Norton Internet Security / Norton AntiVirus

[rft]

We have turned off SONAR since it deletes programs that we wrote and which have been working for many years.

This is a BIG PROBLEM!!!

We develop and provide software to companies all over the world.  SONAR deleting programs wihtout having any chance to stop it is not reasonable behavior.   Such is the default.  Several programs were deleted on our and customer machines wihtout anyone understanding what was happening.

While this technology might be worthwhile, it is not made clear upon installation of Internet Security 2010 that such is going to happen.  2009 does not have this function available.

At this point we do not know that we can continue using NORTON products.  It would appear that the SONAR solution is to delete all programs and leave a PC that has nothing running on it.

Upon investigation of what SONAR was doing, it checked against a database that did not have record of our software.  Writing a new program will cause SONAR to delete it upon first execution.

To repeat, we are very unhappy.

[Yaso_Kuuhl Norton Fighter]

Hi rft, welcome to the Norton Community :-)

We're sorry to hear about the problems you are experiencing with SONAR. 

Does SONAR quarantine the files? If you open your NIS product, you can restore these files from Quarantine (provided SONAR has not flagged them as high-risk items, in which case you cannot exclude them because they are removed at once) and you will be given the option to exclude the files and stop SONAR from flagging them as threats. 

Also, because this seems to be a case of false positives, please submit your files to Symantec via this form:

https://submit.symantec.com/dispute/false_positive/

Message Edited by Yaso_Kuuhl on 10-13-2009 11:06 PM

[rft]

For some programs SONAR just deleted them.

To have to register every program that we write with NORTON does not seem reasonable.  We did not create this problem.

NORTON turns this malicious software on by default.  We innocently purchased NORTON Internet Security 2010 and programs started to disappear.  Why isn't this made clear during the installation and configuration process?

This is going to cost my company a lot of time and money to correct and when customers lose programs due to this it will hurt our business.  None of this ever reflects back to NORTON.

SONAR needs to be removed and re-engineered. 

[Easternokie]

You will also find that even though you exclude a program(with the hotfix installed) when you recompiled it SONAR will delete it again.  I believe that Norton is aware of this and are working on a fix.  I have the same problem with programs developed under Intel Visual Fortran.  I have sent in a file for testing some time ago, but I have no time frame when this problem will be addressed.  Maybe someone with Norton can provide this?

[jbtran]

It's impractical to have to submit each rebuild of every application, to constantly have to un-quarantine and mark files for exclusion (that with the hot fix, still doesn't seem to be properly ignoring the file is to be excluded from future scans).

I've had to disable SONAR permanently and marked it to be ignored that it is off. My subscription ends in a few months and I am seriously considering trying something else. First the Firefox issue, now SONAR. Getting to be a real hassle.

John

[cgoldman]

Gentleman

This problem has already been reported and in the other thread I explained that when you "turn off" Sonar you are NOT disabling SOnar. You are only disabling the detection of low-certaintly threads. Sonar is still active in  detecting high-certaintly threads. The creation of an executable by various third party programes is considering by NIS as a low security thread.

At this time I suggest the only downside of disabling Advanced mode Sonar is that you will not get advised about other low-security threads besides your created executables.

Is this position acceptable or does anyone still feel uneasy?

[jforrest]

I agree with rft and jbtran

We didn’t ask for SONAR, we didn’t buy 2010, and yet we now have it on one of our computers and it turns off and “quaratines” all of self-written applications. Tell us how we can get rid of it – we can’t run our company without those applications. Please also explain how this pest invaded our computer. To have it only partly turned off as described is NOT acceptable

[rft]

We have users who are very disatisified with NORTON.  Many of the my colleagues have switched to Kaspersky.

The internal support cost of Kaspersky is trivial when compared to NORTON products. 

We currently have NORTON installed on a large number of computers internally, at our employee's homes, and at customers.  The problems created cost us money, time and possibly customers.

This SONAR bug just ruined our office administrator's computer.  It is taking me away from other tasks to get her computer back on line.  It has cost a colleague three working days to trouble shoot the problems created by this malicious software on one of our production machines.

I'd rather leave my systems "open" than install supposed security software that is worse than most of the  beasts roaming in the wild. 

[dbrisendine Norton Fighter]

---

jforrest wrote:

I agree with rft and jbtran

We didn’t ask for SONAR, we didn’t buy 2010, and yet we now have it on one of our computers and it turns off and “quaratines” all of self-written applications. Tell us how we can get rid of it – we can’t run our company without those applications. Please also explain how this pest invaded our computer. To have it only partly turned off as described is NOT acceptable

---

To completely turn off SONAR in NIS2010, you will have to remove the product.  Since you didn't buy the product or install it on your company computer, it should not matter if it is removed.  The Norton Removal Tool can be found here; you can also run the Uninstaller from the program menu group in the START menu.  Sorry for your inconvience.

[rft]

It is well and good to disable SONAR so that new programs do not get silently deleted.  We develop software and new programs are constantly being created and tested.

The problem that SONAR is enable by default and the new NOROTN Internet Security 2010 installation does not give any opportunity to tailor the installation.  It is enabled and does its damage before a user can even turn it off.

SONAR should never be installed or enabled by default.  User who install NIS 2010 as an upgrade/renewal get no warning and applications disappear startling rapidity.

As far as I can see SONAR is only useful for someone who uses their computer as a net appliance, i.e. email, web browsing, and simple office suites.

This is not the world that I, my colleagues and customers live in.