2
I have wrote a little script that will automate downloading and running a program, however when invoking the script from command line, Windows Defender will enter the scene warning user that malware is detected, disabling and deleting the script!
How can I stop Windows Defender deleting this script?
Code:
strFileURL = WScript.Arguments.Item(0) 'download url
strHDLocation = WScript.Arguments.Item(1) 'path to exe
Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
objXMLHTTP.open "GET", strFileURL, false
objXMLHTTP.send()
If objXMLHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
objADOStream.Open
objADOStream.Type = 1 'adTypeBinary
objADOStream.Write objXMLHTTP.ResponseBody
objADOStream.Position = 0 'Set the stream position to the start
Set objFSO = Createobject("Scripting.FileSystemObject")
If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
Set objFSO = Nothing
objADOStream.SaveToFile strHDLocation
objADOStream.Close
Set objADOStream = Nothing
End if
Set objXMLHTTP = Nothing
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.Run WScript.Arguments.Item(1)
shell.SendKeys"{ENTER}"
3Have you tried to exclude your script file from checking in Defender options? – Nafscript – 2015-07-03T09:49:39.980
Yes but it ignores the wihtelisted file – Riccardo – 2015-07-03T15:20:41.027
Had to delete previous comment. once realtime protection is restarted it will delete the offending file although whitelisted – Riccardo – 2015-07-03T15:50:55.023
Install an AV that is more configurable, every new incarnation of Defender has fewer user settings, W10 Defender is even worse than W8. – Moab – 2015-07-03T16:47:12.763