03-28-2010 03:23 PM
I want to download an executable that apparently no one else uses, so NIS 2010 keeps killing it wihtout even giving me the option of saving it. After downloading for an hour or two (it is a large file), it just deletes the file.
I thought I disabled Download Insight in the Web Settings under "Download Intelligence" but it still deletes the file. How can I make it allow me to download this?
03-28-2010 03:52 PM
What exactly is the History Log showing for the deletion? Download Intelligence should not be deleting the file unless there is a known High Risk found in the file itself. But that would mean the message would have an error in it and Auto Protect actually deleted the file (or placed it in Quarantine). If you check the History logs under Resolved Security Risks, the details for the deletion should be found there. You may also find the file in the Quarantine area as I have not seen a file deleted entirely but placed in Quarantine first.
03-28-2010 04:32 PM
The History File says "Crossfire181.exe (Trojan Horse), Auto-Protect blocked this Virus, Then it says very few users, fewer then 1o users in the Norton Community have used this file. High Risk.
This is a game mod and I have used previous versions that I downloaded from the same site, so I believe it is OK. But I cannot be certain. Is NIS saying that it analyzed the file and found a trojan horse, or is it suspicious because there are so few users?
03-28-2010 05:58 PM
Norton is saying that it found a Trojan Horse virus in the downloaded file. Download Insight did not delete the file; Auto Protect deleted it. Auto Protect scans every file that is accessed on your system UNLESS it is a Trusted file. Auto Protect came into play the moment the download was complete and the file was made an exe type file by the download manager (your web broswer's download 'helper'). The High Risk is from the Auto Protect scanning and it means there was a positive match to the Trojan Horse signature. The High Risk rating is also why the file was deleted and not Quarantined; Norton will not allow a user the possibility to restore a positive High Risk to their system.
IF YOU ARE ABSOLUTELY POSITIVE THAT THIS FILE IS SAFE then you could start the download again and disable Auto Protect and File Scanning temporarily just towards the end of the download. Then you can add the file manually to Norton's Quarantine and send the file to Symantec (from Quarantine) to have the file checked for the Trojan Horse. You could also submit the file to an online scanning service (like www.virustotal.com) before you Quarantine it to see if other AV find the same virus. If all the scans come back negative, you can then restore the file from Quarantine (you are able to do this since you manually added the file instaed of Norton deleting the file) and use it.
03-28-2010 08:35 PM
Excellent. I will download it again tomorrow and use your method to have it checked by Symantec. I cannot swear the file is clean, it was generated at a game mod site.