Symantec Enpoint Protection Detects Emacs 24.1.0.0 As Virus

[David Cagle]

Hello,

 

I’m a long time Emacs user and recently ran into a problem running Emacs 24.1.0.0 on a machine using Symantec’s Endpoint Protection Software.  The OS is Windows 7. 

 

Executing:

..\emacs-24.1\bin\runemacs.exe

 

Results In:

Symantec Endpoint Protection Virus Detected!

Scan Type – Bloodhound.Sonar.9

 

Executable is quarantined and cannot be run.

 

---

 

I submitted a ‘False Positive’ report with Symantec and they issued a ‘virus definition’ file which resolved the problem BUT implied it is only valid for this particular version of emacs.  An email from Symantec contained the following suggestion:

 

-----Original Message-----

From: Symantec FP Incident Response [mailto:falsepo...@symantec.com]

Subject: Dispute Submission [2820772]

 

If you are a software vendor, Symantec offers the possibility of adding your software to its database of known clean files in order to reduce the possibility of false positives. If you wish to participate in this program, please complete the following form.

 

https://submit.symantec.com/whitelist

 

[Stefan Monnier]

> I'm a long time Emacs user and recently ran into a problem running Emacs
> 24.1.0.0 on a machine using Symantec's Endpoint Protection Software.

Great opportunity to throw away your virus scanner. These are useless
beasts that do nothing better than eat up your computer's resources.

It's just as easy (and a lot more safe and efficient) to upgrade the OS
to fix the bug, than to upgrade your virus scanner to catch some of the
viruses that might exploit that bug.

Virus scanners make you feel nice and warm every time they tell you they
detected a virus, even tho it may not be a virus at all, or even if it
is, it will most of the time be ineffective on your system anyway
(because the actual bug was fixed in the mean time).

> The OS is Windows 7.

Of course, rather than throw away just the virus scanner, you can also
just throw away the whole OS and replace it with a Free one.

> I submitted a 'False Positive' report with Symantec and they issued a 'virus
> definition' file which resolved the problem BUT implied it is only valid for
> this particular version of emacs. An email from Symantec contained the
> following suggestion:

Yup: virus scanners are crap software that sucks, because it's based on
flawed technology. It's about as stupid as a "no-fly" list of
"dangerous names".


Stefan