Forum Feedback

[floplot Norton Fighter]

Hi

I know this post doesn't belong in this thread, but I didn't want to make a separate thread in the regular forum. I just noticed that 2 IPS Detection Statistical Submissions are now pending in the history part of my NAV 2009. I am only mentioning them in here because the offending url is coming from the Norton Community Forum in both cases. I didn't want to post something like that in the regular forum and alarm everyone who would read the thread.

floplot

[edit: Changed subject to reflect moved post.]

Message Edited by shannons on 11-08-2009 07:08 AM

[dbrisendine Norton Fighter]

That's OK.  IPS will send information on anything of interest to Symantec to examine.  It may not be the Forum or it's software for the Forum but some anomaly with the connection that IPS wanted checked.  If it's just a History submission (you got no Blocked or Attack warning messages) then there is nothing to worry about.

[floplot Norton Fighter]

Hi

I got 2 more of those IPS statistical submissions again tonight. Now they are processing. Again the offending url is this Forum. I think what is happening is that it is getting picked up when url's are posted in the Forum and it brings you to a site outside of the Forum. I'm curious if anyone else clicks on some of those links and the same thing is happening. I know this is just for statistical purposes. There must be something in the latest IPS update that is kicking this off. I don't think it's to any particular site, but just the fact that it is outside of the Forum.

[dbrisendine Norton Fighter]

You are correct on the URL listing in the posts kicking this off.  I checked the one you pictured earlier and that is what it seemed to be from.

[floplot Norton Fighter]

Hi dbrise

If they  don't come up with a revised IPS update about this, I guess it should be mentioned some where in the Forum that people should copy and paste the link posted in a thread to their browser directly rather than just clicking the link in the Forum.  I know there is a warning after you click on a link that takes you outside of the Forum, but maybe this warning should be posted some place before the person actually clicks on the link. I suppose we have to get used to doing this like we do with links in emails.

[Tony_Weiss Administrator]

Sorry, I'm a bit lost on this one. Do you have any screenshots of what you're seeing in your History? What are the URLs from the Norton Community listed in History? I'm sorry for the questions; we want to determine whether it's a NAV issue or a Forum issue, or no issue at all. Thanks!

[floplot Norton Fighter]

Hi Tony

http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=85567&page=2

I don't think I can actually take a ss of it since it is quite long and have to use the slider to get the whole thing in.

 Yes, that is the right link. On that page there is a link to DSLReports and I clicked on that link. Once I did that, it created a IPS Statistical Submission.. It started out being a pending one. In fact it happened 4 times over a 2 night period. There were 4 of them pending, but it looks like only this one was sent in to Norton Community Watch Feedback. The one that got sent in was on 11/10/2009 at approx. 1:40AM. I can't supply the other links since they were pending but have since disappeared. They were all caused by clicking on a link provided in a post to an outside site. Sorry, I can't remember what the other sites were. I might have clicked on the same site twice, but definitely not 4 times. I'm using IE 7 with xp pro. System Works 12 Standard with the NAV part updated to 16.7.2.11 version. I hope this helps to clarify things.

Message Edited by floplot on 11-11-2009 02:03 AM

[floplot Norton Fighter]

Hi Tony

Could the problem be that the links that I clicked on were possibly to other web sites that offer help with cleaning up malware? Since they were like competing sites with Symantec, could that have caused the IPS problem? I know definitely that the link for DSL reports was a helping site or maybe the fact that the links were to sites that mentioned or talked about various malware problems. I know I haven't seen anything like this before the latest IPS update. Thanks.

Please let me know when you find out any information about this? Am I the only one who has noticed this?

Message Edited by floplot on 11-11-2009 10:55 AM

[floplot Norton Fighter]

Hi Tony

I just got another pending one by clicking on the link in this thread. This one is still pending since it just happened.

http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=86053

[Tony_Weiss Administrator]

Where are you seeing this "pending" information? Within NIS? The Security History? Please be as detailed as possible about how you're receiving notification of these IPS Statistical Submissions. It could just be the compiling of information from IPS, but I'm not sure without further details. Thanks!