Norton Internet Security / Norton AntiVirus

[ProTruckDriver Super Spam Squasher]

My scan Preformance Profiles setting is set to: FULL SCAN.

I did a FULL SCAN in regular mode and the results were : No Threats Found.

I then did a FULL SCAN in Safe Mode with the following results:

[AllenM Norton Fighter]

Hi ProTruckDriver,

There is another thread where something like this was recently reported. Please see this thread. There is nothing official in terms of a bug regarding this. All known isssues affecting customers are listed in the post below.

http://community.norton.com/t5/Norton-Internet-Security-Norton/Known-Issues-with-NIS-19-1/m-p/533014

I'm doing some testing on my test laptop as we speak and will update this thread when I have some results to share.

Best wishes.

Allen

[elsewhere]

Similar results here. I have 8 detections in Safe mode. All detections are located in MSI files with 6 of these MSI files being located in the Factory Image partition. Scan comparison example below:

In Safe Mode:

Unresolved Threats:
Risks in compressed file "15421.msi"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\windows\installer\15421.msi] - Not Attempted

In Normal mode:

Scan Statistics:
  Scan Time: 1 seconds
  Scan Targets: C:\Windows\Installer\15421.msi
  Counts:
   Total items scanned: 48
   - Files & Directories: 48
   - Registry Entries: 0
   - Processes & Start-up Items: 0
   - Network & Browser Items: 0
   - Other: 0
   - Trusted Files: 0
   - Skipped Files: 0

   Total security risks detected: 0
   Total items resolved: 0
   Total items that require attention: 0

Resolved Threats:
No risks have been resolved

Unresolved Threats:
No unresolved risks

[AllenM Norton Fighter]

I picked up 5 detections during a SAFE mode scan, all in compressed files. I believe all of them were MSI's - I saved a screenshot of them and will check later.

I'm still running other scans. the NBRT scan just completed as I started writing this reply with NO detections.

My next scan will be SAFE mode with networking to see if this makes any difference.

More to follow.

Allen

[michaell Symantec Employee]

Hello Everyone,

I can't look into this right now, but I can on Monday. Looks like there might be a problem, and I have a feeling scanning with networking on might make a deference. Please let us know AllenM if it does.

[AllenM Norton Fighter]

HI michaell,

The SAFE mode with networking appears to have made no difference.

SAFE mode both with and without networking detected 5 heuristic detections, all with MSI files. Now interestingly enough I just noticed that when viewing the details of those detections it actually only shows 3 detections depicted in the final screen. Five were shown as detected during the scan itself, all heuristic.

So to summarize: SAFE mode with and without networking indicated 5 detections, even though only 3 shown on the final screen. NBRT and NIS full scan under Normal mode showed NO detections.

Screenshot below.

Best wishes.

Allen

[Sym_KeN]

Hi ProTruckDriver,

I can say that this is not a bug. Safe Mode scan is most powerfull. In safe mode, only windows files will be loaded.

In normal mode, all files & services are loaded and if you are running a Full System scan there is a chance for getting some Heuristics to get skipped ( If the services are running ).

But in Safe mode, those services will not run and Norton will detect the same. 

[AllenM Norton Fighter]

---

Sym_KeN wrote:

Hi ProTruckDriver,

I can say that this is not a bug. Safe Mode scan is most powerfull. In safe mode, only windows files will be loaded.

In normal mode, all files & services are loaded and if you are running a Full System scan there is a chance for getting some Heuristics to get skipped ( If the services are running ).

But in Safe mode, those services will not run and Norton will detect the same. 

---

NBRT also does not find any problems with these same MSI files.

I also do not recall NIS 2011 reporting these issues during a Safe mode scan but I can test this again on my test laptop tomorrow if desired.

Best wishes.

Allen

[michaell Symantec Employee]

AllenM, could you do that? Would be interesting to see if there is a difference. I am still going to test it myself Monday to double check this.

[AllenM Norton Fighter]

---

michaell wrote:

AllenM, could you do that? Would be interesting to see if there is a difference. I am still going to test it myself Monday to double check this.

---

Hi michaell,

Sure, will do.

Thanks

Allen