Norton Anti-vius SONAR Attacking All MMF exe Files !!!!!!

[drnebula]

In a previous post, I mentioned that Norton's anti-virus SONAR was detecting a number of my MMF files as viruses and deleted them. So I ran a little test. I created a MMF 2 Dev rev253 application exe file that contained only a single active object. I have a new computer that I just bought that does not have MMF installed and has never had a MMF exe file run on it. I ran the newly minted MMF exe file from a flash drive, and Norton SONAR immediately flagged it as a virus and deleted it. This is freaking me out, since the raminfications are huge - the possibility that Norton anti-virus SONAR will flag every MMF exe file past and present as a virus. I would really appreciate some feedback on what might be going on here. I find it difficult to believe that my computer is so infested that all of these files really infected.
Steve

[happygreenfrog]

Norton shares a few of the qualities of a virus. Look at this. It's not like it's fully a virus, but even though it's one of the most well-known antivirus programs out there, it is a very bad one. You can try reporting the application as a false positive here.

[drnebula]

Considering that is true, the problem is still there. There is a huge Norton user base that will not understand that and stop using my software believing Norton over me.
Steve

[happygreenfrog]

You can still report a false positive.

[Jeff]

http://community.clickteam.com/showthread.php?t=71448

I am trying to list links to the places to report it.
The more reports they get the faster they would respond and fix the problem.

[drnebula]

I made the example exe file with MMF 2 Dev, ran it with Norton SONAR running, and it was detected as a virus and deleted. I recreated the file and sent the file and the information to Norton from your link above. The form asked me for information that I did not know how to provide, but it is a start. If there is anything more that I can do, please let me know.
Steve

[drnebula]

This is the reply from Norton that summarizes the information I sent to them.

Steve
__________________________________________________ __________________________________________________ __________________________________________________ _________

This is an automated message. Please, do not reply to this email.

We would like to inform you that your submission has been received successfully by Symantec Security Response and a tracking number has been created for it.

The incident number for your submission is: 2809924

--------------------------------------------------------

Detection occured: APPLICATION

Usign product: UNKNOWN

Type of detection: SONAR

Customer name: Stephen R Hughes (stephenrhughes@comcast.net)

Name of detection given by Symantec product: file was behaving suspiciously

File uploaded:

Virus Total URL:

MD5 or SHA256 from the customer:

Customer's notes:
Norton SONAR is detecting and deleting every exe file made by an
authoring program called Multimedia Fusion 2 Developer. I have
checked these files using several other anti virus programs and they
have found nothing. Norton SONAR is saying that all of the created exe
files are infected including those that were made and not opened 10
years ago. I have also created exe files from other computers and
burned them to a CD and SONAR tries to delete them. I do not believe
that these files are infected. I use this program to create
educational applications for a living and this false positive is
making me feel very insecure about selling my applications. See
www.multimediascience.com for examples.


--------------------------------------------------------

Sincerely,

Symantec Security Response
http://securityresponse.symantec.com

__________________________________________________ __________________________________________________ __________________________________________________

This is a further reply from Norton about what I should do next. Tonight, after work, I will direct them to the demo version of Multimedia Fusion and send them screen shots of the results from Norton SONAR. Any suggestions on what to send and how to handle this would be appreciated.

Steve
__________________________________________________ __________________________________________________ __________________________________________________ _

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software.

We totally understand your situation.However we failed to locate the software from the website.To solve your problem permanently,please provide us these files below:

* Provide us the software Multimedia Fusion 2 Developer

* Provide us the files which were generated by Multimedia Fusion 2 Developer and also they were detected as Sonar. Please provide us as many files as possible

All these above files can be submitted to us via https://submit.symantec.com/retail/ and reply with the tracking number.

Any detection screen shots,logs,reproduced steps are very helpful.


Sincerely,

Symantec Security Response

http://securityresponse.symantec.com

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or may constitute as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, notify us immediately by telephone and (i) destroy this message if a facsimile or (ii) delete this message immediately if this is an electronic communication. Thank you.


timestamp: 1338872351

[drnebula]

Here is the exe file (application.exe) that I sent to Norton that was flagged by Norton Sonar along the mfa file.
Steve

[Phi]

lol, Norton want a free copy of MMF2 Developer?

[Jeff]

Here is what Norton told me:

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software. After downloading, installing and scanning your software with Symantec's latest definitions we have been unable to reproduce any detection on Application.exe. Can we please ask you to ensure that you are using Symantec's latest virus definitions for detection? They can be found using live update or alternatively from the URL below.

This was submitting the same application file you sent them.
I don't use Norton's products because of issues like this in the past so I can't scan it myself.