Norton Internet Security / Norton AntiVirus

[Keith5150]

Everything I try to install is being blocked by Norton AV. Sonar is popping up saying it identified suspicious activity and deletes the install program. This seems to happen just as the system pops up with the administrative privileges prompt.

Yesterday, I though it was targeted at  "Ancient Quest Of Saqqarah" but today I tried to install other, non-related programs and now they are being flagged and aborted before installation even begins.

I don't know whether it's Norton or one of the numerous patches that Microsoft just released on their massive "patch Tuesday ". Or maybe a combination of both.

 HrBertelsen seems to be having a similar problem. 

 NIS 2010 17.0.0.136 deletes programs i want to install during install

I'm running Windows Vista 64-bit. Norton AV 2010 v. 17.0.0136

-Keith5150

[PapauZ Norton Fighter]

How is it working if you disable Auto-Protect temporary? Can you run the installer files then?

[Keith5150]

Thanks for the reply.

I couldn't stand the way 2010 version was flagging things and quarantining them. I started getting paranoid, thinking "what file will it flag next" An application that I use a lot, or even worse, a critical system file.

So, I uninstalled 2010 and re-installed v.2009. Everything is working fine again. I'll continue checking the board and searching the web for answers. And hopefully, I will either find a solution or Norton will issue a fix before I'm forced to upgrade to 2010. Or my subscription expires and I go else where.

I've read messages about people disabling auto protection and others adding programs to the exclude list. But that seems to defeat the whole purpose of having AV software. If I can't trust the program, and I disable or add exclusions then what happens if I ignore it and get infected.

The software needs to identify potential threats but it also needs to provide more information about the aleged threat.And then give me the choice to make an informed decision of whether to ignore or quarantine. Currently, on my system, it's claiming to detect something "suspicious" and then quarantining the file.

again thanks,

Keith5150

[mijcar]

---

Keith5150 wrote:

Thanks for the reply.

I couldn't stand the way 2010 version was flagging things and quarantining them. I started getting paranoid, thinking "what file will it flag next" An application that I use a lot, or even worse, a critical system file.

So, I uninstalled 2010 and re-installed v.2009. Everything is working fine again. I'll continue checking the board and searching the web for answers. And hopefully, I will either find a solution or Norton will issue a fix before I'm forced to upgrade to 2010. Or my subscription expires and I go else where.

I've read messages about people disabling auto protection and others adding programs to the exclude list. But that seems to defeat the whole purpose of having AV software. If I can't trust the program, and I disable or add exclusions then what happens if I ignore it and get infected.

The software needs to identify potential threats but it also needs to provide more information about the aleged threat.And then give me the choice to make an informed decision of whether to ignore or quarantine. Currently, on my system, it's claiming to detect something "suspicious" and then quarantining the file.

again thanks,

Keith5150

---

I find this very weird.  Both versions of Norton use the same signatures (to the best of my knowledge).  And I think the heuristic detection is the same.  Could your sensitivity settings be different from one to the other?  One of the main differences between the two products is the download insight that reports on the program's "reputation", but I don't see how that would come into play here.

Have you checked for malware?  Tried running a scan with a freebie like malwarebytes?  It occurs to me that malware hidden in your system might be trying to take advantage of the installation process by hiding itself somehow and getting installed along with the product you are installing.  But I would think either version of Norton would detect this.

[Jesper]

I'm having the same problems on a daily basis. The sonar protection in 2010 is detecting way more false positives compared to 2009  when installing programs and auto deletes the .exe without my approval.  I used 2009 since it launched and never had these problems. In fact that is why i liked the 2009 suite so much, lightweight and unintrusive, the Sonar was actually smart. Using the same programs I have always used, they never got flagged in 2009. I have settings for Sonar set to "automatic" and "auto delete detected items" set to off. Sonar still gives me messages saying it blocked a threat when I install/upgrade certain programs. These programs could be beta or regular updates or installers my personal friends made for poker mods for full tilt for example. Or even just regular programsthat are known to be safe!

I hope this will be fixed with an update soon. Whenever I have to install or upgrade programs, I always have  to disable AV and sonar to get them to install without a problem. Sometimes if I don't do this, it will delete the .exe, then I have to waste one of my download counts I paid for on certain sites because I have to redownload the file. This is a serious issue which should have been seen in release. Seeing is it is a huge aggressive change from 2009 flagging common safe programs as threats.

My system is clean completly of all malware, Scan daily with Norton and SAS. This is definatly on Symantecs side. The Hueristic detection changed in 2010 and is super aggressive now. Thanks!

Message Edited by Jesper on 10-19-2009 10:07 PM

[Keith5150]

OK, here's my current progress. My system must have finally updated to the latest definitions because like NAV 2010 is flagging "Ancient Quest Of Saqqarah" as being infected with "infostealer" I submitted it for testing and still believe it is a false positive. Since I re-downloaded and installed the file from a legitimate site.

