Norton Internet Security / Norton AntiVirus

[johna]

There have been a couple of reports lately of false positives being picked up by SONAR.

As a first step, can you submit the files to Symantec here with all the details and let us know the response you receive. If no joy there, please advise and I will have the matter investigated for you.

Thanks for your patience.

[Shridhar]

Hi!!!!!!

johna .

Well, I have submitted it to SSR .The response is expected to come by the next day.I will wait till tomorrow otherwise I will submit it to False Positives.

Now if you can get more info. , here are the tracking nos.  #9985206 and  #9985200.

[johna]

OK, thanks for that.

Let's wait and see the results of your submissions, we can go from there. 

Thanks again.

PS It may take up to 48 hours to receive a response from SSR.

Message Edited by johna on 10-20-2008 11:09 PM

[reese_anschultz · Accepted solution]

Shridhar,

I passed these two files past our SONAR team and they have identified them as false positive detections. Corrected definitions should be available some time tomorrow (10/22).

[Shridhar]

---

reese wrote:

I passed these two files past our SONAR team and they have identified them as false positive detections. Corrected definitions should be available some time tomorrow (10/22).

---

Hi reese !!!!!!!

I just got a mail form Symantec Security Response saying this: "Our automation was unable to identify any malicious content in this submission.

 The file will be stored for further human analysis."

Hence seems to be False Positives.

Thanks for the help and the response!!!!!!!!!

[Shridhar]

Hi johna !!!!!!!!!

The samples seem to be False Positives as reese said .

Thanks for your help!!!!!!!!

[Shridhar]

---

Reese Wrote:

Shridhar,

I passed these two files past our SONAR team and they have identified them as false positive detections. Corrected definitions should be available some time tomorrow (10/22).

---

Hi Reese . I just checked those files again(on 10/24) and found that ,still they are getting detected by SONAR.

This time the file is shell_inst.exe  instead of Safemode_inst.exe.

But the main thing is  One False Positive is still there there.

Please try and correct it!!!!!!!

Hre is the link for the file at Virus total :http://www.virustotal.com/analisis/5b18559d7d18bda98bd68b3b40614ced

and I have again submitted the same file to Symantec Security Response with the tracking no. #9994234.

Message Edited by Shridhar on 10-24-2008 11:08 PM

Message Edited by Shridhar on 10-24-2008 11:09 PM

[reese_anschultz]

Thanks, Shridahar, for the update. I'll look into it.