Norton Anti-vius SONAR Attacking All MMF exe Files !!!!!!

In a previous post, I mentioned that Norton's anti-virus SONAR was detecting a number of my MMF files as viruses and deleted them. So I ran a little test. I created a MMF 2 Dev rev253 application exe file that contained only a single active object. I have a new computer that I just bought that does not have MMF installed and has never had a MMF exe file run on it. I ran the newly minted MMF exe file from a flash drive, and Norton SONAR immediately flagged it as a virus and deleted it. This is freaking me out, since the raminfications are huge - the possibility that Norton anti-virus SONAR will flag every MMF exe file past and present as a virus. I would really appreciate some feedback on what might be going on here. I find it difficult to believe that my computer is so infested that all of these files really infected.
Steve

Norton shares a few of the qualities of a virus. Look at this. It's not like it's fully a virus, but even though it's one of the most well-known antivirus programs out there, it is a very bad one. You can try reporting the application as a false positive here.

Considering that is true, the problem is still there. There is a huge Norton user base that will not understand that and stop using my software believing Norton over me.
Steve

You can still report a false positive.

http://community.clickteam.com/showthread.php?t=71448

I am trying to list links to the places to report it.
The more reports they get the faster they would respond and fix the problem.

I made the example exe file with MMF 2 Dev, ran it with Norton SONAR running, and it was detected as a virus and deleted. I recreated the file and sent the file and the information to Norton from your link above. The form asked me for information that I did not know how to provide, but it is a start. If there is anything more that I can do, please let me know.
Steve

This is the reply from Norton that summarizes the information I sent to them.

Steve
__________________________________________________ __________________________________________________ __________________________________________________ _________

This is an automated message. Please, do not reply to this email.

We would like to inform you that your submission has been received successfully by Symantec Security Response and a tracking number has been created for it.

The incident number for your submission is: 2809924

--------------------------------------------------------

Detection occured: APPLICATION

Usign product: UNKNOWN

Type of detection: SONAR

Customer name: Stephen R Hughes (stephenrhughes@comcast.net)

Name of detection given by Symantec product: file was behaving suspiciously

File uploaded:

Virus Total URL:

MD5 or SHA256 from the customer:

Customer's notes:
Norton SONAR is detecting and deleting every exe file made by an
authoring program called Multimedia Fusion 2 Developer. I have
checked these files using several other anti virus programs and they
have found nothing. Norton SONAR is saying that all of the created exe
files are infected including those that were made and not opened 10
years ago. I have also created exe files from other computers and
burned them to a CD and SONAR tries to delete them. I do not believe
that these files are infected. I use this program to create
educational applications for a living and this false positive is
making me feel very insecure about selling my applications. See
www.multimediascience.com for examples.


--------------------------------------------------------

Sincerely,

Symantec Security Response
http://securityresponse.symantec.com

__________________________________________________ __________________________________________________ __________________________________________________

This is a further reply from Norton about what I should do next. Tonight, after work, I will direct them to the demo version of Multimedia Fusion and send them screen shots of the results from Norton SONAR. Any suggestions on what to send and how to handle this would be appreciated.

Steve
__________________________________________________ __________________________________________________ __________________________________________________ _

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software.

We totally understand your situation.However we failed to locate the software from the website.To solve your problem permanently,please provide us these files below:

* Provide us the software Multimedia Fusion 2 Developer

* Provide us the files which were generated by Multimedia Fusion 2 Developer and also they were detected as Sonar. Please provide us as many files as possible

All these above files can be submitted to us via https://submit.symantec.com/retail/ and reply with the tracking number.

Any detection screen shots,logs,reproduced steps are very helpful.


Sincerely,

Symantec Security Response

http://securityresponse.symantec.com

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or may constitute as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, notify us immediately by telephone and (i) destroy this message if a facsimile or (ii) delete this message immediately if this is an electronic communication. Thank you.


timestamp: 1338872351

Here is the exe file (application.exe) that I sent to Norton that was flagged by Norton Sonar along the mfa file.
Steve

lol, Norton want a free copy of MMF2 Developer?

Here is what Norton told me:

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software. After downloading, installing and scanning your software with Symantec's latest definitions we have been unable to reproduce any detection on Application.exe. Can we please ask you to ensure that you are using Symantec's latest virus definitions for detection? They can be found using live update or alternatively from the URL below.

This was submitting the same application file you sent them.
I don't use Norton's products because of issues like this in the past so I can't scan it myself.

Are you sure those system have up to date anti virus definitions?
I just asked Jason to take a look as he uses Sonar and he hasn't had any false positives with it and MMF created EXE files.

For the record, Avast flags mmf created applications as viruses as well.

Jeff,

Norton installs its virus definitions on its own, and I know that the virus definitions were updated at one point just a few minutes before it deleted one of my files. Sounds like Norton's standard stalling line to me.

Steve

I've gathered more detailed information and sent it to Norton with the exe and mfa files, jpg screen shots of the Norton SONAR screens, and a link to the demo version of MMF 2. I've cut and pasted it below. I've attached the files. I'll let you know what I get back.

Your Reply To My Original E-mail is shown below.

I've included the file original exe created using Multimedia Fusion 2 Developer version 253 and screen shots from Norton Sonar in the zip file above. You can get a demo version of Multimedia Fusion from:

http://www.clickteam.com/website/usa/downloads/index/14

The first image, norton1.jpg, illustrates that Norton Sonar is detecting all the files made by Multimedia Fusion as suspicious and deleting them.

