script blocking

[thedon57]

Yes it does, and that is why I asked the original question, it blocked a script....but I didn''t really understand what a script was....

OK thanks makes it clearer for me as well, by the way nice topic, cleared a lot of points up, in what brain I have anyway.

[timcan]

https://www.finjan.com/SecurityLab/SecurityTestingCenter/exploitFinjanPublicVBScriptDemo.aspMy avast pro failed this script test. Is there something I need to tweak? I downloaded analog x scriptblocker that FreewheelingFrank posted a link to (it works).I used IE for this test.

[Lisandro]

https://www.finjan.com/SecurityLab/SecurityTestingCenter/exploitFinjanPublicVBScriptDemo.aspMy avast pro failed this script test. Is there something I need to tweak? I downloaded analog x scriptblocker that FreewheelingFrank posted a link to (it works).I used IE for this test.

Again, is this script infected or not.
avast! just scans scripts, not block them.
Maybe the name of the provider brings this confusion: script blocker if it is infected.
AnalogX blocks all scripts you set it to do while running, asking if it should continue or not.

[SUSZANNAH]

now I am confused.......

[Lisandro]

now I am confused.......

Why?

[SUSZANNAH]

I assumed that when the script blocker flashes up...it it blocking a script......

[Lisandro]

I assumed that when the script blocker flashes up...it it blocking a script......

Your assumption is correct... I've just asked if the script was infected or not.
The user complains that avast! does not block the script. I just say that avast! will only block IF it it infected, otherwise, the scripts will run without any warning. Did I make myself clear this time? 

[SUSZANNAH]

ah sorry Tech my mistake......didn't read it properly.....

[timcan]

https://www.finjan.com/SecurityLab/SecurityTestingCenter/exploitFinjanPublicVBScriptDemo.aspMy avast pro failed this script test. Is there something I need to tweak? I downloaded analog x scriptblocker that FreewheelingFrank posted a link to (it works).I used IE for this test.

Again, is this script infected or not.
avast! just scans scripts, not block them.
Maybe the name of the provider brings this confusion: script blocker if it is infected.
AnalogX blocks all scripts you set it to do while running, asking if it should continue or not.

    Hi Tech, yes this script is supposed to be malicous. analog x blocks file extensions .vbs,.vbe,.js,.jse,.hta,.wsf,.wsh,.shs,.shb. I assume these are bad script only.I believe avast pro should have done this.Avast pro calls this feature "script blocking" not scanner.tim

[polonus]

Hi Susz and timcan,

If you have FF you could do script blocking with NoScript, I have this add-on there now for quite some time, and I am quite satisfied with it.. With one click you can block, block temporarily, unblock, unblock temporarily script. See this thread:
http://forum.avast.com/index.php?topic=15637.0.
Together with the Dr Web in-browser link checker I feel well protected. The real trouble starts when malicious script has been inserted into a site. This can be the route to so-called on-the-fly infection, be it irritant ad- or spyware or evenscumware and even worse nastiness. MS script hosting can be a means of running dangerous script unto your comp too. Here Bitdefenders' free checker can be helpful.

greets,

polonus

[Lisandro]

I assume these are bad script only.

Wrong. Not all the scripts are bad or infected. A lot of them are normal, legit, perfect.

I believe avast pro should have done this.Avast pro calls this feature "script blocking" not scanner.tim

It blocks after being scanned. It blocks the infected ones. Ok, could have another name but, after all, the user should know the behavior of the software that he/she is using.

[Abraxas]

Hi Susz and timcan,

Yes script is dangerous code that try to run on your computer from various sources, this could be a webside with this dangerous code embedded. So it could be useful to have something aboard your browser with which you could pre-scan a link (the place where you are going to click, but do not know if there could be dangerous script luring behind). Such a non-resident small plug in for your browser (also FF and Opera) exists it is Dr.Webs browser plug in. All the scanning is done outside your computer on the update server of Dr. Web at St. Petersburg (this service and the plug-in is free and in English). Oh yeh the link there is:
http://info.drweb.com/show/2653
The virus definitions are very regularly updated (nr. 2 in the world behind Kaspersky's). Susz install it into your browser, and whenever in doubt you might click into a site with malicious script embedded, pre-scan with Dr. Web, if they say it is OK, you can click the link, and eventually pre-scan the next link or a download-link. Feel a lot better and safer now?

greets,

polonus

I installed the Plugin (10Kb)  into FF and you just right click a link and there's a  report popup. Amazing 
Very informative thread everyone , plus good question to ask Susz !
Learn something new everyday 

[Umath]

I have my question.  Does Avast! script-blocking do its job in human language or computer language of script?  For I understand that script can be written in computer language, which is more various than human language with 01 combinations and is much tougher to be identified as malicious.  Analogue X and Script Sentry block every script but how does Avast! recognize malicious script?

[Lisandro]

Does Avast! script-blocking do its job in human language or computer language of script?  For I understand that script can be written in computer language, which is more various than human language with 01 combinations and is much tougher to be identified as malicious.

What will be the difference between scanning a script or a common program, an executable or zip file?
All files are 'translated' into binary combinations, aren't they? avast! should be able to interpretate the binary code in any situation.
If this was not possible, an antivirus won't be possible to run, it will have to block every program, script, etc.
avast! can analyse some 'souspicious' behaviors (for email and for the Behavior Blocker) but the most way it works is scanning not blocking.

[Umath]

Thanx for the reply, Tech.

Your ecplanation is reasonable and natural.

However, even in that case, it would be a good idea using both script blocker even if somebody is using the pro edition since script based virus varies and can be often unknown.  Setting script-blockers to deny every single script and makes exclusions according to the needs may not be innovative but rational.  A  good and informative thread, any way.