Board Logo

Norton Sonar and eJ
Dyno Don - 3-30-2011 at 08:11 PM

This really isn't an eJ bug so I am posting in general discussion. I have Norton Internet Security 2011. It has a part called Sonar which looks at files and flags them if they haven't been reported to the databse, in otherwords a file so new it could be a virus. It keeps deleting ejukebox.exe. It would be funny except I can't stop it. I know it is my problem, but I thought that if anyone new tried eJ and had this package (and they almost give it away with rebates), they couldn't make it work.
I turned off the sonar and I can install ej, but when sonar reactivates itself it deletes the .exe again. Maybe there is a deal with Symantec where you register your new .exes or something.
Just a heads up.

Don


Audiosoft - 3-31-2011 at 06:26 AM

Thanks for letting me know Don!
I found this http://www.symantec.com/connect/forums/sonar-detects-our-protected-application-high-security-risk
and this form...https://submit.symantec.com/false_positive/
you may want to take a look. i filled it out but had to invent the details because i am not sure what exactly happens. if it deletes ejukebox.exe when you install ejukebox, run it or when sonar is doing a system scan?


Audiosoft - 3-31-2011 at 09:01 AM

Got the following message from Symantec

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software. After downloading, installing and scanning your software with Symantec's latest definitions we have been unable to reproduce this detection. Can we please ask you to ensure that you are using Symantec's latest virus definitions for detection? They can be found using live update or alternatively from the URL below.

http://securityresponse.symantec.com/avcenter/defs.download.html

Due to not being able to reproduce this issue we require the additional information below to progress the dispute.

* The message or a screen shot of the message received
* Exact instructions on how to recreate issue
* Symantec product and version being used for detection

If this dispute is no longer valid please respond to this email and we will close off the dispute.

Please respond to this email within 14 days with all questions or requests above answered. Failure to respond to this email within 14 days will deem the Security Risk Dispute submission to be no longer valid and initiate a closure procedure. Once closed a new submission for the same issue can be opened up to two times. Each new submission is subject to the time frame for response of a further week from the submission date.

Sincerely,

Symantec Security Response


Dyno Don - 3-31-2011 at 12:30 PM

I attached a screenshot of what is happening. This is from 5:29 am PDT Thursday. Thanks for looking into this....

Don


Dyno Don - 3-31-2011 at 12:33 PM

More. It just won't let me run eJ! :)


crlove - 4-1-2011 at 11:57 PM

Norton Internet Security 2011 have an exception list for trusted programs until you can resolve your issue with Symantec?
Go to Settings > Computer Settings > Exclusions > Signature Exclusions > Configure
Then ADD, scroll list to find ProduKey and add it to the exceptions.


Dyno Don - 4-2-2011 at 04:06 PM

I found the area to Exclude it, but it no longer seems to be a problem. I guess enough folks have tried it that Norton no longer considers it a threat. I will save this for the next update though :)

Thanks again
Don


Audiosoft - 4-8-2011 at 11:31 AM

Got this back from Symantec!
...
We are writing in relation to your submission through Symantec's on-line
Security Risk / False Positive Dispute Submission form for your software
being detected by Symantec Software. In light of further investigation
and analysis Symantec is happy to remove this detection from within its
products.

The updated detection will be distributed in the next set of virus
definitions, available daily, or weekly via LiveUpdate, depending on
Symantec product version


peleus - 3-2-2013 at 02:30 PM

For sure, it was Symantec causing this. I turned it off for testing purposes and installed this. Turned it back on and no issues after that.