I recently tried updating the firmware on my router (Motorola WR850), and SONAR decided that the configuration software (wr850config.exe) was acting suspiciously and removed it. There seems to be no option to make exceptions for SONAR, and no option to make removal a user's choice, and no quarantine either.
The next version of NIS needs to give users a bit of control over SONAR.
When you launch the Main User Interface and click on Settings in the Computer section, what option does it show selected for Advanced Heuristic Protection?
This can be really ambiguous, can't it? Something can be removed from a file, a subdirectory, a directory, a machine, all machines, the known universe.