Unable to download WinPatrol/add files to the trusted items.

[Indicium]

Since a couple of days MSC 10.5 detected BillP Studios WinPatrol (WP 18.1.2010 and the latest version WinPatrol 19) as malware. Those files are quarantined. As I understood, there is no possibility to add (those) files to the trusted items.

Question: Is McAfee Incorporated 'already' working on a "workaround"/"solution"?

[exbrit]

I've used Winpatrol in the past so this must be something new.  In order to get it removed from the detection list please post the "Artemis" detection number in full if there is one.

Meanwhile read here:    https://community.mcafee.com/thread/2016

[poodles5]

WinPatrol is trusted on my pc- never had a problem with it-Correction, I did not know a new version was out- it must have been blocked by McAfee, sent files to McAfee and e mailed webroot support.my apologies

Message was edited by: poodles5 on 10/9/10 8:52:48 PM CDT

[Indicium]

Thank you. The downloaded versions of BillP Studios WinPatrol, which are stored on my computer, are (indeed) falsely detected as an "Artemis". I have no problem with the installed program. Maybe that's why BillP Studios WinPatrol (in some cases) is not detected.

It would have been a solution if the false positives could have been added to the trusted items. However, that is not possible! So I have to work without the new version of WinPatrol.

[exbrit]

Well can't you submit it as described in that link?  Someone has to otherwise it will never be taken off the database.

Also if anything is ever detected as Artemis that means the database knows about it so send an email to virus_research@avertlabs.com  with the Artemis detection name and the words "False Artemis!++++++" (where ++++ is the code given to it) as the subject/header line.

(Minus the "").

Also you can post a new thread in the Artemis Discussions with that False Artemis!++++++ as the header and that department will hopefully respond.

[Indicium]

Ex_Brit wrote:
Well can't you submit it as described in that link? ...

I have already send several files (WinPatrol, ClamWin, etc.) to McAfee Incorporated during the last couple of weeks. However, their "detection-files" are not adjusted.

[exbrit]

When submitted as per the instructions you should immediately get an automated response, then you should get a manu7al one and if they sday the wrong thing, i.e. it's an infection, then you should reply immediately disputing that.

The other way is to Email  support@WinPatrol.com  to see if they know anything.

[Indicium]

Ex_Brit wrote:
When submitted as per the instructions you should immediately get an automated response, ...
 

This was not possible as the files were already quarantined. When I was able to reach the files in the quarantine, I have send them by the 'internal' mail of MSC. However, I have got no reply from McAfee Incorporated. So, I turned off "real time scanning". The downloaded file (BillP Studios WinPatrol version 19) has been send to McAfee Avert Labs WebImmune and I have got the following result:

McAfee Avert Labs WebImmune wrote:
"inconclusive [ wpsetup.exe ]
Upon analysis the file submitted does not appear to contain one of the 200,000 known threats in the AutoImmune database. The file may contain a new threat, or no code capable of being infected. Your submission is being forwarded to an McAfee Labs Researcher for further analysis. You will be contacted by McAfee through e-mail with the results of that analysis." 

The problem would have been solved if it was possible to add files to the trusted items.

[exbrit]

The link I provided explains how to temporarily disable VirusScan so that you can restore the item from quarantine and then submit it (zipped and password protected).

The email you did receive should have been responded to immediately saying that it is not an infection and VirusScan is blocking it, as I already explained.

We have been asking for the reintroduction of file exceptiions for about 7 years now and so far they have ignored us, but we are told that it is possible in the near future that it will be added.

Message was edited by: Ex_Brit on 09/10/10 9:27:54 EDT PM

[Indicium]

Ex_Brit wrote:
We have been asking for the reintroduction of file exceptiions for about 7 years now and so far they have ignored us, but we are told that it is possible in the near future that it will be added.

Ignorant?! ... It is the end of business! Thanks!