F-Secure blocking Subsurface

[Lubomir I. Ivanov]

On 8 February 2015 at 17:55, Krzysztof Arentowicz <karent.bug at gmail.com> wrote:
> I got a report from a user that on his machine Subsurface was blocked by F-Secure's Deep Guard heurestic.
> Policy settings prevented him from disabling this functionality, so he was unable to run Subsurface.
> I cannot reproduce as I don't have access to a machine with such configuration but I'm letting you now in case this is not an isolated case.
>
> This was reported on Windows7 Pro 64 bit
> F-Secure Client Security 11.60 build 284
> F-Secure Anti-Virus 9.51 build 131
>
> as
>
> Suspicious: W32/Malware!Gemini
> https://www.f-secure.com/v-descs/suspicious_w32_malware_gemini.shtml
>

most/all Windows AV software including F-secure support the "add
exception" feature, which skips an executable from being scanned.

for AV users there are a couple of things to note in the documentation:
1) if Subsurface is detected as malware on runtime, please use the
"Add exception" of your AV software to mark "subsurface.exe" as
non-harmful
2) if the Subsurface installer download is detected as malware, please
temporary disable your AV software until Subsurface is installed
3) please inform your AV software vendor of a "false positive" as we
assure your that Subsurface is not malware

lubomir
--