Scripts and MS Antispyware

[2ffat]

Microsoft posted an article on their Technet site about the problem with scripts and their Antispyware. See:

http://www.microsoft.com/technet/scriptcenter/resources/articles/antispy.mspx

A question was posted on Buqtraq asking if this could be used by spy writers to by-pass the software. Any ideas?

James P. Cottingham
-----------------------------------------
^{To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.}

 

[aquias]

Doubtful, at least in my opinion. I'm not a programmer so if I'm off, someone else hop in!

But, if my understanding of what I read is correct, for a spyware program to bypass your protection, it would have to know of an approved script name/location on your system. Or, it would have to fool the system into someone believing the script was approved.

Spyware makers may be able to attempt to run a discovery of approved scripts or, begin to include generic scripts in their software (IE C:/My Documents/test.vbs) in an attempt to hit on approved scripts. But, this would put a lot of them into the position that they've been trying to avoid.

Many spyware manufacturers are currently screaming they are legitimate. Taking actions, like the ones that would be required for this, would clearly demonstrate that they are attempting to compromise the machines security.

However, this is the perspective of a hardware/network geek, not a developer.

 

[iamnotageek]

Just tried that link and got "our apologies, this content has been removed from our site. In a moment you will be redirected to..." and it goes to the home page. Sweet!