Reply
Rootkit Eradicator
Posts: 5,220
Registered: ‎05-30-2008

Re: Downloader Trojan virus

Remember you should only use one Security Software Product at a time as there could be clashes so, when you do Upgarde to N.I.S. 2008, or the Latest N.I.S., I would un-install that Adware Software before installing N.I.S. 2008/the Latest Version of N.I.S..

 

The problem here seems to be that N.I.S. 2005 cannot Remove that Downloader because it [N.I.S. 2005] is not advanced enough; N.I.S. 2008 should have been able to Remove it, I am very sure.

 

Upgrade as soon as possible!

Tuesday, May 21, 2013: The Symantec THREATCON was Changed to Level 1: Normal | Tuesday, May 14, 2013: Microsoft "Patch Tuesday" | Sunday, May 05, 2013: Microsoft Internet Explorer 8 Zero-Day Vulnerability (Update Released)
Symantec Employee
davecole
Posts: 50
Registered: ‎04-07-2008

Re: Downloader Trojan virus

gang, just a little more insight on this one. when you consider older security products (at least those from us), there are often many, many changes that have taken place "under the hood" that you'll never be able to really see but nonetheless are essential for protecting you against the latest threats. a great example of this is the antirootkit engine we added a couple years back. it was a lot of work for us and very effective, but not very visble inside the product.

 

if you're using a product that's a few years old, it's a good time to think about grabbing the latest version of the product which has more up-to-date protection technologies. while we provide every new protection engine/feature as far back in product versions as we can, there's some new engines and capabilities which just can't be supported by the old products due to a variety issues, such as technical architecture changes across versions.

 

btw, if you're dealing with a suspected infection, pls follow the steps posted here.

 

 --dave

 

Super Contributor
mcullet
Posts: 149
Registered: ‎06-26-2008

Re: Downloader Trojan virus

[ Edited ]

Hi Dave,

 

Excellent points.

 

Program features have changed dramatically and so too have the way programs are designed, written, debugged and maintained. 

 

I bet most readers intepretted the last sentence purely in terms of security solutions developed by Symantec and others.

 

IT advances apply to those who write "good code" and those who write "bad programs".  Welcome to electronic warfare stage 1. 

 

You are perfectly correct - old AV (security) programs won't cut it.  But the problem you identified goes further.  Unwary users may be lulled into a false sense of security and engage in high risk behaviour that they would not otherwise do if they had no security  (protection) at all. Nothing makes you feel all safe and secure as the little AV protection icon in the taskbar <g>

 

Anti Bot is being promoted as a separate security solution.  With respect, it seems to be a risky strategy to carve this off as a separate product rather than incorporate it into NIS.  Perhaps it might generate added revenue (maybe) but only if enough consumers understand the nature of the threat it is designed to address - big leap of faith here.

 

More likely, it will give the completely wrong impression that IT security can be purchased like health insurance: "No, I won't need to worry about ovarian cancer because I'm a guy."  Fragmenting solutions like this risks creating a sense of false security.  We end up with infected (affected) users who are unaware of their true compromised state... yet feel all warm and safe because they have NIS (insert other solution).

 

Worse case: lots of Symantec customers might get 'infected' thinking they were safe and then blame Symantec.  On this forum it is not uncommon for users (with little or no IT skill) to blame Symantec for apparent product failure.  This strategy may harm the company and confuse the market.

 

There is a new batch of products getting ready for release - 2009.  Every company in the market will try to make their products stand out among the crowd.  Some will stand out for all the worst reasons.  IMHO - it makes good commercial (and practical) sense to incorporate AntiBot into the next iteration of NIS ... after all, the product is called Norton Internet Security as opposed to Norton Incomplete Security.

 

I respect the hard work that Symantec folk put into bringing products to market.  My comments are not criticisms but concerns.

 

Just a thought ...

Message Edited by mcullet on 07-15-2008 07:50 AM
Mike

XP PRO SP 3
XP PRO SP 2
Vista SP 1
Symantec Employee
davecole
Posts: 50
Registered: ‎04-07-2008

Re: Downloader Trojan virus

hello again mike, you make some good points. one of the reasons antibot was a separate product is that it uses a broad set of heuristics/behavior-blocking that result in higher false positive rates. across a small customer base of tech savvy people or when you're dealing with an active infection, this is fine. nonetheless, when you take the same approach across millions of customers, it may cause real problems.

 

i don't want to give away too much of 2009 yet, but suffice to say we will be adding the antibot features that are ready for more general release to NAV and NIS customers. 

 

--dave

Visitor
VeryBusyMom
Posts: 6
Registered: ‎07-12-2008

Re: Downloader Trojan virus

Just one quick question.......I am going to download the latest version of NIS 2008.  Will the download uninstall my my 2005 version, or do I need to uninstall it first before downloading?

 

Thanks!

huwyngr
Posts: 18,992
Topics: 906
Kudos: 2,331
Solutions: 337
Registered: ‎04-13-2008

Re: Downloader Trojan virus


VeryBusyMom wrote:

Just one quick question.......I am going to download the latest version of NIS 2008.  Will the download uninstall my my 2005 version, or do I need to uninstall it first before downloading?

 

Thanks!


 

Jumping in -- the download itself will not uninstall the earlier version but the act of installing will.

 

However I personally recommend and do when getting an application by download from the internet always use the SAVE option rather than the RUN and I note carefully where it downloads to. Often the default is the desktop for convenience of finding it later (but yuo haven't seen my desktop on the computer or outside it <g>) so I have a folder named Internet Downloads and Windows usually defaults to that once you use it (VISTA has its own called Downloads I think but I still make mine).

