Norton Antivirus says Trojan.ADH.SMH in uninstall.exe

[rudolfdermapper]

I downloaded and installed josm version 7000 (7001 version 2014-04025)
from ​http://josm.openstreetmap.de/download/windows/josm-setup.exe
After Installation Norton Antivirus poppued up and said Trojan.ADH.SMH in c:/program files (x86)/josm/uninstall.exe, blocked, no further action required.

[bastiK]

​Trojan.ADH.SMH is a feature by Norton that looks for certain suspicious characteristics of files.

From the description page:

If one or more files on your computer have been classified as having a Trojan.ADH.SFC threat, this indicates that the files have suspicious characteristics and therefore might contain a new or unknown threat. However, given the sensitive nature of this detection technology, it may occasionally identify non-malicious, legitimate software programs that also share these behavioral characteristics.

It is very likely that there is nothing wrong with that file, but this is indeed a false alarm. Could you please

• attach the file c:/program files (x86)/josm/uninstall.exe to this ticket for future reference
• submit ​a report that you suspect an erroneous detection. They will (hopefully) double check the file and put it on a white list.

[Don-vip]

I have sent a bug report to Symantec.

[Don-vip]

They are asking for more information, could you please tell us your exact version of Norton Antivirus and if the problem's still here with latest definition updates?

Symantec:

In relation to submission 3584099.

Having reviewed the information provided we are unable to reproduce or confirm the issue described.

Please ensure that you are using Symantec's latest virus definitions for detection. These can be found using live update or alternatively via the URL below.
​http://securityresponse.symantec.com/avcenter/defs.download.html

If the issue persists with the latest definitions, please respond to this email providing the additional information below in order for us to analyze the problem further:

• Details of the message or a screenshot of the message received
• Exact step by step instructions on how to recreate issue
• Details of the Symantec product and version being used
• Detection log(s) from the product

If other versions of the file(s) in question have previously triggered false positive detections please mention this in your response and include all available file versions.

Sincerely,
Symantec Security Response
​http://securityresponse.symantec.com