topic Re: Download Insight Not always checking... in Norton Internet Security / Norton AntiVirus

Download Insight Not always checking...

jarrycanada — Mon, 30 Aug 2010 20:00:59 GMT

TinFoil hat time, I noticed if I download Firefox from firefox's main site. http://www.mozilla.com/ NIS 2010 isn't poping up with a Green firechecked by norton download insight. are some domains not check? or if I've already downloaded a file does it just assume that it's safe and not alert me? I tried this with ie8 and it did the same thing. but if I download a file from another site not the same file it works, strange,

tested on three computers all running NIS 2010, 177012, window xp, windows 7

Re: Download Insight Not always checking...

AllenM — Tue, 31 Aug 2010 02:37:36 GMT

HI jarrycanada,

Nothing should be excluded from NIS giving you a safe or unsafe warning at the end of the download. None that I've ever heard of anyway.

I just tested this and I see the same behavior as you describe, including on my laptop which has never had Firefox downloaded at all.

Yet as you said when I test something else like Acrobat Reader, I get the message from NIS at the end.

I will flag this thread for to request Symantec to take a look.

Best wishes and thanks for reporting this.

Allen

Re: Download Insight Not always checking...

g_cafe_c — Tue, 31 Aug 2010 02:23:28 GMT

This same lack of download safety-notice occurred with me a couple of times last week. I then found another downloadable file worth taking and watched very intently at the lower rightside corner above the task bar near and after the end of the download; I did see the download safety notice this time.

By some chance, did you not watch too carefully for this Norton download safety notice? It shows up only for a few seconds, maybe 4 or 5, and disappears. (Other users should recheck that, since I do not quantitatively measure how long this notice stays displayed).

Here, done with Windows XP s.p. 3, Internet Explorer 8.

Re: Download Insight Not always checking...

AllenM — Tue, 31 Aug 2010 02:36:52 GMT

HI g_cafe_c,

I'm not sure about jarrycanada but I did watch mine very carefully. In fact I did not take my eyes off of it. :smileywink:

I counted about 25 seconds that the message displayed but I don't know if this is consistent since I don't typically measure the time.

Allen

Re: Download Insight Not always checking...

Bombastus — Tue, 31 Aug 2010 06:31:24 GMT

I have noticed this with 2010, too. It seems to be competely fixed in 2011.

Re: Download Insight Not always checking...

reactivate — Tue, 31 Aug 2010 07:57:01 GMT

I have also noticed this problem. Also is it only supposed to work with .EXE files. What about .DLL files?

Re: Download Insight Not always checking...

Thalir — Tue, 31 Aug 2010 09:45:54 GMT

I find few fixes for Download intelligence wrt to Firefox download went in to NIS 2011 and as Bombastus mentioned I find this issue fixed in NIS 2011. Please wait for few weeks untill the latest NIS is released officially and available as free upgrade to NIS 2010, to get this fix. Do let us know if your issue is still not fixed.

reactivate wrote:
I have also noticed this problem. Also is it only supposed to work with .EXE files. What about .DLL files?

Download intelligence in NIS 2011 is suppose to work for all PE files (i.e) - Filename extension .cpl, .exe, .dll, .ocx, .sys, .scr, .drv, .tlb

Re: Download Insight Not always checking...

MellonCollie — Tue, 31 Aug 2010 11:40:57 GMT

I don't get a pop-up when downloading Firefox with NAV2011 and IE8. Same for downloading WinRAR from rarlabs.com, and Opera from opera.com, but downloading Prevx from prevx.com does prompt a pop-up.

Re: Download Insight Not always checking...

Bombastus — Tue, 31 Aug 2010 12:27:52 GMT

Seems like there are indeed quite a number of .exe:s that aren't analyzed. I downloaded the World of Warcraft installer .exe just now, and no check there either.

And this is with NIS 2011, where I thought Download Insight issues were fixed.

Re: Download Insight Not always checking...

bjm_ — Tue, 31 Aug 2010 15:15:42 GMT

I have also noticed this seemingly random anomaly for some time with NIS 2010.

History > Download Insight does not record the anomaly download.

Work around (for me) has been to manual scan saved file > Network & File Insight.

File Insight always pops File Insight Details.

DI Notification: On

DI Full Reports: Always

Re: Download Insight Not always checking...

jarrycanada — Tue, 31 Aug 2010 17:28:34 GMT

I noticed it this weekend because my new notebook was not flaging any of the files I was downloading. seems like it does it the most with firefox and some sites more likely then others. happens with Windows xp pro and windows 7 home pro 64bit.

also should point out it doesn't record them in the event log ether. but it does do a IPS detection statistical submission on the file.

