• Registered: 2010-12-23
  • Posts: 1

Topic: Norton Internet Security Detects Roe.exe as Suspicious.Cloud.2

The program located in ..\dps_base_1006\bin\wnt5_x86-32\roe.exe gets automatically removed from Norton Internet Security as it believes that this is a virus based on malware heuristics. I was not sure if I should go ahead and allow roe.exe or not. I wanted to verify with the authors that the latest version of roe.exe has not somehow been infected. Please post a response on the main page as to wither or not this file is safe to "Restore & exclude this file" which is under options for Norton Internet Security.

  • From: Cambridgeshire, UK
  • Registered: 2007-01-27
  • Posts: 6,226

Re: Norton Internet Security Detects Roe.exe as Suspicious.Cloud.2

Symantec Endpoint Protection is perfectly happy with the file at my end.  The MD5 hash of the ROE.exe file I have is: 3085439b8dd7b0169bf7c06143afa9f6

Read BEFORE you post.  HWID tool   DriverPacks Tutorial   DONATE!
http://driverpacks.net/userbar/admin-1.png
Not all heroes wear capes, some wear Kevlar!
  • OverFlow
  • DriverPacks Administrator & BASE Developer
  • Offline
  • From: Cincinnati
  • Registered: 2006-12-02
  • Posts: 6,730

Re: Norton Internet Security Detects Roe.exe as Suspicious.Cloud.2

ROE.exe is a program that will create an entry in the registry to run the DriverPacks Finisher the next time a computer starts. This is neccessary to install the driverpacks during windows setup.

This type of action might / would seem suspicious to a virus scanner. (hey it found a program that wants to modify the registry and auto run a program! That is kinda suspicious!) It is however by design and neccessary and expected.

Your scanner is warning you about a potential danger (IE Suspicious). Since you know the file is there as an integral part of a program that you intentionally downloaded (IE It's no longer suspicious, You know exactly what it is.)... you can ignore it. Wouldn't hurt to use mr_smartepants hash as a double check that it is the file we ship with our package big_smile.

Suspicious is WAY DIFFERENT than a "positive".

DP BartPE Tutorial   DP_BASE Tutorial   HWID's Tool     Read BEFORE you post    UserBars!
http://driverpacks.net/userbar/admin-1.png
The DriverPacks, the DP_Base program, and Support Forum are FREE!.

OverFlow's Website