Summary

Synopsis

Installer launchers built with both InstallShield and InstallAnywhere are incorrectly flagged by Symantec Endpoint Protection Version 12 as containing a threat. The specific threat indicated is Bloodhound.Sonar.9. Symantec has confirmed that this behavior was incorrect and verified the launchers created by InstallShield and InstallAnywhere do not contain a threat. Symantec released new definitions to resolve the issue.

Discussion

Symantec released the following statement regarding this issue:

***************

Late in April, the Symantec released an update to the SONAR engine, which is part of the Symantec Endpoint Protection product. SONAR is a heuristics engine which looks at certain application attributes and behavior. After this update went out, the SONAR engine started detecting software from FLEXERA SOFTWARE as malware. After the customer reported of this incident, we have done a thorough investigation.

Here are some of the steps we have taken,

1. All the reported files are "whitelisted", which assures that we will never trigger on them again.

2. We have released an emergency update that will further ensure we will not trigger on these and similar files in the future.

Our investigation is ongoing and we will do another update which will ensure we will not convict similar files from FLEXERA SOFTWARE and other vendors in the future.

We take such incidents very seriously and are taking aggressive steps to make sure they do not happen in future.

***************

Additional Information