Exclude FP in NIS 2011

Discussion in 'other anti-virus software' started by Ed_H, Feb 28, 2011.

Thread Status:
Not open for further replies.
  1. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I have been trialing NIS 2011 and generally like it so far. However, it keeps identifying a file as a threat and I am sure it is a FP. I have excluded the file from AV scans and from SONAR but NIS keeps identifying the same file as a threat anyway. The report shows it as a heuristic detection but I can't find any additional ways to exclude the file. What am I missing?
     
  2. eBBox

    eBBox Registered Member

    Joined:
    Aug 10, 2006
    Posts:
    482
    Location:
    Aalborg, Denmark
    Have u submitted the file (if its a fp, they will correct it)?
     
  3. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    810
    Location:
    255.255.255.255
    you have to also exclude it from sonar scanning too.. see fig , configure both of them


    Capture.JPG


    btw , what is that file
     
  4. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I have not yet submitted it. From looking at the help document it looks like I should have an option to submit the file but there is none. I let NIS delete the file and quarrantine a copy but there is no option to submit the file for analysis.
     
  5. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    810
    Location:
    255.255.255.255
    click on Options and then Submit to symantec :

    Capture.JPG

    Capture1.JPG
     
  6. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I have excluded the file from sonar scanning as well.

    It is 45a90.msi in c:\Windows\Installer that has been on my laptop since 2008 and NIS is the 1st AV to flag it.

    14/43 report the file as malware on Virus Total and 6/19 on Jotti's.
     
  7. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    810
    Location:
    255.255.255.255
    u said norton first to flag it but u also say 14 other Av detected it

    also it doesn't matter if a file is in ur PC for long time .. it doesnt mean its not infected... I m not saying it is but i cannot be sure
     
  8. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    No option to submit is available.
     

    Attached Files:

  9. Nevis

    Nevis Registered Member

    Joined:
    Aug 28, 2010
    Posts:
    810
    Location:
    255.255.255.255
    ok, then just submit it manually at site

    more better ooption would be to go to norton community and post . they would actually verify whether its actually a malware or not
     
  10. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    I just submitted it manually. Thanks for the help.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.