Reply to thread

Message

<blockquote data-quote="LaurentG" data-source="post: 935557" data-attributes="member: 91050">Yes, you&#039;re right, I just did the test and I have the same.This is very strange.... and make me even more doubtful than before on accuracy of&nbsp; AMSI-based detections of MSDefender....I don&#039;t remember exactly why I&#039;m using &quot;Msxml2.ServerXMLHTTP&quot; rather than &quot;WinHTTP.WinHTTPRequest.5.1&quot;As far as I remember, in the past, my scripts that dowloaded files from Internet were using &quot;Msxml2.XMLHTTP&quot; (not serverXMLHTTP...) , and some other were using &quot;WinHTTP.WinHTTPRequest.5.1&quot;. But I got some problems (I don&#039;t remember at all which ones). And it is on some forums that I found it was preferable to use &quot;Msxml2.ServerXMLHTTP&quot;. Indeed, this solved al my issues..... until this script (but at this time, I was not using MSDefender, but AVAST, as antivirus).And to be honest, I do not have any idea on the difference between these various solutions Msxml2.ServerXMLHTTP/ Msxml2.XMLHTTP / WinHTTP.WinHTTPRequest.5.1Anyway, if I didn&#039;t have found a solution to have my script working, your test could be one. But since it&#039;s OK splitting the script in two sub-scripts...Moreover, this kind of solution could help, but wouldn&#039;t be the answer to the initial question I ask with this thread : How to prevent efficiently Defender from considering a given VBS script as containing a threat ?We&#039;ve seen that there is no solution for threats detected by AMSI-based models... except maybe to send a request of &quot;False positive&quot; to MS.... provided MS give a really positive answer to the question you sent them yesterday....I&#039;m looking forward to getting MS answer....</blockquote>

[QUOTE="LaurentG, post: 935557, member: 91050"] Yes, you're right, I just did the test and I have the same. This is very strange.... and make me even more doubtful than before on accuracy of AMSI-based detections of MSDefender.... I don't remember exactly why I'm using [B]"Msxml2.ServerXMLHTTP" [/B]rather than [B]"WinHTTP.WinHTTPRequest.5.1"[/B] As far as I remember, in the past, my scripts that dowloaded files from Internet were using [B]"Msxml2.XMLHTTP" [/B](not [B]server[/B]XMLHTTP...) , and some other were using[B] "WinHTTP.WinHTTPRequest.5.1"[/B]. But I got some problems (I don't remember at all which ones). And it is on some forums that I found it was preferable to use "Msxml2.ServerXMLHTTP". Indeed, this solved al my issues..... until this script (but at this time, I was not using MSDefender, but AVAST, as antivirus). And to be honest, I do not have any idea on the difference between these various solutions Msxml2.ServerXMLHTTP/ Msxml2.XMLHTTP / WinHTTP.WinHTTPRequest.5.1[B][/B] Anyway, if I didn't have found a solution to have my script working, your test could be one. But since it's OK splitting the script in two sub-scripts... Moreover, this kind of solution could help, but wouldn't be the answer to the initial question I ask with this thread :[B] How to prevent efficiently Defender from considering a given VBS script as containing a threat ?[/B] We've seen that [B]there is no solution[/B] for threats detected by AMSI-based models... except maybe to send a request of "False positive" to MS.... provided MS give a really positive answer to the question you sent them yesterday.... I'm looking forward to getting MS answer.... [/QUOTE]

Verification