1 Reply Latest reply on Oct 1, 2011 5:23 AM by exbrit

    Word "autosave" .asd files quarantined as 'low risk' exploit - false positive?

      Security Centre is marking automatic backups [autosave .asd files] from Word 2010 as an exploit and put into quarantine. ["Exploit-MSWORD.a" http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=141098 ] As described by someone else here: http://forums.majorgeeks.com/showthread.php?t=242036 and perhaps same issue here:https://community.mcafee.com/thread/30968 . The actual word file reads clean but the temporary auto-backups are detected as the exploit mentioned on those forums. Separate scans of the files with other virusscanners turn up nothing. Looks to be a false positive (or maybe the detection is not anyway for an actual virus but just a situation where a virus could take advantage?)

       

      I use the very common Thomson Endnote citation software which integrates with Word and creates links in the documents to the database of citation references, so I wonder if this is something that McAfee finds suspicious.

       

      Over the past few weeks I have been sending the quarantined files to McAfee through the Security Center as they are detected, but would like some self-help in the short-term as I'm in the last days of working on my PhD and am worried that this may screw up something important in the files for my PhD.

       

      I thought I would be able somehow to exclude these files, the directory, or the 'exploit' from McAfee, i.e. by putting in the 'trusted' list, but there seems to be no way to do this.

       

      So to sum up, the question is: how can I exclude these files, the directory, or the exploit from future scans. If McAfee puts them in quarantine I'm assuming they won't be in the right place for word to restore them if it crashes for any reason and that is obviously a problem!

       

      In the short-term I will turn on automatic scans as McAfee doesn't seem to do this other than when it runs a system scan.

       

      thanks for any help on how to put things on the trusted list!

       

      Matt

       

      Message was edited by: mattpollard on 30/09/11 17:23:39 CDT