Menu
Windows 10 will allow apps to actively scan their content for malware

Windows 10 will allow apps to actively scan their content for malware

Developers will be able to have their apps talk to the locally installed antivirus programs through a new API

A Windows 10 laptop on show at Computex 2015 in Taipei

A Windows 10 laptop on show at Computex 2015 in Taipei

Windows 10 will have a new mechanism that will allow software developers to integrate their applications with whatever antimalware programs exist on users' computers.

The goal of the new Antimalware Scan Interface (AMSI) is to let applications send content to the locally installed antivirus product to be checked for malware.

According to Microsoft, this can have important benefits when dealing with script content in particular, because malicious scripts are commonly obfuscated to bypass antivirus detection. Scripts also typically get executed in the memory of the applications that are designed to interpret them, so they don't create files on disk for antivirus programs to scan.

"While the malicious script might go through several passes of deobfuscation, it ultimately needs to supply the scripting engine with plain, unobfuscated code," Lee Holmes, principal software engineer at Microsoft, said in a blog post. "When it gets to this point, the application can now call the new Windows AMSI APIs to request a scan of this unprotected content."

Scripting is not the only type of content that can be scanned with this new feature. Communication apps could scan instant messages for viruses before displaying them to users and games could scan plugins before installing them, Holmes said.

The Windows developer reference for AMSI says that the mechanism allows for "file and memory or stream scanning, content source URL/IP reputation checks, and other techniques." So, it potentially supports many types of content in many use cases.

Catalin Cosoi, chief security strategist at antivirus firm Bitdefender, doubts that the feature will have a significant impact over the next couple of years, because in order to be effective both application developers and antivirus vendors need to decide to use it. How many of them will do so remains to be seen.

"We obviously salute the initiative, but there's two sides to every medal," Cosoi said via email. Allowing applications to perform this type of scanning through AMSI shifts the responsibility to the app developers, he said. "Will they actually use the feature? Will their programs correctly interpret the answers provided by the antimalware engines and take the right decisions?"

There are many unknowns and it's not yet clear how aggressively Microsoft will promote the feature to developers -- or whether it will force it upon them -- and what are some of the downsides that will come with it, Cosoi said.


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags securityMicrosoftmalwareantivirusbitdefenderDesktop security

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments