A friend of mine is on a Desktop Deployment project, and they have just started deploying SAV 10 throughout their network. Once they started this, his deployments stopped working. After researching the issue, he found that SAV 10 was detecting command line utilities, then actually going into the scripts and editing them out!
Here's the email from him:
I ran across an interesting issue today at a client site. They started rolling out SAV 10 this week (upgrading from SAV 9) and some of our desktop deployment automation scripts started failing on the new systems. Symantec 10 has added a new category of threat for “hacking tools” and is beginning to classify a lot of command line utilities as such and prevent them from running. The main one affected here is a command that controls desktop windows, and is also used by many hardware manufacturers as part of their install routines.
But my favorite part of the story is that SAV went a step further. It not only quarantines the file, it actually edits the batch file that called the command line tool in the first place, and deletes the line from the script. I confirmed this multiple times with different witnesses to make sure I wasn’t loosing my mind. Everyone who likes AV products editing your scripts and removing things they don’t like raise your hand.
Obviously in the corporate edition of the product, the administrators can configure these options, but it is important to be aware of the issue, and what the next steps may be this and similar products.
I haven't confirmed it, but will be posting it to the SMS mailing list for confirmation...