False Positives and Auto Protect Exclusions

Norton Security | Norton Internet Security
1

 

There has been an earlier thread titled Auto Protect Exclusions (feb.-march 2014). I did not want to use that one for my own questions. Nonetheless the below is somewhat related to that earlier thread.

=

 

I have been using a tool for quite a few months. A week or so ago, I installed NIS 2014 and it seems to have discovered this tool and deleted it as of yesterday. Until then, I have been using the tool frequently.

 

Virustotal detection ratio is either 2/51 or 1/51,  depending on whether I have the latest version or an earlier version of the same .exe scanned.

By default CMC reports a 'Trojan.Win32.Generic!O '  and

Symantec reports either WS.Reputation.1 and with the latest virusupdate Trojan.ADH.SMH or in a few cases even nothing

 

The exe is named SetFolDateFM.exe.

It is a kind of plug-in for filemanager Directory Opus and takes care of redating folders, i.e. Set Folder Date after either the olders or newest filedate in that folder.

 

I submitted as 'false positive' using https://submit.symantec.com/false_positive/standard/

 

Right now I cannot use the tool - it is being deleted automatically.

 

Two question, three actually:

1/ will I be informed of the results of my false positive submission?

 

2/ presumably not, how to proceed then?

Am I to extract the .exe from the zip file on a daily basis to see whether or not NIS will delete it and if not then Symantec apparently has added it to its whitelist or what?

 

3/ When extracting an older .zip file (containing an older version of this .exe file) a Norton pop-up showed up

"Auto-Protect is processing security risk Suspicious.Cloud.9."

and a little later..

"Auto-Protect has removed security risk Suspicious.Clould.9.  Your computer is secure now."

 

Not the faintest idea what this is. Does it have something to do with me extracting the .zip file, or is it something else and me extracting the zip file at the same time was a mere coincidence?

 

Thanks

=

 

 

 

2

Glad you got it sorted and thanks for coming back and letting us know all is good!

3

 

There has been an earlier thread titled Auto Protect Exclusions (feb.-march 2014). I did not want to use that one for my own questions. Nonetheless the below is somewhat related to that earlier thread.

=

 

I have been using a tool for quite a few months. A week or so ago, I installed NIS 2014 and it seems to have discovered this tool and deleted it as of yesterday. Until then, I have been using the tool frequently.

 

Virustotal detection ratio is either 2/51 or 1/51,  depending on whether I have the latest version or an earlier version of the same .exe scanned.

By default CMC reports a 'Trojan.Win32.Generic!O '  and

Symantec reports either WS.Reputation.1 and with the latest virusupdate Trojan.ADH.SMH or in a few cases even nothing

 

The exe is named SetFolDateFM.exe.

It is a kind of plug-in for filemanager Directory Opus and takes care of redating folders, i.e. Set Folder Date after either the olders or newest filedate in that folder.

 

I submitted as 'false positive' using https://submit.symantec.com/false_positive/standard/

 

Right now I cannot use the tool - it is being deleted automatically.

 

Two question, three actually:

1/ will I be informed of the results of my false positive submission?

 

2/ presumably not, how to proceed then?

Am I to extract the .exe from the zip file on a daily basis to see whether or not NIS will delete it and if not then Symantec apparently has added it to its whitelist or what?

 

3/ When extracting an older .zip file (containing an older version of this .exe file) a Norton pop-up showed up

"Auto-Protect is processing security risk Suspicious.Cloud.9."

and a little later..

"Auto-Protect has removed security risk Suspicious.Clould.9.  Your computer is secure now."

 

Not the faintest idea what this is. Does it have something to do with me extracting the .zip file, or is it something else and me extracting the zip file at the same time was a mere coincidence?

 

Thanks

=