 

That way I know where to look, I can right mouse click on it and get Norton to check it for security and by clicking on the Last Modified Date column I can arrange them in Date order, last at the top and find the most recent.

 

It's worth doing this so that if you have to reinstall you have the file on your hard disk.

 

FWIW



Hugh
Rootkit Eradicator
Posts: 5,220
Registered: ‎05-30-2008

Re: Downloader Trojan virus

[ Edited ]

It is fine to just Run the Installer for the Latest Version if you have an Older Version of a Norton Product.  If you want, you can Run the Norton Removal Tool first and then Install your Latest-Version Product; just type "Norton Removal Tool" in to the Search Box at the top-right-hand-corner of this Web Page and Select the "Download and Run the Norton Removal Tool".

Message Edited by Floating_Red on 07-14-2008 06:09 PM
Tuesday, May 21, 2013: The Symantec THREATCON was Changed to Level 1: Normal | Tuesday, May 14, 2013: Microsoft "Patch Tuesday" | Sunday, May 05, 2013: Microsoft Internet Explorer 8 Zero-Day Vulnerability (Update Released)
Stu Rootkit Eradicator
Rootkit Eradicator
Stu
Posts: 5,210
Registered: ‎04-08-2008

Re: Downloader Trojan virus


Floating_Red wrote:

It is fine to just Run the Installer for the Latest Version if you have an Older Version of a Norton Product.  If you want, you can Run the Norton Removal Tool first and then Install your Latest-Version Product; just type "Norton Removal Tool" in to the Search Box at the top-right-hand-corner of this Web Page and Select the "Download and Run the Norton Removal Tool".

Message Edited by Floating_Red on 07-14-2008 06:09 PM

This is highly recommended by the way.

You can find it here.

Norton Removal Tool

"All that we are is the result of what we have thought"
Super Contributor
mcullet
Posts: 149
Registered: ‎06-26-2008

Re: Downloader Trojan virus


davecole wrote:

 

i don't want to give away too much of 2009 yet, but suffice to say we will be adding the antibot features that are ready for more general release to NAV and NIS customers. 

 

--dave


Hi Dave,

 

Thanks for this - very interesting.  I can see where you're pointing ... concept testing while balancing on a tightrope over a sea of molten lava.  No pressure.

 

Out of pure curiosity ... has Symantec noticed any reduction in product support costs because of the forum?   This forum has an excellent user support base. It's difficult to tell if anything we (forum users) do helps or hinders ... too close to the ground. 

 

I've seen a number of commercial product forums and this one (Symantec's) is streets ahead of others in terms of activity, quality of assistance and speed of problem resolution.  The operation and 'culture' of the forum really is a credit to you guys (symantec staffers).  Great work...

______________________

 

If the development door has not totally shut on 2009, there are a few things I'd dearly like to see.

 

ZAPRO (Zonealarm) produced quite good firewall products initially.  That has changed for the worse.  I really liked having easy control over the firewall.  Others thought differently - any pop up was a bother.  I know NIS has quite fine firewall control ... however, it is not exactly easy to use. 

 

I'd like to be advised that "program X is attempting to access the internet - destination IP xxx.xxx.xxx.xxx".  It would be handy to be asked if I want to allow it and better if I could do an on the fly whois search of the IP.  (Incomming triggers?  Not really an issue unless we are talking port probes.)

 

This ability helped me pick up malware early.  Not all nasties trigger NIS.  Perhaps they are better defined as nuisances.  They don't fit into a malware category per se yet chew up resources for no useful purpose (eg logitech program updaters) and often cause code conflict with legitimate products (eg creative labs drivers and 'phone home' modules).

 

I'd really like to have an RSS news panel on the main program.   This way users could elect to see relevant Symantec news / alerts / warnings ... and with a little creative thinking, Symantec could gather real time polling info ... powerful for all parties.  The recent mis-step with the update from 15.0 to 15.5 would have been totally avoided ... "news flash: click here to get this big update because ..."

 

Thinking laterally, why not have push promotions via the panel's RSS feed?   Symantec is in business to make money - perfectly legitimate.  The main website is very good ... but you have to make the effort to go there to see any promotions.  Many users either auto-update or buy off the shelf (no thought required).  Push promotion is an application of the law of large numbers to an established client base - nearly zero costs to operate.

 

It would be nice to have a bug report button that produced a standardised system report as well as the user's feedback.  I suspect FF 3 (and / or various add-ons) is responsible for a lot of problems being attributed to NIS ... a bug report button could enable data collation (for statistical analysis etc) which, in turn, could give Symantec a good idea about client systems in real time (snapshot) and over time (trend / hypothesis testing and other useful analytical operations).  A minor adjustment ... link the button to the forum perhaps? 

 

Sigh ... yes, yes I am so looking forward to the next version. 

 

Whoops ... gotta wipe the drool away. <g>

 

(Hey I do have a life ... :)

 

 

Mike

XP PRO SP 3
XP PRO SP 2
Vista SP 1
huwyngr
Posts: 18,992
Topics: 906
Kudos: 2,331
Solutions: 337
Registered: ‎04-13-2008

Re: Downloader Trojan virus


Stu wrote:

 

This is highly recommended by the way.

You can find it here.

Norton Removal Tool


If you mean that use of the Norton Removal Tool is highly recommended I don't believe that is the case by Norton Staff -- I've seen many posts that the NRT is intended for use if normal removal -- Uninstall in the Norton menu or Remove Programs in Windows -- fails.

 

The big danger is that people will start it without realizing that it removes all Norton programs you may have installed -- not just the one you want to get rid of.



Hugh