Article:HOWTO55254  |  Created: 2011-06-29  |  Updated: 2011-12-16  |  Article URL http://www.symantec.com/docs/HOWTO55254
Article Type
How To



SONAR is a real-time protection that detects potentially malicious applications when they run on your computers. SONAR provides "zero-day" protection because it detects threats before traditional virus and spyware detection definitions have been created to address the threats.

SONAR uses heuristics as well as reputation data to detect emerging and unknown threats. SONAR provides an additional level of protection on your client computers and complement your existing Virus and Spyware Protection, intrusion prevention, and firewall protection.

Legacy clients do not support SONAR; however, legacy clients use TruScan proactive threat scans to provide protection against zero-day threats. TruScan proactive threat scans run periodically rather than in real time.


Auto-Protect also uses a type of heuristic that is called Bloodhound to detect suspicious behavior in files.

See Managing SONAR

See About the files and applications that SONAR detects

Legacy ID


Article URL http://www.symantec.com/docs/HOWTO55254

Terms of use for this information are found in Legal Notices