The (correct) detection of light grey software

Roel Schouwenberg Kaspersky Lab

As brought up in my article in Virus Bulletin (see VB, October 2005, p.6), a new type of 'malicious' software is on the rise which can be considered as 'light grey'.

Since then some of these programs have made the news, with the introduction of the WMF exploit by people wanting to promote their light grey software being the main headliner. Several security vendors have dubbed these programs as adware or spyware, but is this classification actually correct? There is more than meets the eye.

As ICT is evolving we are seeing an increase in requests to detect 'regular' programs, such as Skype for instance, which is known to be almost impossible to block on the network level. What kind of implications does this have? Which way should the AV industry move in order to protect not only its customers but also itself from a legal point of view?

This paper presents a view on these questions, along with some proposed answers.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.