Since turning on heuristic scans (aka bloodhound detection) in SEP 11, we occasionally get random email notifications for valid exes that are being picked up and then left alone one example is in the alert below:

At least one security risk found:

Risk name: (Unknown)

File path: c:\impsql\progress\bin\prowin32.exe

Event time: 2013-03-05 06:58:39 GMT

Database insert time: 2013-03-05 07:00:43 GMT

Action taken on risk: Details pending

How can we stop this from happening, it doesn't do any harm but just alerts each time it finds it.  Can Symantec update defs if I send a copy of this file so it doesn't keep happening or is the only way to make a centralised exception for truscan proactive threats.

First, you can add an exception for the file. See this KB on how to do so:

Creating exceptions for Symantec Endpoint Protection

You can send it to Symantec to have the app whitelisted. See here:

https://submit.symantec.com/whitelist/isv/
 

About adjusting TruScan settings for legacy clients

check this link

http://www.symantec.com/business/support/index?page=content&id=HOWTO27058

submit the file to security response

Hi,

In quality assurance circles at Symantec it is often stated that clean data (e.g. files from clean software) are to false positives as malicious data are to true positives. In simple terms this means that clean data helps us prevent false positives in the same way that we can’t write antivirus signatures or antivirus technology if we don’t have malicious data.

Refer this blog to learn more about it: https://www-secure.symantec.com/connect/blogs/software-white-listing-program

I see that the links to whitelist apps are only for the original software authors/developers i.e. https://submit.symantec.com/whitelist/isv/.

Is there a different link to use as a business user of the app or is it best to go back to the software vendor and request that they submit it to Symantec?
 

You can upload the file for the false-positive detection check on the following portal:

https://submit.symantec.com/false_positive/

I think you can still submit this as they verify the installer and whitelilst accordingly.

Hi,

I would suggest to get it whitelisted from origianl software vendor only.