SONAR.Cryptlck!g134 warning from Norton

[Dopplizzle]

Just a heads up. Norton Security is firing off a heuristics detection warning of "SONAR.Cryptlck!g134" trojan virus for soundswitch.exe. Re-downloading and reinstalling from your github immediately fired it again upon running the executable. This hasn't happened before, so not sure why it's tripping the alert now, but it is (Norton tends to err on the side of caution). It's a little unsettling, even when I'm sure it's a false positive...

[Belphemur]

Hello @Dopplizzle

It's not the first time Norton is annoying with the installer.
It must be because this last version includes the debugging symbols (pdb) that would help me debug the program if it crashed.

I ran a virus total with the download link:
Url
File itself

As you can see, there is nothing dangerous into the installer (hence neither in the application itself).

[Dopplizzle]

Yep, I had already run those checks, mostly posted here so others could google it. Thanks for double checking. Closing the issue.

[Belphemur]

I submitted the false positive report to Symantec.
We'll see where it goes...

I'll keep this open for transparency purpose.

[Belphemur]

I got an answer from Symantec, they can't reproduce the issue. Can you give me the exact name of the product you're using and it's version?

It would help greatly!

[Dopplizzle]

I am using Norton Security version 22.9.0.68. with Windows 10 64-bit. Oh, and the latest version of SoundSwitch v3.12.8.37187 doesn't seem to cause the alert...

[CrippleZero]

I am on a corporate machine and the same happened to me. Our company is running Symantec Endpoint Protection 12.1.6 (12.1 RU6 MP5) build 7004 (12.1.7004.6500). I am running Windows 7 64bit with the latest release of SoundSwitch.

Even though I "recover" the executable for SoundSwitch, it immediately gets put back in to Quarantine once I attempt to run it.

This did not happen with the previous version of SS.

EDIT: My fault - I was running v3.12.6.23652; I didn't see that you had updated to .8.37187. It works!

[Belphemur]

Symantec confirmed the False Positive, it should take around 72h to propagate to all their products.
I'll keep the issue open for 72 hours.

Exerpt of the email response:

In relation to submission 18472.

Upon further analysis and investigation we have verified your submission and, as such, the detection(s) for the following file(s) will be removed from our products:

File name: 0128f3091762d1aefd4af9d01f52cd33c1bdd378179530937b01757c549396f8
MD5: 76b30cdde516c2b6d5e23cf097ed13dd
SHA256: 0128f3091762d1aefd4af9d01f52cd33c1bdd378179530937b01757c549396f8
Note: Whitelisting may take up to 72 hours to take effect via Live Update

In relation to submission 18239.

Upon further analysis and investigation we have verified your submission and, as such, the detection(s) > for the following file(s) will be removed from our products:

File name: SoundSwitch_v3.12.6.23652_Release_Installer.exe
MD5: 1c34e1b837db11121bd2f99d577c551d
SHA256: 15fd5b65dc7661422d6883c06a038f2e45e46727c0f75f073cfa0450f53c5166
Note: Whitelisting may take up to 72 hours to take effect via Live Update

[arosendaal]

Good to read this: I had the same issue, probably after the update on 13/2. Symantec Endpoint Protection.

SoundSwitch version 3.12.7.38751. Win 7 Enterprise 64-bit

[uvcshelp]

My organization is continuing to have issues with Symantec Endpoint Protection disabling SoundSwitch, despite Symantec having by now released a number of updates for its malware definitions.

SoundSwitch version 3.12.8.37187
Windows 10 Education version 1607 build 14393.693
Symantec Endpoint Protection managed client version 12.1.6 (12.1 RU6 MP6) build 7061 (12.1.7061.6600)
SEP definitions current as at 2017-02-20 11:00 PST

[arosendaal]

No problems here anymore, including a manual scan of soundswitch.exe: SoundSwitch version 3.12.8.37187 Windows 7 Enterprise SP1 Symantec Endpoint Protection version 14.0 MP1 build 2332 SEP definitions current as at 2017-02-22 Kind Regards, André From: uvcshelp [mailto:[email protected]] Sent: dinsdag 21 februari 2017 23:41 To: Belphemur/SoundSwitch Cc: arosendaal; Comment Subject: Re: [Belphemur/SoundSwitch] SONAR.Cryptlck!g134 warning from Norton (#146) My organization is continuing to have issues with Symantec Endpoint Protection disabling SoundSwitch, despite Symantec having by now released a number of updates for its malware definitions. SoundSwitch version 3.12.8.37187 Windows 10 Education version 1607 build 14393.693 Symantec Endpoint Protection managed client version 12.1.6 (12.1 RU6 MP6) build 7061 (12.1.7061.6600) SEP definitions current as at 2017-02-20 11:00 PST — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146 (comment)> , or mute the thread <https://github.com/notifications/unsubscribe-auth/ABMSm-EmNkOiIr5Cwc-4nmaedF-ERgOqks5re2fhgaJpZM4L-m01> . <https://github.com/notifications/beacon/ABMSmyl49A48t1Wm6jXMgfIrO12A4QBlks5re2fhgaJpZM4L-m01.gif>