Norton Antivirus 2011 removes the exiftool 8.50 application

[ali]

Hi,

I had reported the same problem earlier as well and can confirm that I was able to install 8.51 today without NAS interfering. It seems to work fine, what it didn't a couple of days ago.

Alfred

[Phil Harvey]

Well, that's good enough for me.  With great relief I will now end my testing so I can dump this Norton software since it is a terrible drain on all of my system resources (CPU, disk, network), and interferes with some of my other software.  (Probably worse than most viruses out there...)

- Phil

[BogdanH]

...so I can dump this Norton software since it is a terrible drain... ...(Probably worse than most viruses out there...)

^ -you've made me laugh 

Bogdan

[rugru]

Hi Phil,

With ExifTool 8.51 and 8.52 used as Windows Executable, the problem with NAV remains on my computer (Win7). Fortunately, I found a description on the net, how to exclude ExifTool from scanning with NAV:
Link: http://community.norton.com/t5/Norton-Internet-Security-Norton/SONAR-is-deleting-programs/m-p/192632.
Paragraph with yellow background: '2. Files when restored from quarantine are convicted again by SONAR'.
After performing the steps of this paragraph I can use ExifTool as Windows Executable without hassle.

Regards, Rudolf

[tbaetge]

I use Exiftool with Geosetter on two computers, both with NIS 2011 but different operating systems. On the Windows XP machine there ist no problem. On the other one, running Windows 7 64bit, NIS Sonar always removes ExifTool.

Regards,
Torsten

[Phil Harvey]

Hi Torsten,

Thanks for this information.

I have just posted this in the Norton AntiVirus forum

- Phil

[Phil Harvey]

Update:  Symantec has been quite responsive about this.  In the Norton forum they said that they can't reproduce the problem with exiftool 8.56, but I submitted 8.50 using their "false positives" form and received this response:

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software. In light of further investigation and analysis Symantec is happy to remove this detection from within its products.

The updated detection will be distributed in the next set of virus definitions, available daily, or weekly via LiveUpdate, depending on Symantec product version, or daily from our website at

http://securityresponse.symantec.com/avcenter/defs.download.html.

Decisions made by Symantec are subject to change if alterations to the Software are made over time or as classification criteria and/or the policy employed by Symantec changes over time to address the evolving landscape.

If you are a software vendor, Symantec offers the possibility of adding your software to its database of known clean files in order to reduce the possibility of false positives. If you wish to participate in this program, please complete the following form.

https://submit.symantec.com/whitelist

Sincerely,

Symantec Security Response

So it sounds like this problem should be fixed at their end.

- Phil