Norton Internet Security / Norton AntiVirus

[tech-sponge]

I have Norton Internet Security 2009 installed. The auto-protect keeps picking up 15-20 of my files as Infostealer.Gampass, removes them, and dumps them in qarantine. It does this when there are no scans (on demand or idle) running, so I assume some other program on ym computer is accessing them.

The problem I have is, I cant make norton ignore this 'threat'. Clicking on exclusions brings up the list of threats, but Infostealer.Gampass is not listed there, and hence, i cannot stop norton from nuking my files 6-7 times a day.

At the moment, I have had to turn auto protect off as it has become so intrusive (antispyware, privacy control, heuristics and firewall are still ON). I am supplementing with threatfire and spyware doctor, until i can fins a fix (yes, i am aware they may have potential conflicts, but they run fine for me).

Does anyone know of a way to makr norton ignore this threat? Can any symantec mods suggest it to the engineers to include in future updates?

----

*Same problem with 'Hacktool'. Exclusions list hacktool.xxx, hacktool.yyy etc, but not just plain 'hacktool'.

Message Edited by tech-sponge on 10-27-2008 08:06 PM

[Dieselman743]

Seems like a liget find to me. Did you read this.

http://securityresponse.symantec.com/security_response/writeup.jsp?docid=2006-111201-3853-99&tabid=1

[tech-sponge]

Yes, i am aware that it is a legit virus.

However, the files i know are 100% clean, havign decompiled some of them myself to check.

Iv also used virus total, and viruscan @ jotti .org to scan them.

Any way to shut norton up?

[Dieselman743]

May I ask what the files are? Making a post to "Shut Up Norton" is not a way to get help. Sounds to me like you have some cracks and keygens in your pc that you use.

Message Edited by Dieselman743 on 10-27-2008 04:42 AM

[tech-sponge]

Most are security/administration tools -

computer remote control/management over LAN

password recovery

etc

not illegal, but certainyl suspicious if installed on a pc without the user knowing, hence norton flagging them

edit - 

i've had these files for a while, and keeping them inside a rar used to be sufficient, but NIS09 seems to be much more 'accurate' at finding them

Message Edited by tech-sponge on 10-27-2008 10:49 PM

[tech-sponge]

Spoke with an analyst @ virus tech support tonight. He said he'd pass the info on to engineering...

hopefully he does.

Guess i'll have to wait and see if the enxt round of definitions in the comign days resolves the problem

[Quads]

Hi

In NIS 2009, click "Settings" by the word "Computer", Now you will see in the list "Antispyware" with "on".  Click "Configure" to the right.

Niow you see this. 

 

Try un-ticking "Hack Tool".

The other thing if you know the files and where you have them located on you PC, you can add them one at a time to the Exclusion lists, both "Scan and "Auto Protect" lists. Select any file even .zip or .rar etc.

Click "Configure" to the right of "Scan Exclusions" then the 2 lists appear, Click the Add button for either list to browse and add the file(s) in question.

Quads 

[Floating_Red]

---

Quads wrote:

Hi

In NIS 2009, click "Settings" by the word "Computer", Now you will see in the list "Antispyware" with "on".  Click "Configure" to the right.

Niow you see this. 

 

Try un-ticking "Hack Tool".

The other thing if you know the files and where you have them located on you PC, you can add them one at a time to the Exclusion lists, both "Scan and "Auto Protect" lists. Select any file even .zip or .rar etc.

Click "Configure" to the right of "Scan Exclusions" then the 2 lists appear, Click the Add button for either list to browse and add the file(s) in question.

Quads 

---

With regard to the AntiSpyware, I would not un-check Hack Tool or anything else so you are Fully Protected becasue, if a Hack Tool did get on to your P.C. and you happen to have another on-demand Scanner and that picked the Hack Tool up, the User may complain that Norton "does not work"; you really need to be Fully Protected against all things "evil" on the Internet.  :)

[Tech0utsider]

Infostealer.Gampass is a generic detection for files. Most, in fact all, of the files detected as Gampass by N360, in this case, were keygens/cracks. I would move the slider about low risks to "remove automatically" and turn remove infected files to "automatic".

About Norton "nuking" 6-7 files of yours daily...it could be an network threat...anyone else in your network? 

Message Edited by Tech0utsider on 10-27-2008 10:12 PM

[tech-sponge]

Thanks for the reply Quads. I don't think unchecking those boxes work, as Infostealer.Gampass and Hacktool aren't actually isted under those categories.

Message Edited by tech-sponge on 10-28-2008 01:44 PM

Message Edited by tech-sponge on 10-28-2008 01:45 PM