Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 935570" data-attributes="member: 32260">It seems that this detection tries to fight any scripting code that wants to download something and run anything. It is invasive but safe for most home users because many malware samples try to do it. In enterprises, people use the Defender ATP paid version instead of Defender free and this version has an excellent Security Center, so managing such detections is not a problem for administrators. Home users who use such scripts can remove the detection (TrojanDownloader:HTML/Adodb.gen!A) by submitting the file to Microsoft. The detection name is rather informative:TrojanDownloader:HTML&nbsp; ---&gt; download something from the Internet,Adodb&nbsp; ----&gt; download via ADODB.Stream object.To this point, I like the way how Defender works. But, then the script is detected at the runtime by AMSI-based post-execution models. This detection is troublesome if cannot be whitelisted. It seems that Microsoft has a technical problem with it, so far.</blockquote>

[QUOTE="Andy Ful, post: 935570, member: 32260"] It seems that this detection tries to fight any scripting code that wants to download something and run anything. It is invasive but safe for most home users because many malware samples try to do it. In enterprises, people use the Defender ATP paid version instead of Defender free and this version has an excellent Security Center, so managing such detections is not a problem for administrators. Home users who use such scripts can remove the detection ([B][COLOR=rgb(184, 49, 47)]TrojanDownloader:HTML/Adodb.gen!A[/COLOR][/B]) by submitting the file to Microsoft. The detection name is rather informative: [B][COLOR=rgb(184, 49, 47)]TrojanDownloader:HTML[/COLOR][/B] ---> download something from the Internet, [B][COLOR=rgb(184, 49, 47)]Adodb[/COLOR][/B] ----> download via [COLOR=rgb(184, 49, 47)][B]ADODB[/B][/COLOR].Stream object. To this point, I like the way how Defender works. But, then the script is detected at the runtime by AMSI-based post-execution models. This detection is troublesome if cannot be whitelisted. It seems that Microsoft has a technical problem with it, so far. [/QUOTE]

Verification