Hello Everybody.
I had with the nightly before (The 21 June 2016 build (10868)) some heuristic behaviour based virus-detections again with Symantec Norton 630. Further investigations showed that this where "False Positive" detections. Thus I decided to provide Symantec a zip-file with all 6 exe and 79 dll files of this nightly with the request to place them on their whitelist to prevent such detections for the current nightly.
They have accepted my request and yesterday I received the following reply:
Hello,
In relation to software whitelist submission 4003687.
We have added this version of the software to our whitelist.
Whitelisting is file specific. A new version of your software may have new files and thus new versions of the files would not be known to us. This could result in a false positive occurring on the new files.
In order to mitigate this risk, we recommend submitting new versions of your software to us.
Symantec's decision is not a certification or endorsement of your software in any way, and you are expressly advised by this message that Symantec does not consent to you disclosing that Symantec has added your software to its White-List, or that Symantec has evaluated, endorsed or certified your software in any manner, directly or indirectly.
Decisions made by Symantec are subject to change if alterations to the software are made over time or as classification criteria and/or the policy employed by Symantec changes over time to address the evolving landscape.
Please see our software whitelist program FAQ here: https://support.symantec.com/en_US/article.TECH232956.html
Sincerely,
Symantec Security Response
http://securityresponse.symantec.com
My first tests with the "File Insight" tool of Norton showed, that dll files detected as suspicious in the old release are now accepted as ok, even they are new and only less Norton users seem to use the new nightly (known by Symantec).
How ever, I hope that this nightly will not be detected by Symantec products any more and if so the mail posted here will be helpful while further discussions.
Best regards,
Eckard Klotz.