Getting rid of false positive?

[Migration User]

One of our clients is producing thousands of alerts about a Windows Indexing file (the indexing service generates the file again over and over....)
Virustotal says it's clean.
I submitted it to Symantec, they say it's clean.

No other computers react to the file.

Risk name is just  "ACG", which is not very telling, really...

But how do I stop this now? Has anyone had similar problems?
Last week the same thing happened, for a day, then stopped. Now it's on again...

We tried clearing the indexes, but this didn't help. It comes back.

Client is RU5, defs. feb 16th, rev 39.

[Rafeeq]

create  centralized exception for that file 

http://service1.symantec.com/support/ent-security.nsf/docid/2008030423280248
send the file to symantec again saying that its detecting false, the file is jenuine, they wil correct in next virus defs.

[Migration User]

Please submitt the file to Symantec Security Response and Open a Ticket with Support so that it can be dealt on High Priority

https://submit.symantec.com/websubmit/gold.cgi

https://submit.symantec.com/dispute/false_positive/


http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2005012415180263

[Migration User]

Thanks, but the file name is not constant. Last week it was a slightly different name (the files are named with a running number, it  seems).

I did point out to Symantec security response that it was a false positive, but they never commented on that.

I also find it strange that it is only this one computer that reacts to the file....

[Migration User]

Ah.. thanks, that's news to me. I only knwe of the page for submitting it as a suspicious file.

Now submitted as a false positive, too!

[Mick2009]

Hi Reedmohn,

The following article may help:

Best Practice when Symantec Endpoint Protection or Symantec AntiVirus is Detecting a File that is Believed to be Safe

Specifically look at whether the detection is signature-based or heuristic.  What component is logging these detections?  If your bloodhound settings are configuraed at their highest level and it is resulting in what you have confirmed to be false positives, then you may wish to set them lower.

Thanks and best regards,

Mick