[citation][nom]alextheblue[/nom]SmartScreen occurs BEFORE you install something. If it can tamper with SmartScreen, that means it is already running - in other words your computer is already compromised. At that point you're already vulnerable, why bother attacking smartscreen, when you can just open the machine wide and install whatever you want remotely? Silly.[/citation]They can only check for "known" hashes. Anything else either has to be blocked or left to the user to decide - and trojan horses are as old as Troy. Malware is designed for stealth. Once one unknown malware gets control and corrupts SmartScreen then any known malware will not be detected either.
And how is SmartScreen going to function if the computer is not connected to the Internet (or blocked) at the time the executable is installed, like from a Flash drive? Are they checking downloads in real-time also?
And how is SmartScreen going to function if the computer is not connected to the Internet (or blocked) at the time the executable is installed, like from a Flash drive? Are they checking downloads in real-time also?