topic Re: Let the user decide whether or not to quarantine a file in Product Suggestions

Let the user decide whether or not to quarantine a file

n2009user27 — Sat, 09 Oct 2010 14:26:32 GMT

IN NIS 2011, when File Insight detects an apparently risky file (e.g. a downloaded ".exe"), it immediately deletes the file and quarantines it, even if the user is happy to accept the file. It is very inconvenient having to then go to quarantine every time to restore it, especially if the user is confident that it is a safe file.

The same argument also applies to sofware developers, whose executable files they have developed appear to suffer the same fate without being consulted first.

Therefore, could you please give the user the option of whether or not to delete/quarantine such a file instead? All it needs is extra buttons on the File Insight notification screen (e.g. "Allow this file" or "Remove") with a suitable warning re the consequences of doing so. With the filename also displayed, the user can then decide whether or not to let the file through if he recognises it or get it quarantined if he does not.

By the way, it is not good enough just to ask the user to "Trust" the individual file each time, because chances are every time a file is downloaded it will have a different name, so the "trust" list could end up with a huge number of files (unnecessarily).

Please note - "Computer software exists as the servant of the user, not the other way round."

Thanks.

Re: Let the user decide whether or not to quarantine a file

mp3jo — Sun, 10 Oct 2010 11:44:36 GMT

Many users in german forum want this too.

The option of whether or not to delete/quarantine such a file is a very good idea.

Re: Let the user decide whether or not to quarantine a file

Basler — Sun, 10 Oct 2010 14:22:55 GMT

Hello together

In the German forum, we speak about it. Many of us want this option. Please let the user decide what they delete.

Sorry for my language.

Basler

Re: Let the user decide whether or not to quarantine a file

Niko233 — Mon, 11 Oct 2010 01:55:24 GMT

Does false positives appears so frequently?

Not so few cases then a malware sample is recognized as a Safe file (about the one in every 30 downloaded files)

> By the way, it is not good enough just to ask the user to "Trust" the individual file each time, because chances are every time a file is downloaded it will have a different name, so the "trust" list could end up with a huge number of files (unnecessarily).

a few piece of info:

Security data is binding with file checksum (for example you can see it in wikipedia as md5 ,sha-256 and other hash algorithms). checksum is changing if only file content was changed (filenames and extentions may be anything you want - it will not change the checksum).

(see video http://community.norton.com/t5/Norton-Protection-Blog/New-Feature-for-Norton-Internet-Security-2010-Download-Insight/ba-p/113827 )

Re: Let the user decide whether or not to quarantine a file

dallas_maverick — Mon, 11 Oct 2010 14:29:20 GMT

Hello Niko233,

Thank you for your feedback, now to give you more details about the problem :

It would be ok if Norton would show this Insight Message for all threats, but it is detecting some applications as false positive and it deletes (quarantines) them instantly, which causes some inconveniences to restore the file and then create a scan exclusion :

There is a switch between auto / manual for the low threats but not for the higher ones. Should it be changed for the future versions of Norton ?

Best regards,

John

Re: Let the user decide whether or not to quarantine a file

logi42 — Tue, 12 Oct 2010 21:47:48 GMT

Hello

I agree with this thread!

Manuel

Re: Let the user decide whether or not to quarantine a file

Dinole — Wed, 13 Oct 2010 14:10:59 GMT

i totally agree with the suggestion, that the user has to decide himself, to quarantine or not. Michael.

Re: Let the user decide whether or not to quarantine a file

syntax868 — Wed, 13 Oct 2010 17:39:03 GMT

Good Idea. Signed!

Re: Let the user decide whether or not to quarantine a file

specimen — Thu, 14 Oct 2010 16:12:57 GMT

I agree because I just face the problem that NIS not allow me to upgrade the software because of false alarm.

Re: Let the user decide whether or not to quarantine a file

MarkAtHome — Thu, 28 Oct 2010 13:02:47 GMT

More generally, NIS should not do anything to my system that I cannot easily undo.

Re: Let the user decide whether or not to quarantine a file

grtoro — Thu, 28 Oct 2010 13:09:23 GMT

I support the idea. Symantec: are you listening?

Re: Let the user decide whether or not to quarantine a file

xxJackxx — Thu, 28 Oct 2010 16:42:42 GMT

Do it. This is the main reason I am not using Norton at the monent.

Re: Let the user decide whether or not to quarantine a file

brb — Thu, 28 Oct 2010 16:52:35 GMT

+1 on this.

You could always make it a setting that is off by default so the actual behaviour remains unchanged and at the same time also cater to the more computer-savvy audience.

This would make an excellent addition and I'm sure you would get more support for that.

Re: Let the user decide whether or not to quarantine a file

Victek — Fri, 29 Oct 2010 00:13:14 GMT

Yes, I would like to see this option added as well. I've been nailed a few times by NIS auto-deleting files that I know are OK and have had to turn it OFF to get it out of the way temporarily.

Re: Let the user decide whether or not to quarantine a file

Mark_Kratzer — Fri, 29 Oct 2010 11:25:57 GMT

I vote yes.

Re: Let the user decide whether or not to quarantine a file

n2009user27 — Mon, 08 Nov 2010 17:21:06 GMT

My original post was about a month ago and its status is still "New Idea". When is it likely to be updated to (e.g.) "Under Consideration"?

Do Symantec consider all new Norton Product ideas or are some ignored without comment?

It would be nice to get some feedback from Symantec on this one, especially as it has gained so much support from other users.

Many thanks.

Re: Let the user decide whether or not to quarantine a file

MarkAtHome — Fri, 10 Dec 2010 15:54:52 GMT

Consider this signed. Until it is addressed, Sonar is turned off.

Re: Let the user decide whether or not to quarantine a file

Kryptik — Tue, 14 Dec 2010 01:13:07 GMT

I think it should scan the file then ask the user is it safe to store *.somefile name to " safe directory" where the file can be opened and tested ( ex... like win zip) to see if it is a reliable file and that there is no hackware or spyware in it. if there is a issue then ask user if they want to fix problem or bypass and continue install. when it is installed or ran not shal use a monitor of the program and make sure that it don't change any key settings in the o.s. (ex... like a self duplicator) and check to see were it "dials home" at and check to make sure that it is a reliable source (ex.. like a popup trojan or back dialer) Norton allready does this automaticly but doesn't let the user have any input... input would be nice!

Re: Let the user decide whether or not to quarantine a file

xxJackxx — Thu, 30 Dec 2010 19:19:00 GMT

No progress on this? I reinstalled NIS 2011 on my machines and am mostly happy with it. However, when I ran a full scan on my desktop machine it deleted 6 files I would rather it had not messed with. It would not let me restore 2 of them. It is my machine and they are my files. An internet security suite should be a tool, not something that takes over my computer.

Re: Let the user decide whether or not to quarantine a file

ScottBull — Mon, 03 Jan 2011 10:11:26 GMT

I've had this too, however in all but one case, the quarantine has been accurate.

The idea should be expanded, there should be 3 options; trust, quarantine, and remove, as there's always a possibility that the threat has an anti-quarantine counter-measure, or a 2nd threat comprimises your quarantine information.