MAS Mis-Handles Restricted Site Entries

[SteveT]

This is a design observation of MAS, the enclosed sample
is not meant as a specific exception suggestion, but
rather as an example:

The product is finding Reg Keys in:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Internet Settings\ZoneMap\Domains
without regard of key value, and suggesting they be
deleted. With a value of 4, this is meant to exist as a
site purposely placed in the "Restricted Zone" by the
computer user. The product should inspect these keys a
bit deeper and determine why they might exist. If "Always
Ignore" is selected, will it only ignore this entry if the
value (in this case, 4) is the same?

Example:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Internet Settings\ZoneMap\Domains\searchsquire.com]

 

[SteveT]

Further testing reveals that the reg value is taken into
account, since in my second run after changing site from
Restricted to Trusted, it now calls the threat "An IE
Trusted Zone Hijack". This is good, but more should be
done about Restricted's getting caught in the first place.