HI Minedu,

Just a clarification on terminology: if SEP is reporting files as infected and you believe they are safe, it's referred to as a "false positive."  False negative would be a malicious file that SEP scanned and was missed. 

This article is the best place to begin: Best Practice when Symantec Endpoint Protection or Symantec AntiVirus is Detecting a File that is Believed to be Safe (http://service1.symantec.com/support/ent-security....)

I am not aware of any FP that affects the file names that you have listed, but file names are a poor indicator of the file's true nature.  Can you list the unique MD5 hash value of each?  With that information I can go and check for simiiar reports.

It would also be good if you could export SEP risk history that shows those files being detected and attach it to this community thread.  I will keep an eye out for it!

Thanks and best regards,

Mick

Mick,

I have the same quarantined files as Minedu. How to detect if these files are actually infected.

Hi Autclock,

Can you let me know the MD5 hash values of those files?

The links, etc above will also help....

Thanks and best regards,

Mick

We are getting the same reported infection.  I believe this is part of the right-click tools.

*changecachesize.vbs md5
fd7ae021ffdcbacf79ee73a67ec7d7e9

Thanks for your help Mick2009.

Hi Mick2009
 
Thanks for your response, this is as you described a “false positive”  my mistake.

Below are the MD5 hashes and attached is the risk report.
 
changecache.exe
MD5
98f552c986c8ed4bc489b1a676b542de
 
Tools.exe
MD5
47e7bdb33b4ccca0c9fed98a4ed9b8ea

Thanks.

Same issue here, and yes, I believe it is part of the right-click tools. ( i just ignored it.)

I also had  "Setup.exe" from Akeni instant messenger detected as trojan.gen last week.

Hi Mick,

I can confirm that this is now working, I have removed the local exception and no more alerts about trogans.

Thanks for you help.