False positive - Dameware

[Richard Ling]

Surprised to see Dameware on the list

This is used extensively as a support tool withi our
company

 

[Jacques]

But if you find it on your home computer you should worry. I think this will
be solved in the enterprise edition.

 

[JohnF.]

You will find that MSAS will tell you about several remote control
programs - sure you could use them legitimately but wouldn't you also want
to know if someone had loaded it onto you machine without your knowledge?

JohnF.

 

[Mikolaj]

Surprised to see Dameware on the list

This is used extensively as a support tool withi our
company

RealVNC (this one I know for sure, but most of VNC family products will, I
think) also appear on the list of detected items after the MS AntiSpyware
scan - but this is only information for user, that this software poses some
kind of security threat to the system and the user should be aware of it.
And of course - everything is OK when this kind of software appears as
intended to the system, but what if it was not intended? Then, used by THEM
;-), it appears to be a real threat and a spyware..

 

[Bill Sanderson]

I'll just chime in to support all the other responses:

Detection by Microsoft Antispyware doesn't necessarily mean that something
is in some way illicit or harmful.

Listing is based on specific criteria listed here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;892340

You might also be interested in this article, which may well be relevant in
your environment:

http://support.microsoft.com/kb/892375 End users may be prompted to allow or
block administrative actions that originate from a central management tool
after they install Windows AntiSpyware (Beta) on a computer that is managed
by Systems Management Server 2003

Additionally, here are a couple of other tidbits:
Unattended uninstall:

MsiExec.exe /X {536F7C74-844B-4683-B0C5-EA39E19A6FE3} /L *vx /Log
c:\msas.log /quiet

Unattended Install:
http://www.overdose.net/docs/msas_silent_remote_install.txt

-----------------------------------------
One more issue: there is a significant bug involving scripting with the
current beta builds.

On the first run of a script, when Microsoft Antispyware flags the script as
unknown and requires permission from a user for it to proceed--this
execution of the script loses directory/folder context. The script would
normally run in the context of the folder in which it is located, but
instead, on this first run only, will run in the context of \system32. This
can have results ranging from none, to failure of the script, to data loss.

Subsequent invocations of the same script work correctly. The developers
are aware of this issue and it is being fixed.

So--Dameware may be the least of your problems! As others have noted Remote
Control facilities that can be present and invoked without notice to the
user will be flagged by this product. This is by design. Microsoft has
stated that they will produce a version of this product designed for
enterprise environments and which will not be free. I would expect such a
product to have provision to exempt standard management tools from
disclosure to the local users.