We are developing .NET application which has been working (and not detected by SONAR) for many months. Now, when I try to start application, it is quarantined by SONAR (log attached). This behaviour has started about a week ago. I tried older versions of our application, but result is the same - application is quarantined.
Our application assembly is obfuscated (all the time) by WiseOwl Demeanor 4.0 for .NET. When I tried to run not obfuscated version of application, everything is fine, file is not quarantined.
- application must be obfuscated for security purposes
- it is impossible to exclude application form scan on customers PCs.
Any help or advice will be appreciated.
FileInsight details:
(Why is a keystroke capture labeled as suspicious action?)
Full Path: Not Available
____________________________
____________________________
On computers as of:
6/15/2011 at 1:08:28 PM
Last Used:
6/15/2011 at 1:08:28 PM
Startup Item:
No
Launched:
Yes
____________________________
____________________________
Very Few Users
Fewer than 5 users in the Norton Community have used this file.
____________________________
High
This file risk is high.
____________________________
Threat Details
SONAR Protection monitors for suspicious program activity on your computer.
____________________________
Origin
Downloaded from URL Not Available
Source File:
explorer.exeFile Created:
app.exeFile Created:
app.exe
____________________________
File Actions
File: c:\program files\app\app.exe
Removed
____________________________
Network Actions
Event: Network activity (Performed by c:\program files\app\app.exe, PID:4052)
No action taken
____________________________
System Settings Actions
Event: Process start (Performed by c:\program files\app\app.exe, PID:748)
No action taken
____________________________
Suspicious Actions
Event: Keystroke capture (Performed by c:\program files\app\app.exe, PID:4052)
No action taken
____________________________
File Thumbprint - SHA:
Not Available
____________________________
File Thumbprint - MD5:
Not Available
____________________________