Ranorex Studio RUN - Symantec Conflict SONAR.Heuristick.155

Ranorex Spy, Recorder, and Studio.
RanoTester
Posts: 18
Joined: Mon Jan 14, 2013 7:16 pm

Ranorex Studio RUN - Symantec Conflict SONAR.Heuristick.155

Post by RanoTester » Thu Dec 01, 2016 5:35 pm

SUMMARY: This may affect other customers. That is why I am posting this. We are currently running Ranorex Studio 6.1.1 on a Windows 7 (SP1) machine using Internet Explorer 11 for the web app we are testing. This machine also uses Symantec Endpoint Protection v12.1.1101.401 as its anti-virus software. This morning, after running a LiveUpdate from within Symantec, we could no longer run individual scripts from within Ranorex Studio, i.e., we'd open an existing script (.rxrec) and click RUN. When it would try to launch, we'd get a blank Symantec popup. We later discovered this was due to Symantec detecting SONAR.Heuristick.155 as a live threat. We've never seen this problem before. It only started to occur this morning.

In this case, it was a false positive. Symantec interpreted something Ranorex does (i.e., when it tries to run a script) as a SONAR.Heuristick.155 detection. As a result, Symantec would disallow Ranorex to proceed with the net result being the total loss of ability to run a Ranorex script ever again on the machine. That is . . . until we performed below-stated workaround.

WORKAROUND: In the Symantec ‘Proactive Thread Protection’ section, needed to add SONAR.Heuristick.155 as an excluded item. Attached are a few screenshots of the process we used to add this exclusion (within Symantec).
Attachments
12_1_16 - Figure 3x - Symantec - Ranorex.JPG
Workaround: In the Symantec ‘Proactive Thread Protection’ section, clicked Options > Change Settings, selected the ‘System Change Detection’ tab, clicked View List button, clicked Add, select ‘Application Exception’, and then select “SONAR.Heuristick.155” as an item to exclude. Once this was OK'd, the problem was resolved.
12_1_16 - Figure 3x - Symantec - Ranorex.JPG (116.13 KiB) Viewed 899 times
12_1_16 - Figure 2 - Symantec - Ranorex.JPG
Detailed version of the Symantec popup that blocked our ability to run a script from within Ranorex Studio
12_1_16 - Figure 2 - Symantec - Ranorex.JPG (47.23 KiB) Viewed 899 times
12_1_16 - Figure 1 - Symantec - Ranorex.JPG
Before excluding SONAR.Heuristick.155 , this is the error that would appear when attempting to run a script from within Ranorex Studio
12_1_16 - Figure 1 - Symantec - Ranorex.JPG (27.08 KiB) Viewed 899 times

krstcs
Ranorex Guru
Posts: 2683
Joined: Tue Feb 07, 2012 4:14 pm
Location: Austin, Texas, USA

Re: Ranorex Studio RUN - Symantec Conflict SONAR.Heuristick.155

Post by krstcs » Thu Dec 01, 2016 5:45 pm

As is noted in several other threads and in the User Guide, Ranorex does not support running tests with anti-virus or other security software running. Turn off AV/security software while running tests. Ranorex does things that some AV systems see as threats, as you found.
Shortcuts usually aren't...

RanoTester
Posts: 18
Joined: Mon Jan 14, 2013 7:16 pm

Re: Ranorex Studio RUN - Symantec Conflict SONAR.Heuristick.155

Post by RanoTester » Thu Dec 01, 2016 6:34 pm

Thanks for the quick reply. We were not aware of potentially needing to disable anti-virus software when running Ranorex scripts. :)