Had a friend download something fishy, and MSE detected it (2 exploit packs) right away - however he tells me that he clicked "allow" for both, I don't know why.
Now, I'm sitting here with his computer, and sure enough MSE's history does say that 2 files were set to "allow" (Trojan:Mesdeh and a java exploit). However when I look at the logged location of the download, there is nothing to be found! He says he didn't delete anything, so where has this .zip package gone to? The MSE log also says it has been copied to mse's own quarantine zone (\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\), which I promptly deleted. But we can't figure out how the 2 files in question have been "allowed", yet the entire .zip archive that they were contained in is gone.
I'm running a full scan with MSE on his comp as I type this but it will take a while; so now I'm wondering will MSE even detect something that A) apparently isn't even there anymore and B) has already been told to "allow"? I don't see an option to remove or quarantine anything that has been allowed within MSE.
Did MSE just remove the entire archive even though it was told to allow files in the archive? Or is something else going on here?
-
If you've deleted MSE's history it'll detect it again. It may have removed it... I'm not sure. I don't really understand >_> you sent your friend a virus or a fake virus?
-
Ah, didn't know about deleting the history will force a redetect. I don't know where he found the files, it was hosted on one of those rapidshare clone sites.
I think it was an actual virus, but because I can't seem to find the files in question, I can't verify what it actually was...
I'm still really confused as to how mse can "allow" files yet remove the archive which contains the files? That's what I'm leaning towards for an explanation right now and there's not much sense in that! -
If it was an actual virus it could simply have moved itself. I dono. MSE's detecting things for me before and when I allow them it just leaves them alone.
MSE and "allow" option
Discussion in 'Security and Anti-Virus Software' started by hakira, May 13, 2011.