program that crashed to see if it works.

Yup, already happened to me; i added Firefox and then i could not get Firefox to run, so I went in an removed Firefox from the apps list in EMET. I guess i need to RTFM lol. But at least it was painless to install EMET and just go with the automagic default install for now, I feel a bit more secure until i read the fine manual on EMET. Never heard of EMET before, thanks for sharing this resource!

 

[JohnCoder]

... Uninstall all current & past versions of Oracle's Java ...

. Don't I kind of need Java on my PC for games and other software?

 

[Tookeri]

i added Firefox and then i could not get Firefox to run, so I went in an removed Firefox from the apps list in EMET. I guess i need to RTFM lol.

Yes obviously, because that way Firefox isn't protected by EMET anymore

I wrote some general advice here regarding the new EMET 5.0 that might help if you run into problems
http://www.sevenforums.com/tutorial...on-experience-toolkit-emet-7.html#post2857216

 

[JohnCoder]

i added Firefox and then i could not get Firefox to run, so I went in an removed Firefox from the apps list in EMET. I guess i need to RTFM lol.

Yes obviously, because that way Firefox isn't protected by EMET anymore

I wrote some general advice here regarding the new EMET 5.0 that might help if you run into problems
http://www.sevenforums.com/tutorial...on-experience-toolkit-emet-7.html#post2857216

Very useful thank you! I have Firefox running now with EMET. Used your info post to uncheck some of the mitigations in the EMET GUI. Also EMET popped up something about SimExecFlow mitigation error when I tried to run Firefox so I unchecked that mitigation also. I mirrored the settings for Firefox with some other apps I added to EMET (Gimp2, 7zip, Libreoffice, etc), so at least they will run; I can gradually check more mitigations with time.

 

[1PW]

Don't I kind of need Java on my PC for games and other software?

If you don't need Java at all, you are that much better off. If you do require Java, Use JavaRa to rid your system of older vulnerable versions. Then, understand that Java will likely always be a weakness in your system.

 

[Tookeri]

I agree. Java is one of the most vulnerable programs nowadays. If you absolutely need it verify that it's protected by EMET. If you used the recommended setup for EMET it should've added Java's executables.

One more advice: Free Computer Security - Personal Software Inspector (PSI) - Secunia
It checks most of your installed programs for security updates. That's the great thing about it, it doesn't update a program only because there's a new version available. But only if the current version is vulnerable and it's fixed in a new version. And it has a huge list of programs it watches. The default configuration is to update automatically so you might want to change that to manual if you want full control.

 

[JohnCoder]

Don't I kind of need Java on my PC for games and other software?

If you don't need Java at all, you are that much better off. If you do require Java, Use JavaRa to rid your system of older vulnerable versions. Then, understand that Java will likely always be a weakness in your system.

DO i need java? I really do not what if any software requires Java. I use my Windows system for word processing, spreadsheet, some gaming (Skyrim via Steam, Battlenet/Diablo/etc, Unreal Tournament), screenwriting, web/internet/email; music composing with software like PLAY, Kontakt, Cubase, Reaper; video editing with Adobe After Effects and Sony Vegas. Maybe I do not need Java? I guess worst case I remove Java and if an app needs it then i install it at that point in time?

 

[1PW]

I'm sorry, but I'm not the least bit familiar with which of your applications might require Oracle's Java Runtime Environment (JRE).

But that reads like a good plan anyway, and if JavaRa is properly used, you could be assured of the removal of obsolete and vulnerable remnants.

 

[andrew129260]

... Uninstall all current & past versions of Oracle's Java ...

. Don't I kind of need Java on my PC for games and other software?

Java is almost never needed nowadays, and if you do have it installed, at the very least keep it updated constantly, and disable it in your web browser.

Adobe reader is unnecessary, as most browsers have built in pdf support. If you have chrome, you can uninstall adobe flash as it is built into chrome and is constantly updated.

That eliminates the 3 most common attack types right there.