• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

submitted: 26 files, 18 double detections, 8 false negatives

I have some files some were previously submitted as missed PUA detection(false negative), and some as incorrect detection (false positive).

There are some files left from this process that have come back twice from false positive submission as "Upon further analysis ... determined ... meets ... criteria ... (PUA) ... reclassified accordingly" but still have problems.
Specifically they are currently detected as BOTH Trojan.Gen.2(incorrect) AND PUA.InstallCore(correct) -- this is after coming back from a successful false positive submission.

Replies

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

Is there any way to make progress on this issue?

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

32 files, 18 double detections, 14 false negatives

I have some files some were previously submitted as missed PUA detection(false negative), and some as incorrect detection (false positive).

There are some files left from this process that have come back twice from false positive submission as "Upon further analysis ... determined ... meets ... criteria ... (PUA) ... reclassified accordingly", which is exactly as expected. But this isn't what is really happening. There is a problem with the detection.
Specifically they are currently detected as BOTH Trojan.Gen.2(incorrect) AND PUA.InstallCore(correct), AT THE SAME TIME.

I have yet to receive any human response on this topic from Symantec/Norton. It's been ~37 days!

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

Specifically they are currently detected as BOTH Trojan.Gen.2(incorrect) AND PUA.InstallCore(correct), AT THE SAME TIME.

Okay.  Educate me.  What's wrong with two flags on an event.  

Why is Trojan.Gen.2 (incorrect).    

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

bjm_:

Specifically they are currently detected as BOTH Trojan.Gen.2(incorrect) AND PUA.InstallCore(correct), AT THE SAME TIME.

Okay.  Educate me.  What's wrong with two flags on an event.  

Why is Trojan.Gen.2 (incorrect).    

Because in this specific case the file(s) are safe (only a PUA). As confirmed by the false positive submission coming back "Upon further analysis ... determined ... meets ... criteria ... (PUA) ... reclassified accordingly". Previously it was detected only as "Trojan.Gen.2". Now after successfully going through a false positive submission it's still detected as Trojan.Gen.2 and now ALSO detected as a PUA. Some older and newer versions of the same program are not detected at all, some are detected properly as a only PUA (and a minor one at that). All of the recent ones (detected as PUA, double detected, and not detected at all) contain the exact same (unchanged) install time PUA (the PUA itself doesn't persist past the install offer).

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

Hmm.....okay.... over-my-pay-grade.....Thanks

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

bjm_:

Hmm.....okay.... over-my-pay-grade.....Thanks

Any way you can nudge Symantec/Norton to respond?

Kudos0

Re: submitted: 26 files, 18 double detections, 8 false negatives

This thread is closed from further comment. Please visit the forum to start a new thread.