Endpoint Protection

Symantec looks at firefox_setup_3.0.4_en.exe , firefox_setup_3.0.4_en.exe.svn_base and firefox3.6.13 as a downloader virus and deletes them.

What Symantec product and version are you running? Are you getting the Firefox setup file from the Mozilla site or someplace else?

http://www.mozilla.com/en-US/firefox/

Did you get the .exe from Mozilla's website or from an unknown, untrusted source?

running symantec 10.1.9.9000. One correction to make it is not deleting firefox 3.6.13 just the old setup files firefox_setup_3.0.4_en.exe , firefox_setup_3.0.4_en.exe.svn_base.

The files were downloaded from mozilla's site

It may be a false positive. Note that 3.0.4 version of Firefox is over two years old.

move the files before closing Firefox the files will  not be deleted.

thats what I figured and since they are now running firefox 3.6 it doesnt matter . The problem happened on all our QA machines and it was deleted from the folowing folder which is odd , im thinking it was downloaded through selenium rather than Firefox.

C:/qa/ExternalUtils/SeleniumToolSetup/.svn/tmp/text-base/Firefox_Setup_3.0.4_en.exe.svn-base  

I am not familiar with Selenium, but the fact that it was downloaded from a site other than Mozilla and the files were flagged by SAV makes me a bit concerned.

is that the default folder where downloads are stored? you can try excluding that if you want....

It looks like Selenium works like a keylogger.

Selenium IDE is a Firefox add-on that records clicks, typing, and other actions to make a test, which you can play back in the browser.

This explains why SAV flagged the files.

http://seleniumhq.org/ - link Safeweb tested