Norton AV flagged Creo 3.0 M010 as high risk...

[TomD.inPDX]

Heads up, and looking for others that have had this pop up recently...

I download all the releases for Creo to an archive foldere. After a few days of being on my system, Norton antivirus flags the install zip file as a high risk.

I reported this to customer support. I will update with their response. Anyone else get this?

This thread is inactive and closed by the PTC Community Management Team. If you would like to provide a reply and re-open this thread, please notify the moderator and reference the thread. You may also use "Start a topic" button to ask a new question. Please be sure to include what version of the PTC product you are using so another community member knowledgeable about your version may be able to assist.

[TomU]

Here you go. This is the one inside the Win64 installation.

[TomU]

By the way, I didn't zip it, the community forum did automatically upon upload.

[TomD.inPDX]

Thanks for the clarification. I did know the community does this by default.

More stuff to send CS.

[TomD.inPDX]

Norton -really- doesn't like this file. It stripped it out of the ZIP on download... and when I open it with the downloader, it nixes the save to desktop...

It now has a Suspicious.Cloud.7.F. flag.

[dschenken]

So run it and see what happens.

Note - Off topic, but just to give an idea of possible consequences.

I wish I could find a video link with audio from Malcom in the Middle and the Komodo 3000. It's not available on DVD. Season 4 Ep 8, maybe available on Netflix.

After dark, when the parents aren't watching, the boys set off a fireworks display that has some roman candles. The camera shows them standing in the darkness by the corral, illuminated by the moon, the stars and the fireworks. One asks how they will know if the Komodo 3000 has gone off. Then they are illuminated by a blinding white flash and the scene turns to daylight to the horizon, complete with blue sky and white clouds. A second later, it all goes dark again.

After darkness returns -

Francis: [having lit a huge firecracker] Did it say when our vision would come back?

Reese: Box said two days.

Francis: Totally worth it.

Frankly, one of the best uses of editing I recall ever seeing.

[TomD.inPDX]

That was EXCELLENT, David!!!

[TomU]

https://www.youtube.com/watch?v=EYng9T8EpS0

[Inoram]

BAHAHA

[dschenken]

Ha - for some reason Firefox had stopped running audio to the OS. I thought the links had no audio, as even on the Windows sound monitor there was no indication of audio. Then I tried Pachelbel's Canon in D and figured that while a clip might be silent no one would post a mime of a musical work.

[TomD.inPDX]

Thanks for all the insight, people! I have no interest in becoming an AV expert nor to add yet again more software. AV apps have always been the bane of my total computer experience. They seem to get in the way more than they help.

Funny thing is, Comcast use to have McAfee and switched to Norton. It's been pretty quite and reliable so far until this.

I don't know how to give credit for so many helpful replies but I am perfectly acceptable with finding this a false positive. I do hope that PTC will contact Norton and have this unflagged by the "Symantec community". So far I am not excited about PTC's pro-active stance, or lack there of, on an issue such as this.

[RichardJ]

Stop! I'm not sure it is a false positive. Norton found "Suspicious.Cloud.7.F". That is not just a suspicious file by heuristics, it's a known trojan from their database!

Edit: I take it back. That is a heuristic detection, just not one I've seen before. It's one that looks for new versions of old threats with somewhat different signatures. So it's probably a false positive. I'm going to report it to Symantec.

[TomU]

Odd that the exact same file didn't trip up any of the other AV software it was fed through...

[TomD.inPDX]

It's time to get back to CS... Windows reports the same portmap.exe in Creo 2.0 M060 install file. I ran a scan on this file and no issue. I don't know if it is PTC branded or not. I still cannot open CAB files within the large ZIP.

This was the port from Norton when I scanned the Creo 2.0 M060 zip:

Scan Statistics:
Scan Start:
Local: 12/16/2014 12:10 PM
UTC: 12/16/2014 8:10 PM
Scan Time: 984 seconds
Scan Targets: C:\Users\...etc...\PTC\Creo2.0_install_files\MED-100WIN-CD-390_M060_Win32-64.zip
Counts:
Total items scanned: 259,534
- Files & Directories: 259,534
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 0
- Skipped Files: 0

Total security risks detected: 0
Total items resolved: 0
Total items that require attention: 0

Resolved Threats:
No risks have been resolved

Unresolved Threats:
No unresolved risks

[RichardJ]

Well, if it's a heuristic algorithm nobody else will have exactly the same algorithm. Something in the file triggered the Norton algorithm, but not anyone else's. I just reported it to Symantec, and I'll let you all know what they say.

[TomD.inPDX]

Thanks Richard. I just updated CS.

[TomD.inPDX]

CS is also reporting this to Norton as a false positive and will get feedback from them as to when it is fixed in their risk list. Appearantly, this is also going into R&D to better undertsand how this can be avoided in the future. But no SPR as yet.

Scanning the M010 install disk now.

[TomD.inPDX]

Install disk scan also showed risk. It did not specifically point to the file but it did point to the cab file. And now I can see what is in the cab file with OPEN from the disk and it only contains the portmap.exe file. And Norton is still clamping down hard on this one.

Scan Information:
Virus Defs Version: 2014.12.15.016
Virus Defs Seq ID: 159772

Scan Statistics:
Scan Start:
Local: 12/16/2014 12:51 PM
UTC: 12/16/2014 8:51 PM
Scan Time: 1,952 seconds
Scan Targets: D:\ptcsh0
Counts:
Total items scanned: 279,184
- Files & Directories: 279,184
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 0
- Skipped Files: 0

Total security risks detected: 1
Total items resolved: 0
Total items that require attention: 1

Resolved Threats:
No risks have been resolved

Unresolved Threats:
Suspicious.Cloud.7.F
Type: Anomaly
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Heuristic Virus
Status: Remove Failed
-----------
1 File
d:\ptcsh0\ptc269.cab - Delete Failed

[Inoram]

IMO It's not PTC's responsiblity to prove the innocence of their file, other then possibly providing a verified checksum or whatever they are going to use to check against. Which should be Norton's job to figure out.

[TomD.inPDX]

Interesting perspective

It will be interesting to see what Norton tells us and PTC.

[RichardJ · Accepted solution]

I just got this from Symantec:

In relation to submission [3688339].

Upon further analysis and investigation we have verified your submission and, as such, the detection(s) for the following file(s) will be removed from our products:

53E35B99B59E10B3BA69A503A4919AF6 - portmap.exe

The updated detection(s) will be distributed in the next set of virus definitions, available via LiveUpdate or from our website at http://securityresponse.symantec.com/avcenter/defs.download.html

Decisions made by Symantec are subject to change if alterations to the Software are made over time or as classification criteria and/or the policy employed by Symantec changes over time to address the evolving landscape.

If you are a software vendor, why not take part in our whitelisting program?

To participate in this program, please complete the following form: https://submit.symantec.com/whitelist

So it is definitely a false positive. PTC might want to think about that whitelisting program. I assume other AV software companies have similar programs

[TomD.inPDX]

Thank you very much, Richard!

I will let you know if it indeed stops flagging this within the next week.