Symantec Scan Engine deletes clean exe files such as the adobe flash player installer

Article:TECH178323  |  Created: 2012-01-05  |  Updated: 2012-05-15  |  Article URL http://www.symantec.com/docs/TECH178323
Article Type
Technical Solution

Product(s)

Issue



Symantec Scan Engine deletes clean exeutable files such as the adobe flash player installer installation file.
 


Error



A container violation has been found
Date/time of event = 2011-10-26 10:23:19 Event Severity Level = Warning URL = aihdownload.adobe.com/bin/install_flashplayer11x32ax_gtbd_aih.exe
File name = install_flashplayer11x32ax_gtbd_aih.exe
File status = BLOCKED
Component name = install_flashplayer11x32ax_gtbd_aih.exe
Component disposition = DELETED
 


Environment



Symantec Scan Engine 5.2.x
 


Cause



Some executables are encrypted and by default Scan Engine deletes encrypted containers.
 


Solution



To resolve the issue follow these steps:
1. In the Scan Engine console Uncheck/Disable "Delete encrypted containers" in Policies - Filtering - Container Handling
2. Click on Save using the floppy disk icon in the top left
3. Go into services.msc and restart the Symantec Scan Engine service

 




Article URL http://www.symantec.com/docs/TECH178323


Terms of use for this information are found in Legal Notices