Norton Internet Security / Norton AntiVirus

[PurkissA]

Trying to transfer a 9GB Norton Ghost Backup file between two PC using MS protocols. The Norton Ghost file starts transfering but 1/4 way through brings up the message "Cannot Copy %filename% Network name no longer available", On the destination PC, NIS gives the message intusion attempt blocked. Example messages below

Details: Attempted Intrusion "Nebiwo Worm Propagation (1)" against your machine was detected and blocked.
Intruder: Wavp-XXXXXb8528.home(1212).
Risk Level: High.
Protocol: TCP.
Attacked IP: WAVP-XXXXX6008D.
Attacked Port: microsoft-ds(445).

Details: Attempted Intrusion "Deloder Worm Infection" against your machine was detected and blocked.
Intruder: Wavp-XXXXXb8528.home(1147).
Risk Level: High.
Protocol: TCP.
Attacked IP: WAVP-XXXXX008D.
Attacked Port: microsoft-ds(445).

Both machines have been scanned and no infection found. Nebiwo removal proceedures also confirm infection not found. I am running XP SP3 on both machines. Intel based D975XBX and DX48BT2 boards with intel on board network interface. Help. I have intrusion detection turned off and file transfer completes OK. I would add the problems also occured with SP2.

[reese_anschultz]

What version of Norton Internet Security do you have installed? What version of the IDS signatures is on your system (found in the logs)?

[PurkissA]

Norton Security Online provided by BT Yahoo! Online Protection Version 10.2.0.30 (my computer recognises it as NIS2007).

Intrusion Prevention Signature File Version: 20080711.001. Intrusion Prevention Engine Version: 4.0.1.80206. Can't find IDS signature date but it is the latest live update file.

[PurkissA]

Also I don't understand why this messages thread has been moved from the NIS section to Other products. Although Norton Ghost is mentioned the problem lies with NIS. It is just a Norton Ghost large backup file I am trying to move. It is not a problem with Norton Ghost.

[reese_anschultz]

Thanks for the feedback. I'm looking into it.

[reese_anschultz · Accepted solution]

Sorry about not getting back sooner.

Our suspicion is that you have some crash dumps in your Ghost image and that the our signatures are triggering the detection. Unfortunately there's not much that you can do about this other than, delete the dumps, disable the particular problem signature(s), or disable Intrusion Prevention/Detection altogether.