Norton Internet Security / Norton AntiVirus

[Ardmore]

I use what I believe is a popular and reputable media player called Zoom Player, from Inmatrix.  They offer several versions, and while the version I use ("Premium") has not been sold for awhile, Inmatrix still offers updates for it.  The executable is zplayer.exe.  I had been using update 811 of Zoom Player Premium for months, and NIS never had any problem with it, either in virus scans or when I used it.  But tonight, shortly after I started playing a video file Sonar detected zplayer.exe as a high risk file,  supposedly due to suspicious behavior -- keylogging attempts --  and deleted it.

So I downloaded and installed the latest update of Zoom Player Premium from Inmatrix (v 816), and again as soon as I started playing a file Sonar flagged and deleted the latest update of zplayer.exe for the same reason.  It said "very few users" (less than five), but that's probably because it is a just-released update of a legacy version of the product.

This smells like a "false positive" to me.  Or is it possible that version 811 suddenly became infected with a keylogger after months with no problems, and version 816 was keylogging immediately upon installation?

Any thoughts or advice?  I have used Zoom Player for years and definitely trust it.  It seems odd that a media player would suddenly be the target of infection by a keylogger.  Windows XP SP3, NIS 2011.  Thanks

[Bombastus]

I am sure it contains keylogging technology. Many many legitimate programs do - indeed, many can't function without it. Imagine playing a pinball game that wasn't allowed to capture your keystrokes. No highscore today. Keylogging activity in itself isn't malicious, but can be quite necessary for a program to function.

The problem here is that Norton mistakes it for malicious keylogging activity. I installed it and tested it, and it does indeed do what you describe, and it is assuredly a false positive.

[dickevans Super RootKit Eradicator]

---

Ardmore wrote:

I use what I believe is a popular and reputable media player called Zoom Player, from Inmatrix.  They offer several versions, and while the version I use ("Premium") has not been sold for awhile, Inmatrix still offers updates for it.  The executable is zplayer.exe.  I had been using update 811 of Zoom Player Premium for months, and NIS never had any problem with it, either in virus scans or when I used it.  But tonight, shortly after I started playing a video file Sonar detected zplayer.exe as a high risk file,  supposedly due to suspicious behavior -- keylogging attempts --  and deleted it.

So I downloaded and installed the latest update of Zoom Player Premium from Inmatrix (v 816), and again as soon as I started playing a file Sonar flagged and deleted the latest update of zplayer.exe for the same reason.  It said "very few users" (less than five), but that's probably because it is a just-released update of a legacy version of the product.

This smells like a "false positive" to me.  Or is it possible that version 811 suddenly became infected with a keylogger after months with no problems, and version 816 was keylogging immediately upon installation?

Any thoughts or advice?  I have used Zoom Player for years and definitely trust it.  It seems odd that a media player would suddenly be the target of infection by a keylogger.  Windows XP SP3, NIS 2011.  Thanks

---

Hi,

Here's where to submit the file for evaluation and a possible change of status

https://submit.symantec.com/false_positive/

Hope this helps

[Ardmore]

Both responses helpful, thanks

I agree with Bombastus that this has got to be a safe file, but I'll go ahead and submit it to the link Dick provided.  anyway.  However, even if the file were initiating keylogging (maliciously or not), is that something that Norton could evaluate just from examining the file or comparing to prior community reports?

One interesting twist to this:  Shortly after my original post last night I had NIS change the status for zplayer.exe (update 816) to trusted.  Then I used the player a few times.  Then I went back and removed trusted status, and NIS reverted its Insight assessment back to "Untrusted - Bad."  Then I proceeded to use the player some more, but NIS no longer aborts and deletes it (i.e., it's back to the way things always were before yesterday in that regard).  The pattern is perplexing.

EDITED TO ADD:  Just did another Insight check of zplayer.exe, and see that the status has changed from Untrusted-Bad to Trusted-Good without any further intervention on my part.