Norton Internet Security quarantined 2 files just after I installed the LR4 Beta, based on heuristic malware characteristics, both in the support\dynamiclinkmediaserver\dynamiclinkmediaserver\1.0 subfolder in the install location: qtparser.dll and mc_enc_mpa.dll.
I have yet to run the program without these files. Anybody else run into this?
Yes, I'm also running Norton IS and it also removed what it said was a virus in both those DLLs.
Here's the output from NIS on the first one:
Full Path: c:\program files\adobe\adobe photoshop lightroom 4\support\dynamiclinkmediaserver\dynamiclinkmediaserver\1.0\qtparser. dll
Number of users in the Norton Community that have used this file: Unknown
This file release is currently not known.
This file risk is high.
Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.
File: c:\program files\adobe\adobe photoshop lightroom 4\support\dynamiclinkmediaserver\dynamiclinkmediaserver\1.0\qtparser. dll
File Thumbprint - SHA:
File Thumbprint - MD5:
I have no idea if these are legitimate or not, but I can at least confirm what you're asking.
The question is, now what?
A poster on dpreview referred me to "isthisfilesafe.com" (I'm not familiar with the site) which states that qtparser is safe (looks as if it's been in use by Adobe for a couple of years) and that mc_enc_mpa.dll is an audio encoder file. I suspect Norton is being a bit trigger happy here, Better safe than sorry, but this is a pain. Still, until I get some deeper confirmation that these particular files or OK, I'll run the program without them to the extent it remains functional. Good thing I don't do much with video, which may have some dependence on the encoder. I'll report what I find out back here.
Some of you have more tolerance for risk than I do, but I think you're probably right, and that this is a false positive. So -
1) I've run LR4 beta without the quarantined files and so far no problem has arisen
2) I've reported these as potential false positives to Symantec - we'll see how long it takes them to respond.
Thanks enormously for all the feeback here. If anything weird happpens, I'll post here. If not, assume I got assurance and liberated these from quarantine with no ill effects.