Re: Download Insight Not always checking...

AllenM — Wed, 01 Sep 2010 03:05:52 GMT

Hi jarrycanada,

Symantec has seen the problem and is looking into it. I'll be sure to update this thread once I hear anything back.

Best wishes.

Allen

Re: Download Insight Not always checking...

begemot — Sat, 04 Sep 2010 19:15:36 GMT

This is an EXTREMELY serious bug (present in NIS2011) - it means Sonar, which relies on Download Insight information, cannot function correctly, and you can potentially be infected by malware as a result - here is a direct example:

http://community.norton.com/t5/Norton-Internet-Security-Norton/Serious-issue-with-SONAR-NIS2011/m-p/283106#M124988

Re: Download Insight Not always checking...

AllenM — Sat, 04 Sep 2010 19:44:14 GMT

Hi begemot,

Download Insight is not the same thing as Sonar. In other words even if Download Insight does not give you a safe/unsafe rating on a file you just downloaded, does not in any way mean that Sonar would not be able to protect you when you try to run that file.

Symantec is aware of this problem and is looking into it.

Here are a couple of Protection Blogs with more information.

http://community.norton.com/t5/Norton-Protection-Blog/What-s-new-in-Norton-Internet-Security-2011/ba-p/222807

http://community.norton.com/t5/Norton-Protection-Blog/SONAR-3-A-new-level-of-behavioral-security-in-Norton-2011/ba-p/224116

Another post of interest:

http://community.norton.com/t5/Norton-Internet-Security-Norton/Does-Symantec-analyze-files-categorized-as-WS-Reputat-ion-1-in/m-p/274266

Best wishes.

Allen

Re: Download Insight Not always checking...

eplose — Sat, 04 Sep 2010 20:01:57 GMT

Hey Allen,

I've tested Norton against quite a lot files, and seen that shutting Insight has some devastating effects on Sonar. In other words, Sonar won't really work. See the attached:

http://www.wilderssecurity.com/showpost.php?p=1741745&postcount=203

By shutting Insight, I managed to infect the machine badly, with no option of recovering windows...

Re: Download Insight Not always checking...

AllenM — Sat, 04 Sep 2010 20:11:46 GMT

HI eplose,

Download Insight and Sonar along with all the other methods used by NIS all work together to give us the "full" protection package, no denying that.

What I am cautioning against is drawing the conclusion that just because Download Insight does not give you the rating at the end of the download that it means you will automatically get infected if the file is malicious.

This is not the case. People do get infected all the time either because they give "permission" for some file to run, visit risky websites or because a particular piece of malware has found a way to bypass your security software. This happens with any security software out there.

In the end all I am saying is that this problem with Download Insight does not in itself mean you will get infected.

Yes this is a problem and one in which Symantec is working on and will hopefully have a resolution soon but I don't think it is one which is "devastating".

My two cents worth.

Best wishes.

Allen

Re: Download Insight Not always checking...

TomiRed — Sat, 04 Sep 2010 20:46:21 GMT

mistake...

Re: Download Insight Not always checking...

reactivate — Sun, 05 Sep 2010 09:01:33 GMT

Thalir wrote:
I find few fixes for Download intelligence wrt to Firefox download went in to NIS 2011 and as Bombastus mentioned I find this issue fixed in NIS 2011. Please wait for few weeks untill the latest NIS is released officially and available as free upgrade to NIS 2010, to get this fix. Do let us know if your issue is still not fixed.

reactivate wrote:
I have also noticed this problem. Also is it only supposed to work with .EXE files. What about .DLL files?
Download intelligence in NIS 2011 is suppose to work for all PE files (i.e) - Filename extension .cpl, .exe, .dll, .ocx, .sys, .scr, .drv, .tlb

Well I can most definitely say it is not working properly then Thalir.

Re: Download Insight Not always checking...

AllenM — Sun, 05 Sep 2010 17:14:53 GMT

Hi Reactivate,

Thalir posted the reply before this problem had been recognized and reproduced. Subsequent to that Symantec was able to reproduce this problem and are still working on it.

Best wishes.

Allen

Re: Download Insight Not always checking...

jeffw — Thu, 09 Sep 2010 23:22:54 GMT

Thanks everyone for bringing this to our attention. We have identified a fix and it is currently undergoing testing. Once testing is complete, the fix will be deployed via LiveUpdate later tonight or sometime tomorrow. I will put up another post to let everyone know when the fix is available.