There have been a couple of reports lately of false positives being picked up by SONAR.

As a first step, can you submit the files to Symantec here with all the details and let us know the response you receive. If no joy there, please advise and I will have the matter investigated for you.

Thanks for your patience.

Hi!!!!!!

johna .

Well, I have submitted it to SSR .The response is expected to come by the next day.I will wait till tomorrow otherwise I will submit it to False Positives.

Now if you can get more info. , here are the tracking nos.  #9985206 and  #9985200.

OK, thanks for that.

Let's wait and see the results of your submissions, we can go from there. 

Thanks again.

PS It may take up to 48 hours to receive a response from SSR.

I passed these two files past our SONAR team and they have identified them as false positive detections. Corrected definitions should be available some time tomorrow (10/22).

I just got a mail form Symantec Security Response saying this: "Our automation was unable to identify any malicious content in this submission.

Hi johna !!!!!!!!!

The samples seem to be False Positives as reese said .

Thanks for your help!!!!!!!!

Reese Wrote:

Shridhar,

I passed these two files past our SONAR team and they have identified them as false positive detections. Corrected definitions should be available some time tomorrow (10/22).

This time the file is shell_inst.exe  instead of Safemode_inst.exe.

But the main thing is  One False Positive is still there there.

Please try and correct it!!!!!!!

Hre is the link for the file at Virus total :http://www.virustotal.com/analisis/5b18559d7d18bda98bd68b3b40614ced

and I have again submitted the same file to Symantec Security Response with the tracking no. #9994234.