The main difference is NAV 2009 isn't flagging other programs that I tried to install under NAV 2010. When using 2010 it said that it detected "suspicious activity". Now though, NAV 2009 IS flagging the "Ancient Quest Of Saqqarah" installer , during installation, as "Saqqarah.exe was detected with infostealer" and quarantined the file. In my original thread, another member downloaded and installed the same file without any virus warnings. Although I'm sure our systems are different and that may be causing my problems.

To be safe, I did the following:

NAV 2010 system scan. Nothing detected

NAV 2009 system scan. Nothing detected     ( I had a typo here, I had NAV 2090, I'm using really advanced software  )

Spybot S&D scan -  detected 1 issue,

 HKEY_USERS\S-1-5-21-939100176-3772110265-2097740649-1002\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe

I did a search and the best I could tell was this was flagged because other programs could take advantage of it. I deleted the reg setting anyways.

Malwarebytes' Anti-Malware - Full scan - 3 problems, fixed all, but again false alerts, non vital files, quarantined anyways.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) - sounds devious but from what I read, false positive.

L:\harddrive\program files\DarkBasicPro\Help\examples\file\Exe.exe - Trojan.Agent - old backup of software, haven't used in years - doubt alert was real, again quarantined to be safe

R:\Backup\program files\DarkBasicPro\Help\examples\file\Exe.exe - Trojan.Agent - copy of the last file, again quarantined to be safe

Zone Alarm Anti-Spyware deep scan - nothing.

Next, I think I'll try a little black magic or a divining rod. Anyone know any good chants ?

Seriously, I'm tried from all of this. And I'm going to keep Saqqarah quarantined for now and just go on living and waiting for an update. I'll continue the search in a couple of days. Now, must rest....

That's it. After scanning all those times I found only 4 issues. Most, if not all, weren't anything. So, again it leaves me with just one highly possible false positive. And leaves me with the opinion that NAV 2010 is buggy, over aggressive, and "not ready for prime time".

Thanks  for all the responses.

-Keith5150

[floplot Norton Fighter]

Hi Keith

You are running programs which will conflict with one another and that could cause more problems than it can fix. If you are running Spybot with Teatimer enabled, that will conflict.  Zone Alarm anti-spyware will conflict with your Norton product install as it has the same function and is probably running at the same time as your Norton product. Using a on demand program that doesn't conflict with Norton's is a better solution. Could you please run a HiJackThis and post the log using the attachment  line below the post button. Thanks.

[mijcar]

---

floplot wrote:

Hi Keith

You are running programs which will conflict with one another and that could cause more problems than it can fix. If you are running Spybot with Teatimer enabled, that will conflict.  Zone Alarm anti-spyware will conflict with your Norton product install as it has the same function and is probably running at the same time as your Norton product. Using a on demand program that doesn't conflict with Norton's is a better solution. Could you please run a HiJackThis and post the log using the attachment  line below the post button. Thanks.

---

What we have found in beta testing over two years is that Teatimer WILL interfere with Norton installations to the point of corrupting them so badly that even subsequent installations become problematic.

I don't recall that Teatimer actually interfered with Norton's working once it was installed; however it is generally bad practice to have two security programs running in tandem: Inevitably some kind of conflict will occur over which has primary access to a questionable app or what should be done about some dubious behavior.

More to the point, Teatimer is more difficult to use correctly than it would appear.  Teatimer becomes involved during and right after the installation process of a new program.  Installing a program initiates Teatimer which could then interfere with Norton correctly determining what is really happening with an installation.  After having two or three clients suffer disasters trying to negotiate Teatimer's "helpful" involvement, I disabled Teatimer on all my clients' computers.  It just wasn't worth it.  I haven't used it myself for years and have felt absolutely no loss.

[Keith5150]

I'm racking my brains on how to word a response so that this doesn't turn into a discussion of the merits or demerits of other programs.

But, I just can't find the words. If I defend my position it's just going to snowball.

My issue is with NAV.

I appreciate everyone's help.

Keith5150

[mijcar]

---

Keith5150 wrote:

I'm racking my brains on how to word a response so that this doesn't turn into a discussion of the merits or demerits of other programs.

But, I just can't find the words. If I defend my position it's just going to snowball.

My issue is with NAV.

I appreciate everyone's help.

Keith5150

---

If you drop a glass on the floor and it breaks, with what is your issue?

The floor?

The glass?

Or the person who allowed the two to come into conflict?

---

Worth noting:  The conflicts I or my clients experienced with Teatimer were not with Norton as we were not using the two in tandem.  The conflicts were related to installations of other applications.

---

Beyond that, I see nothing debatable.  You makes your choices and you live with the results.  Most of us are just sharing experiences; and we do it for free.

If you wish to find another product or earlier version of Norton that has no interactive impact with multiple active security programs, I think we will all wish you luck in your search.