Symantec Hotfix does not fix false positive in SONAR for winrar.exe

Norton Security | Norton Internet Security
1

Sonar quarantines winrar.exe even though it has been excluded from scans. I applied the hotfix mentioned  elsewhere in this forum but the problem remains after rebooting. Each time I try to use the program Sonar flags and quarantines the file. Any help will be appreciated. Thanks.

2

Hi

 

Where did you get your Winrar from because if not from the creators site then it could be that you have downloaded even innocently a trial from somewhere and it's no the genuine on, there are a few around.

 

Quads  

3

I got the program for free when the authors had an anniversary of some kind and they for a short time gave out keys by email for an older version of the program. The program is legit and it has been used for at least two years without incident with several versions of NIS.

4

I've tried running a number of versions of winrar in a couple platforms and (as expected) cannot reproduce a situation where winrar.exe gets convicted.  As other posters have stated, SONAR does not convict winrar.exe Furthermore, our reputation for these files is good.

 

Can you please provide more information about what exact steps lead to this conviction?  Anything funny going on other than double clicking the .rar archive you are trying to open?

 

 

Can you please post screenshots that show:

 

1. The actual conviction notice.

2. The details of the conviction (Main UI | History | Show SONAR Activity)

3. The product version you are using (Main UI | Help and Support | About)

 

I would also need:

 

1. File version of:  BHDrvx86.sys

    - XP - C:\Documents and Settings\All Users\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20090911.001\

    -Vista/7 - C:\Users\All Users\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20090911.001

2. File version and SHA256 hash for the winrar.exe you are using.

5

Dear Carlos,

 

The hotfix finally worked after two additional reboots. Starting Winrar either from the program group or from the context menu  in Win XP SP3 no longer  is flagged by SONAR. I am good to go now. Thanks very much for the help

6

Sonar quarantines winrar.exe even though it has been excluded from scans. I applied the hotfix mentioned  elsewhere in this forum but the problem remains after rebooting. Each time I try to use the program Sonar flags and quarantines the file. Any help will be appreciated. Thanks.