A security researcher is taking Microsoft to task for advising customers to exclude certain files and folders from anti-virus scanning, arguing the practice could be exploited by pushers of malware.
Microsoft issued the recommendations in October, as a way of improving system performance:
http://support.microsoft.com/kb/822158 They suggested administrators exclude certain files used by Windows Update, Automatic Update, and security features in six different versions of the Windows operating system.
In a blog item posted Monday, David Sancho, a malware researcher at Trend Micro, warned the recommendations put users at risk:
http://blog.trendmicro.com/microsoft-virus-scanning-recommendations-bring-risks/"Following the recommendations does not pose a significant threat as of now, but it has a very big potential of being one," he wrote. "Cybercriminals may strategically drop or download a malicious file into one of the folders that are recommended to be excluded from scanning, or use a file extension that is also in the excluded list."
Microsoft's recommendations stem from the belief the scanning of certain files is unnecessary and detrimental to performance.
"These files are not at risk of infection," the October Microsoft article said. "If you scan these files, serious performance problems may occur because of file locking." The recommendations pertain to machines running Windows Server 2008, Windows Server 2003, Windows 2000, Windows XP, Windows Vista, or Windows 7.
(Register)
Total Members: 14197
, you should not be advising anyone especially not corporate customer's to put things like MS update in the AV's white list....