How to allow "red alert" items in MSE

[MarkC0]

MSE has detected a "severe alert" item and I cannot seem to allow it through. Observe:

How would I go about allowing the item through? Checked the other sections and while it allows the option to create exceptions, these files are yet to be placed in the list.

 

[FaberTech]

I did a little looking and found this. hope it helps

How do I allow programs that generate "high" or "severe" alerts in MS Security Essentials? - Super User

 

[MarkC0]

Thanks for the link, unfortunately though it presents no real solution for this particular item outside of re-installing the A/V. However it does present a solution that would work from this point forward, but is claimed to not work with any previously detected items. I will test doing a full scan again and see if that "resets" the other alert level, and allows me full control.

 

[Layback Bear]

I have a silly question.
Why would you want MSE or any security program to let a virus through?

Virus:Win32/Induc.A
http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Virus:Win32/Induc.A

 

[Barman58]

The only serious reason I can think of is a false positive alert for something you know is clean, there's also a few "Potentially Unwanted Programs" that may be flagged at a high level - just because they are dangerous, in the wrong hands. I have a few that can trash a system if you don't use then correctly

 

[Layback Bear]

Thanks Barman. This virus doesn't seem to be a false positive because it seem to be block by many anti virus program.
MSE, Bitdefender, Eset, Sophos and probably more.

Detailed Analysis - W32/Induc-A - Viruses and Spyware - Threat Analyses - Threat Center - Sophos

I would recommend not give permission for this infection to enter any computer.

 

[Barman58]

It's a strange virus, it was included in the def's back in 2009, and is targeted to exploit Delphi code, not that common a dev. package these days, and in this time I would imagine Delphi would have patched the vulnerabilities long ago

 

[Layback Bear]

You would think so. It could be cause by something old be downloaded using a torrent.

 

[Barman58]

What's not clear from the report is if the Win32/Induc.A ident shown by MSE is for the original Delphi infecter code or the code showing in an infected program created by an infected copy of the Delphi IDE, if that makes sense

The original code that infects the Delphi IDE would probably be of little consequence, to most users, (who are not Delphi Developers), whereas the second option could affect many, I would assume they would have a separate code and cure for the secondary infection type but it's not clear. The fact that it's rated High risk would lead me to believe this is a secondary infection type, but not sure

 

[Layback Bear]

It's hard to read the OP post #1 picture but it appears to be a game mod tool from July 2000.

 

[Alejandro85]

A known false positive is a good reason for an "allow" option, no antivirus should prevent completely the user from doing that, but it should advice not to do it though, preferably as loudly as possible.
No idea if this is the case, but it can be that a legit file gets detected as a very dangerous virus by error (and as well as possible is that the virus is really there)

I particularly hate when antiviruses just keep deleting the EICAR file as soon as I throw it at them.

 

[Layback Bear]

I understand you thoughts Alejandro85. I just thinking that if that many anti virus programs claims it to be a virus why would one think it's a false positive.
Considering it is from 2000. Anything that old I would think a false positive would of been take care of in 13 years.
Me personally will not assist someone to install a virus.
Any one installing virus for testing purposes would have the knowledge needed they wouldn't be asking us how to install it.

 

[Jacee]

Good article by a Kaspersky Lab Expert on Induc.
Induc, the innovative file infector - Securelist

 

[Layback Bear]

Thank you Jacee for the information.
Would you knowingly allow this infection on your computer?

 

[Barman58]

Good article by a Kaspersky Lab Expert on Induc.
Induc, the innovative file infector - Securelist

Thanks Jacee, am on phane atm so will read the info in the morning when at a pc

 

[Jacee]

Thank you Jacee for the information.
Would you knowingly allow this infection on your computer?

Probably not, even tho' I know I don't have any versions of Delphi installed.

 

[MarkC0]

The tool I'm using was created from scratch by a forum regular and modder in the GTA community. It's been around for awhile and pretty commonly used. It changes the weather data in GTA IV basically, but it's included in a larger package that allows you to edit the image files containing game data.

I think I asked him about this last year or something, and he said it was common for A/V to detect cracks (which I don't use) and game hack tools as malicious.

I'll have to look through this thread more carefully perhaps, I'm not really quite sure of the terminology being used however. I guess I should ask then, is it possible for someone to create a non-malicious program that would nonetheless show up as this infection?

More info: The infected file is file format ASI. These files are loaded using an "ASI" loader, which is a DLL file placed in a given game directory, that will load each ASI mod when the given game is launched.

"ASI is a file extension for an assembly language file used with Borland Assembler. ASI stands for ASsembler Include. ASI files are created using the Turbo C or Borland C++ programming languages, which are very close to machine code (also referred to as assembly code). ASI files can be opened and edited by Borland Assembler."

 

[Barman58]

As Borland are the original developers of the Delphi Development package the ASI file extension fits.

As your "Modder" states, it is not unknown for an AV to tag a tool, used to alter "system Files", as bad.

However, this is normally reported to the user as a Potential problem, (PUP's or Potentially Unwanted Program). In this case however, MSE and other AV packages all flag this file as a known threat "Induc", whereas if it was a more general warning the threat level would usually be lower, and the reports show their own PUP advisory warning.

IMO, at some time the developer of your tool has been infected by the virus concerned, and thus this is not a false positive.

I would strongly advise you not to let this through your defense, as you cannot be sure If or what any payload may be.If you have contact with your modder I would suggest you make them aware of the full details, (given in the links here), of this potential infection and that they should scan and repair their system before more systems become infected.

The potential for future issues here is serious - the infected code is spread out amongst the gamers using this mod, and someone other than the original virus developer uses the Induc. hooks, present in these systems, to introduce a payload