Page 1 of 1

UMS 2.6.0 & Symantec reporting security risk

Posted: Sun Mar 31, 2013 1:31 am
by john3voltas
Hello.
I am trying UMS on a laptop PC running Windows 7 x64 (intel coreduo 1.8Ghz/4GB RAM).
This is "the company's laptop" so it has symantec endpoint protection 12.0 installed.
When I install UMS on it, symantec detects a "suspicious.emit" in mplayer.exe.
Since I don't manage symantec (corporate rules) I can't disable it and apparently UMS doesn't work without it.
So I downloaded mplayer.exe for windows from mplayerhq.hu and put it in UMS/win32 folder. Then I started UMS and apparently it is working fine.
1-I sure hope this is a false positive but is there any reason why a "stock" mplayer.exe doesn't trigger the AV while the one that comes with UMS triggers the AV?
2-Am I missing anything by using the stock mplayer.exe instead of the one that comes with UMS?

Full symantec log:

Code: Select all

Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Suspicious.Emit
File: C:\Program Files (x86)\Universal Media Server\win32\mplayer.exe
Location: C:\Program Files (x86)\Universal Media Server\win32
Computer: corporate_computer_name
User: corporate_user_name
Action taken: Pending Side Effects Analysis : Access denied
Date found: sábado, 30 de Março de 2013  13:28:08

Re: UMS 2.6.0 & Symantec reporting security risk

Posted: Wed Apr 03, 2013 8:27 am
by SubJunk
It's probably just because they have manually allowed the standard mplayer but not our one. We've had lots of problems with Symantec blocking things before. Our version of MPlayer has more reliable audio sync and is needed for DVD support, Xbox support, and some other things. If the stock one works for you then stick with it :)