topic Re: sample submission s.mh2 in Norton Internet Security / Norton AntiVirus

sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 22:36:00 GMT

uh oh. I was running a full system scan and I checked my logs after it finished and found these 4 logs

[Edit: Cropped images and resized to fix formatting]

Message Edited by Tim_Lopez on 04-20-2009 03:36 PM

Re: sample submission s.mh2

delphinium — Sun, 19 Apr 2009 20:44:11 GMT

Norton sends things that might look a bit suspicious back home to Symantec for a look. I had submissions for Graybird. If anything is a problem, in the "I think this is bad," it will be blocked or deleted. In this case, it's more like curiosity.

Do not look for it, you won't find it. It is more a case of Norton asking if certain files might be like s.mh2.

Re: sample submission s.mh2

GreatNate1312 — Sun, 19 Apr 2009 20:49:48 GMT

After reading the logs more quickly I seethere are statistical and sample submissions of the file? The file is coming from some photo application? I was on photobucket today, could I have gotten a virus from there? Im so safe on the web though. should I run a scan with malware bytes?

Re: sample submission s.mh2

delphinium — Sun, 19 Apr 2009 21:09:50 GMT

Update Malwarebytes and go for it.

Re: sample submission s.mh2

GreatNate1312 — Sun, 19 Apr 2009 21:17:21 GMT

If nothing comes up then what should I do?

Re: sample submission s.mh2

dbrisendine — Sun, 19 Apr 2009 21:21:36 GMT

Relax. As stated before, the logs were just sending this to Symantec as in "look here, here is something similiar so you can fine tune the definitions / routines".

Re: sample submission s.mh2

delphinium — Sun, 19 Apr 2009 21:24:47 GMT

As per Dbrisendine, if nothing comes up nothing was there. You are supposed to run Malwarebytes to make you feel better, not worse because you didn't find anything.

Re: sample submission s.mh2

GreatNate1312 — Sun, 19 Apr 2009 21:25:03 GMT

UPDATE

I went into MY COMPUTER and was actually able to find the exact file. I scanned it with malwarebytes and no malware was detected. I looked at the date it was modified and it was 3/13/2008 wich probably means it shipped with the operating system, right?

Re: sample submission s.mh2

GreatNate1312 — Sun, 19 Apr 2009 22:06:23 GMT

because I got this computer in december of 2008, an the file was modified before then, that means it probably shipped with the OS right?

Re: sample submission s.mh2

delphinium — Sun, 19 Apr 2009 22:14:15 GMT

I don't see how any of us would know whether it came with your OS or not. If it scans as not malware, I don't see a problem.

If you are still concerned, go here:http://www.symantec.com/security_response/writeup.jsp?docid=2009-041623-2617-99&tabid=3

and follow the directions on the website. Let us know how it goes.

Re: sample submission s.mh2

GreatNate1312 — Sun, 19 Apr 2009 22:18:55 GMT

Ill wait until later to see what nortons responce is. If norton finds it as a threat they will remove it, right? If they find i as not a threat what will they do then? Iv had this happen to me before except with a submission of suspicious.vundo. I was told on here it was a false posotive, and the submission logs just dissapeared from my history. Is that what will happen here if thats the case?

Re: sample submission s.mh2

delphinium — Sun, 19 Apr 2009 22:22:11 GMT

Same thing will happen. As I said, if Norton was convinced it was a problem, it would have taken immediate action. It doesn't leave something dangerous in your machine while it checks it out, it removes it. It is checking something, like you check the oil in your car to see if it is of interest.

Re: sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 12:41:29 GMT

How long wil it take? Its still processing

Re: sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 13:22:45 GMT

now im getting worried because 3 of those submission logs just dissapeared and the one log that is still left says PENDING- This item could not be submitted to symantec at this time, another attempt will be made shortly. whats going on here? Anyone please feel free to anwser, thanks

Re: sample submission s.mh2

delphinium — Mon, 20 Apr 2009 15:46:03 GMT

It will be submitted when it gets access. You are not the only one in the world submitting samples you know.

Re: sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 15:50:03 GMT

I just wonder why 3 got submitted?

ps- thanks for all your help

Re: sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 16:47:05 GMT

I wonder if anyone els is getting the same message as me?

Re: sample submission s.mh2

delphinium — Mon, 20 Apr 2009 20:48:51 GMT

Keep in mind that this is an idle time task. If there is no idle time or if it gets interrupted, it will not be submitted. You might be doing it to yourself.

Re: sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 20:55:20 GMT

maybe I turned off the computer then? But why would 3 dissapear?

Re: sample submission s.mh2

GreatNate1312 — Mon, 20 Apr 2009 21:25:43 GMT

gosh its still pending, even after I left my computer alone for a god 30 min