Exclude FP in NIS 2011

Discussion in 'other anti-virus software' started by Ed_H, Feb 28, 2011.

Thread Status:
Not open for further replies.
  1. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I have been trialing NIS 2011 and generally like it so far. However, it keeps identifying a file as a threat and I am sure it is a FP. I have excluded the file from AV scans and from SONAR but NIS keeps identifying the same file as a threat anyway. The report shows it as a heuristic detection but I can't find any additional ways to exclude the file. What am I missing?
     
  2. eBBox

    eBBox Registered Member

    Joined:
    Aug 10, 2006
    Posts:
    482
    Location:
    Aalborg, Denmark
    Have u submitted the file (if its a fp, they will correct it)?
     
  3. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    786
    Location:
    255.255.255.255
    you have to also exclude it from sonar scanning too.. see fig , configure both of them


    Capture.JPG


    btw , what is that file
     
  4. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I have not yet submitted it. From looking at the help document it looks like I should have an option to submit the file but there is none. I let NIS delete the file and quarrantine a copy but there is no option to submit the file for analysis.
     
  5. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    786
    Location:
    255.255.255.255
    click on Options and then Submit to symantec :

    Capture.JPG

    Capture1.JPG
     
  6. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I have excluded the file from sonar scanning as well.

    It is 45a90.msi in c:\Windows\Installer that has been on my laptop since 2008 and NIS is the 1st AV to flag it.

    14/43 report the file as malware on Virus Total and 6/19 on Jotti's.
     
  7. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    786
    Location:
    255.255.255.255
    u said norton first to flag it but u also say 14 other Av detected it

    also it doesn't matter if a file is in ur PC for long time .. it doesnt mean its not infected... I m not saying it is but i cannot be sure
     
  8. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    No option to submit is available.
     

    Attached Files:

  9. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    786
    Location:
    255.255.255.255
    ok, then just submit it manually at site

    more better ooption would be to go to norton community and post . they would actually verify whether its actually a malware or not
     
  10. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I just submitted it manually. Thanks for the help.
     
Thread Status:
Not open for further replies.