This is an automated message. Please, do not reply to this email.

We would like to inform you that your submission has been received successfully by Symantec Security Response and a tracking number has been created for it.

The incident number for your submission is: 2809924

--------------------------------------------------------

Detection occured: APPLICATION

Usign product: UNKNOWN

Type of detection: SONAR

Customer name: Stephen R Hughes (stephenrhughes@comcast.net)

Name of detection given by Symantec product: file was behaving suspiciously

File uploaded:

Virus Total URL:

MD5 or SHA256 from the customer:

Customer's notes:
Norton SONAR is detecting and deleting every exe file made by an
authoring program called Multimedia Fusion 2 Developer. I have
checked these files using several other anti virus programs and they
have found nothing. Norton SONAR is saying that all of the created exe
files are infected including those that were made and not opened 10
years ago. I have also created exe files from other computers and
burned them to a CD and SONAR tries to delete them. I do not believe
that these files are infected. I use this program to create
educational applications for a living and this false positive is
making me feel very insecure about selling my applications. See
www.multimediascience.com for examples.


--------------------------------------------------------

Sincerely,

Symantec Security Response
http://securityresponse.symantec.com

__________________________________

Problem is, MMF2 applications are easy to make into advanced viruses, just because it's easy to make into any advanced program. ;D
I use F-Secure and tell it to ignore all .mfx files during real-time scanning. It doesn't pick up any of the MMF2 programs, hasn't for half a year, it just asks me when they run or access the interwebz whether I want to permit it, every time the app's content is modified.
I'd recommend F-Secure over Norton any day. Pity it isn't free.

I run into Avast complaining about MMF2 applications as well no matter what they are. It constantly asks me if I want to run in sandbox mode.

I'm not sure if this is relative to your situation but I notice that if I have "Compress the runtime" selected I get a lot more virus flags from Norton. (Actually, I don't get any when I deselect that option!) Maybe the way it un-compresses is similar to some virus behavior???

Yeah, I've heard that when compress the runtime is checked, then there are lots of virus scanners that don't like what it does. It extracts the runtime file and runs it in the background, which virus scanners don't like, because that is virus-like behavior.

Well, I unchecked "Compress the runtime" in the sample application.exe / mfa that I sent to Norton. And sure enough, he exe ran fine. Now this might solve the Norton SONAR problem going forward, but it dosn't change the fact that I have hundreds of mfa files that would need to be rebuilt and new installs created, and hundreds of pieces of software already sold, and inventory that now may not work for my customers due to Norton anti-virus. So, I'm still going to pursue this with Norton as far as I can.

But sure appreciated the heads up on the information that you provided.

Steve

I found out about the compressing of the runtime some time ago. My firewall asked me if I wanted to allow strdt.exe to run. This happened the same time I had ran my app I created with MMF. Searched on here and found lots of complaints on the boards here about antiviruses going crazy over it. For your software sold, why couldn't you just create a version of the software where the runtime is not compressed and just tell people it's an update?

If I had a lot of issues with my users reporting antivirus issues then I would make it a point of putting that as part of the FAQs on my website. All you can do is explain to your users what's going on. If they don't listen you can't force them to listen to you.

Quote:

---

Originally Posted by drnebula

Here is the exe file (application.exe) that I sent to Norton that was flagged by Norton Sonar along the mfa file.
Steve

---

scans fine with AVG2012

twice last week, i had to uninstall nortons off customers pc's to make them boot again!!! highly not recommended piece of garbage.
unfortunately we cant help what happens when nortons scans a MMF file :/

Compressing the runtime makes the smaller runtime program get extracted to a temporary directory, along with all the mfx files. Because it has a temporary folder name, every time a program runs or accesses the internet, its path changes. So anti-viruses and firewalls see it as a different file each time.

Personally, I think CT needs to remove "compress runtime" in a new update (or at least uncheck it by default). The way this feature works - by extracting an executable and then running it - is usually considered malicious behaviour. Sure, it's the AV companies that are making the mistakes, but it'll help if MMF generates executables that as little as possible behaves like a typical virus. I'm sure this is one of the main reasons for all the false positive problems.

Also, MMF3 should really be built much more with this in mind.

I agree. I think the Compress Runtime should be unchecked by default. I've looked over how MMF extracts the files. How all the extensions (mfx) files are put in to a temp folder but appears the actual program (i.e. what you create) does not get put in to a temp folder, unless I missed something. It would be nice in future versions (e.g. MMF 3) to have it where it all stays contained within the executable (EXE) without being put in to a temp folder.

Avast does the same thing for all of my programs. It says the file's prevalence/reputation is low. (Well duh, I'm the only person in the world who has it.) It actually closed all of my programs automatically after running them, until I told it to ask me first. Now I just have to tell it that the file is okay every single time I open it which is still really annoying.

Any idea how to fix that?

As someone who does tech support on a daily basis for PC users, here is my advice.

You need to have information on your website that users may need to add exceptions for your program and folder of where it is installed to, if you have it inside an installer. You can also tell them that while downloading or installing your program, that at their own risk, they may need to temporarily disable their antivirus or firewall software long enough to get the game working.

Setup a FAQ on your website, and let users know they may need to also contact the software maker's support website if they need help with their use of your game.

Also, Kaspersky (X, Vista, 7) and Microsoft's security software (for Win Vista and Win 7) I suggest for solid, gamer friendly security programs. Having your UAC settings at medium to high helps protect your system closer to a Linux secure system.

Hope that helps some!