Norton 360

[cystatinC]

i got infected with a Trojan Virtumonde which norton 360 v2 didn't detect it about 2 weeks ago !!.becose norton 360 doesn't have the option to quarantine and send suspected malware directly to symantec so i sent it to symantec submission site 2 times the infected malware...and each time symantec reply me with same message a 4 days later that the file is clean and not infected..but when i checked it at virustotal..the file is defiantly a proven Malware:18/33 (54.55%)

 http://www.virustotal.com/analisis/8b271ad7f142b99f88509344ccca293b

 and here's a quot from symantec reply:

 Symantec Security Response Automation: Tracking #9665065‏

We have analyzed your submission. The following is a report of our
findings for each file you have submitted:
filename: Spyware.exe
machine: Machine
result: See the developer notes

Developer notes:
Spyware.exe Our automation was unable to identify any malicious content in this submission.
The file will be stored for further human analysis
Our automation was unable to identify any malicious content in this submission.
The file will be stored for further human analysis

so after being more than 10 days infected i decided to uninstall Norton360 v2 and install other vendor to clean/disinfect the Trojan. which saved my PC  in this point !!..

So the reason why I’m posting that back. is ..I’m trying to give feedback in this issue. for to improve analyzing for future

hope to hear commints about it...

thanx

[cystatinC]

i'm sorry .i supposed to post it in the 360 section

[cystatinC]

here's another example i sent it 2 days ago a backdoor!!!....i lost my trust with symantec security analysis

www.virustotal.com/analisis/3c6685363fef8e81beec05a6c2d600f2Tracking #9710371

We have analyzed your submission. The following is a report of our
findings for each file you have submitted:

filename: info.exe
machine: Machine
result: See the developer notes

Developer notes:
 info.exe Our automation was unable to identify any malicious content in this submission.
 The file will be stored for further human analysis

[Grumpster Regular Contributor]

As a matter of fact I had the Virtumonde adware on my machine while running N360 v2 . It was not found by N 360, not even on full system scans . Since I make automated back ups with Ghost I went back 3 days and got rid of it that way.  Spybot found it tho but could not get rid of it quick enough to my taste. The story  with N360 v2 continues

[cystatinC]

i hope Tony Weiss will comment on this thread also

[cystatinC]

so, shall i continue posting examples of undetected malwares?.i received new another 2  different submitted malwares that symantec saying are clean...where other vendors approved that the files are 100% infected 

 i should better get over ..and let symantec be as it is ...

[huwyngr Norton Fighter]

Could you confirm the dates and anything else of reference of the reports back from Symantec on those two incidents.

I've never had to report stuff not detected so I don't know how that works with the Symantec system but does it select the specific file to submit or do you?

I'm not querying your veracity but just interested in how it works. I see Grumpster has had a similar problem.

I've flagged this thread for a Norton Staffer and will watch how it develops but I'm a volunteer here and can't do more than that unless I have experience to share which I don't.

[Tony_Weiss Administrator]

I apologize for any delay; I have contacted the security response team to look into this issue further. From the Symantec site, the following information is available regarding VirtuMonde, which Symantec identifies as Adware:

http://www.symantec.com/security_response/writeup.jsp?docid=2003-120914-4108-99

This thread also looks very similar to the following thread:

http://community.norton.com/norton/board/message?board.id=nis_feedback&message.id=2736#M2736

Is your product up-to-date? What version of Norton 360 v2 are you running? Thank you for your patience while we address the problem.

[cystatinC]

thank u Tony&huwyngr  for reply..

norton 360 v2 is up to date and vrrus signature always updated and product version (2.3.0.9)...norton didn't includ the threats even to the comminuty watch submitted catagory..

here is another

Below is a status update on your virus submission:  

[CLOSING]: Symantec Security Response Automation: Tracking #9711043

Date: June 23, 2008

We have analyzed your submission. The following is a report of our
findings for each file you have submitted:

filename: WUPH.exe
machine: Machine
result: See the developer notes

 WUPH.exe Our automation was unable to identify any malicious content in this submission.
 The file will be stored for further human analysis This file is contained by Desktop.rar

[4runner]

Ok lets analyize what's going on here:

---

cystatinC wrote:

i got infected with a Trojan Virtumonde which norton 360 v2 didn't detect it about 2 weeks ago !!.becose norton 360 doesn't have the option to quarantine and send suspected malware directly to symantec so i sent it to symantec submission site 2 times the infected malware...and each time symantec reply me with same message a 4 days later that the file is clean and not infected..but when i checked it at virustotal..the file is defiantly a proven Malware:18/33 (54.55%)

---

so you send the file to virustotal and out of 33 scanners running at that site only half (roughly) thought the file was malware.  So this could be a new varient of something.....   but we don't know if this one file submitted was really the right file, or if it was part of several originally...

---

cystatinC wrote:

filename: Spyware.exe

---

but i guess submitting the file with whatever name it had was out not possible, which may have been part of the problem with detection of a known threat.  I doubt the filename was spyware.exe when you got infected... after all how obvious is that?   

but wait.... we don't even know what file you actually submitted to get this result...  after all the name appear to have been changed along the way...    but whatever was sent in

---

cystatinC wrote:

The file will be stored for further human analysis

---

will get analized by more than a machine.

---

now lets move to your next post:

---

cystatinC wrote:

here's another example i sent it 2 days ago a backdoor!!!....i lost my trust with symantec security analysis

---

wow.....  you got infected by a second so soon?   Or do you just keep various files around to submit to places to see what happens?

---

 

---

cystatinC wrote:

so, shall i continue posting examples of undetected malwares?.i received new another 2  different submitted malwares that symantec saying are clean...where other vendors approved that the files are 100% infected 

 i should better get over ..and let symantec be as it is ...

---

wow..... how many do you have?   do you just collect these to submit?   

I really find it hard to believe you are constantly getting infected... submitting files...  and then coming here to post about it to:

---

cystatinC wrote:

So the reason why I’m posting that back. is ..I’m trying to give feedback in this issue. for to improve analyzing for future

---

Message Edited by 4runner on 06-25-2008 10:09 AM