Norton Internet Security / Norton AntiVirus

[martinsa]

Lots of users are reporting Spotify.exe being classed as a Trojan as of this morning. Seems likely that this is a false positive. Especially as it seems to be only for certain versions of NAV.

Anyone having the same problems? Any news from Symantec on this issue anywhere?

[3play]

Visit this web-page https://submit.symantec.com/dispute/

and provide Symantec with the necessary information and with the file so that they can fix it if it is a false positive

[martinsa]

Hi

Thanks. I'll post that to the Spotify support forums so they can request a change.

[Rax]

To temporarily fix this problem in Norton Internet Security,

Open Norton Internet Security and click on Settings in the computer "Box"

about halfway down the the list you should find the option for Scan Exclusions,

click on configure

choose Add under exclusion for auto-protect and browse to the folder where spotify is installed and  add it.

if spotify.exe was removed and not quarantined you will need to reinstall spotify

[jAW]

Hi martinsa,

It is a known issue that a false positive was introduced through LiveUpdate. A RapidRelease is out that should fix this. Make sure that you have the newest definitions by running LiveUpdate manually and then uninstall and reinstall Spotify. You might need to check the firewall also so that Spotify.exe has not been blocked.

There is a small chance that the RapidRelease has not reached you yet, if Spotify still is detected as a Trojan after running LU and reinstall, please try again in a few hours.

Regards

jAW

[martinsa]

Thanks. That's good news.

Do you happen to know which products were affected? I did not seem to get the problem on NAV 10. Or maybe it is a settings issue?

[jAW]

I was told that the false positive impacted all Norton and Symantec security customers. I myself was never affected, but that could simply be that once I started my computer today the false positive was no longer being distributed through Live Update. The Rapid Release fix should be to remove the FP from those who got the update.

Regards

jAW

[orla_cox]

I can confirm that we did unfortunately  have an FP on Spotify.exe. This FP was included in a LiveUpdate release that went out at approximately 07.00 am GMT. We've since rectified it and a new LiveUpdate build is underway. This should be available within the 2-3 hours. After applying those defs, you can restore the file from quarantine. If the file has been removed, then unfortunately you'll have to reinstall.

In the meantime there are a few options to workaround this problem:

1. Exclude spotify.exe from scanning and then restore from quarantine. Details on excluding a file from scanning on NIS2010 are here:

http://www.symantec.com/norton/support/kb/web_view.jsp?wv_type=public_web&docurl=20091007171742EN&ln...

For older products, see the instructions here:

http://service1.symantec.com/support/nav.nsf/0/c829006aa01d540b852565a6007770d8?OpenDocument&seg=en&...

2. Apply the latest rapid release definitions and restore spotify.exe from quarantine. The latest Rapid Release definitions are available here: 

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=rr

Our sincere apologies for any inconvenience caused. We're doing what we can to get the corrected LiveUpdate out ASAP.

Orla

Symantec Security Response

[Bombastus]

Thank you for the update.

[orla_cox]

Some additional information for NIS 2010 users. When the FP was corrected earlier today, this information was passed into the Cloud. As a result, the file was no longer detected on machines with NIS 2010. If you have NIS 2010 you can restore the file without any further issues.

Regards

Orla

Symantec Security Response