I am affraid you will need to contact Tech Support - they will tell you where to submit the file and will take care about the rest :) It's quite easy and painless.

I'm having the same problem. Exceptions are not working.

Try applying the latest Rapid Release definitions before contacting support.

Best Practice when Symantec Endpoint Protection or Symantec AntiVirus is Detecting a File that is Believed to be Safe

http://www.symantec.com/business/support/index?pag...

Thomas

I just applied the rapid release defs and I get the same behavior.

I set the exceptions via the SEP Manager console and pushed the content to the client.

I added the filename to centralized exceptions.

I defined the file as a security risk file, action Ignore. I pushed the new policy to the affected computer and it has not done anything.

I have the same software installed on three different operating systems. XP Pro and Windows Server 2008 are affected. Windows 7 is not affected. The SEP client on the Windows 7 machine has not quarantined or deleted the file.

This is a huge problem. I cannot manage several hundred computers because of this.

I've contacted Faronics, maker of Deep Freeze, as well.

These 3 machines (7, XP and 2008) have the same AV/AS policy? Could you tell me what this file is detected as? You can export a risk log from your SEP client and paste it here.

They're managed by two different consoles. The Windows 7 and XP machines are on one and the server is on a separate one. The file is detected as an Infostealer. Here's the text of the risk log:

Filename,Risk,Action,Risk Type,Original Location,Computer,User,Status,Current Location,Primary Action,Secondary Action,Logged By,Action Description,Date and Time
DFServerService.exe,Infostealer,Cleaned by deletion,File,C:\Program Files\Faronics\Deep Freeze 7 Enterprise\,CULGHOST,DSSupport,Deleted,Deleted,Clean security risk,Quarantine,Auto-Protect scan,The file was deleted successfully.,12/1/2010 7:17:56 AM
DFServerService.exe,Infostealer,Cleaned by deletion,File,C:\Documents and Settings\DSSupport\Local Settings\Temp\,CULGHOST,DSSupport,Deleted,Deleted,Clean security risk,Quarantine,Auto-Protect scan,The file was deleted successfully.,12/1/2010 9:39:45 AM
DFServerService.exe,Infostealer,Cleaned by deletion,File,C:\Program Files\Faronics\Deep Freeze 7 Enterprise\,CULGHOST,DSSupport,Deleted,Deleted,Clean security risk,Quarantine,Auto-Protect scan,The file was deleted successfully.,12/1/2010 10:28:38 AM
DFServerService.exe,Infostealer,Restart Required - Cleaned by deletion,File,C:\Program Files\Faronics\Deep Freeze Enterprise Server\,CULGHOST,SYSTEM,Deleted,Deleted,Restart Required - Clean security risk,Restart Required - Quarantine,Auto-Protect scan,The file was deleted successfully.,11/30/2010 4:09:37 AM
DFServerService.exe,Infostealer,Cleaned by deletion,File,C:\Documents and Settings\DSSupport\Local Settings\Temp\,CULGHOST,DSSupport,Deleted,Deleted,Clean security risk,Quarantine,Auto-Protect scan,The file was deleted successfully.,11/30/2010 7:19:34 AM
DFServerService.exe,Infostealer,Restart Processing,File,C:\Program Files\Faronics\Deep Freeze Enterprise Server\,CULGHOST,DSSupport,Infected,C:\Program Files\Faronics\Deep Freeze Enterprise Server\,Delete,Leave alone (log only),Auto-Protect scan,Performing Post-Reboot Risk Processing.,11/30/2010 7:18:02 AM
DFServerService.exe,Infostealer,Cleaned by deletion,File,C:\Program Files\Faronics\Deep Freeze 7 Enterprise\,CULGHOST,DSSupport,Deleted,Deleted,Clean security risk,Quarantine,Auto-Protect scan,The file was deleted successfully.,11/30/2010 9:30:38 AM

Thanks for helping!

Yes, I did things just as you describe. I'll try the tamper protection. BTW, this is not a new installation of any software. We've been working just fine for a long time with all the software. There haven't been any changes except the usual virus def updates and windows patches. I might not be surprised if it was a brand new version of Deep Freeze or something but this just came out of nowhere yesterday morning.

Tamper protection exception did not work. SEP deletes DFServerService.exe as soon as I install the software.

The version of Deep Freeze on my Windows 7 box is slightly older, btw.

Will do. I'll figure out who at Cornell is authorized to do this sort of thing. I'm quite sure it's not me. :-)

Thanks for your help.

A quick and unscientific search shows no submissions of the file DFServerService.exe in the past week - if anyone is still affected by this suspected false positive, even with the latest rapid release definitions, please do make a submission of this file and contact Technical Support.  All the instructions afre in the thread above.  Security Response will examine the file in depth and eitehr confirm the detection or confirm a False Positive.

Thanks and best regards,

Mick