Norton Internet Security / Norton AntiVirus

[Accipiter]

Hello Allen

Thanks for staying with me. I'm quite happy to switch to Smart Definitions if it's not going to compromise my security, but as I understand things, this only affects the size of the initial download of definitions. Surely wouldn't all updates be the same regardless of whether this was on or off? 

Regards

Accipiter

[Accipiter]

Hello Allen and Hello BajaBoojum

Things have moved on quite a bit now. I got in touch with support by email, and they suggested running the Norton Removal tool and reinstalling NIS 2011. This I did successfully, but LU updates failed to complete Virus 2011 definitions. I ran LU again, and again it downloaded all 94 mb and failed in the same way. I switched to Smart def in desperation, and it downloaded its 55 mb successfully.

I let support know the outcome of this, and they suggested I go into the Norton "Definitions" and "Downloads" folders, and delete all the files then run LU again. I tried this, but the system won't allow me access to delete these files. I know I can get round this problem, but I'm going to have to look up how to do it; I would have thought the Norton Removal tool would have done that anyway.

Support advised me to contact them by phone. So, having explained everything again, they said the problem is caused by my slow connection, and suggested I download "Intelligent Updater" to get updates. I'm surprised this is the likely cause. It's true that I am out in the sticks a couple of miles away from the exchange on a long length of copper wire, but I still typically get .4 to .7 mega bits (half a meg'ish - say 3 to 5 M bits/minute), taking 20 to 30 minutes to download a 90 odd mb file. Does LU have a time out that won't cope with this, and if so, what happens to people on dialup?  I have run LU successfully at that size several times in the past.

I haven't followed this advice as yet, as I've already used up nearly 20% of my monthly 2 gig allowance in just one afternoon, and another 94 meg, that my well not solve the problem, is a step too far.

One other piece of advice I was given over the phone, was to change my LAN settings to: "Automatically Detect Settings". Since I'm not aware that I'm going through a Proxy Server, I wondered how this would help.

So as not to lose sight of my original problem, it is this:

When I first loaded NIS 2011 three months ago, LU ran successfully, and further LU updates worked OK.  On some occasions, a small  update (say a few kb to a couple of meg) will fail to complete (always Virus 2011 updates), and when I run LU again, it wants to download more than 90 mb. This is usually successful, although on one occasion I did have to do the large rerun twice.

It seems I'm not getting very far with this, and I wonder if LU is designed to download its evergrowing database in its entirety, if a hiccup occurs on the first attempt. It's only because I have a restricted, (but usually perfectly adequate) monthly allowance that I spotted it as a problem. 

So far, for what ever reason, being switched to Smart Def has worked without trouble. So for the time being that has to be the solution. It's interesting though, that when I ask if this setting will compromise the integrity of my security, Norton staff never give a straight answer, like - no It won't or yes it will, but... 

Anyway, if anyone has any further suggestions they will be most  gratefully received.

Regards

Accipiter 

[BajaBoojum]

Sorry I can't be more help and the following suggestions contain lots of ifs, but they are something to consider.

If support is right and it's a connection issue, here are a couple poor work-arounds:

Is it a notebook or desktop?  If it's a notebook, can you bring it out to civilization every once in a while and download the most recent updates?  I actually did something similar for my netbook before I got WiFi.  It took four or five days for the Norton icon to go red.

If it's a desktop, can you download the updates to a flash drive somewhere else?  What about your workplace, a library, or a friend's house?

These are not ideal solutions, but you have a couple of things in your favor.  First, many really bad threats come via faster connections.  I know some people who still have dial up and don't worry about attacks.  I don't agree, but they can live with it.  Second, you still have the excellent Norton protection in between updates, so even if the icon says 'At Risk' you're still fairly safe.

Good luck!

[AllenM Norton Fighter]

Hi Accipiter,

I've thought about the issue being triggered by your internet connection and I think that is the most likely possibility. Do you tend to have temporary, short duration interruptions with your internet connectivity?

I have been thinking about the possibility of a problem which might cause this if that first live update happens to get interrupted due to brief loss of internet connectivity or some other timeout causing Norton to want to download the entire definition set. I've actually been periodically trying to reproduce this on my test laptop.

This is one time my high speed internet connection is working against me. Updates typically download so fast that I have not been able to kill my internet connection quick enough before the live update has finished the download phase.

However I will continue to try and reproduce this because my instincts are telling me there might be an issue in this area.

Having to do with Smart Definitions, it is a pretty tough question to give an absolute definitive answer on. Having Smart Defs ON causes NIS to download only the core set of defs and excludes older malware definitions for malware which has not been seen in the wild for a long time.

There is always the possibility that older malware could resurface again and be re-introduced into the wild. This is where NIS "could" be vulnerable but there are two things abould older malware like this:

1. Since the malware is older and has well known definitions to eliminate them, even if older malware like this were to be re-introduced into the wild it would most likely have changes to it such that the older definitions would no longer work anyway.

2. If this were to occur then NIS would start including the definitions for that older malware into its "core" definition set and you would start receiving it via pulse/live update again.

I will certainly update this thread if I am able to reproduce this.

Best of wishes.

Allen

[AllenM Norton Fighter]

Hi Accipiter,

I just wanted to pass on one small update. I was able to (finally) interrupt my live update in mid-stream on my test laptop which caused 5 of 9 updates to fail, including new virus definitions.

However, a subsequent live update only downloaded the remaining updates and not the full definition set.

I will restore a Ghost image containing NIS 2011 to my test laptop and test again on that over the next few days.

Best wishes.

Allen

[Accipiter]

Hello Allen and BajaBoojum

I am using a PC (XP SP3)  with a hard wired router connected via Ethernet. I don't need to go to another machine with faster broadband for downloads, because at half to 3/4 of a meg, it's not really a big problem to download files of say 100 meg. It would only take 30 minutes at most. My problem is that I don't want to pay my ISP for an upgrade to my monthly download allowance just so I can update NIS. I've already used up nearly 20% of it in one afternoon just trying to solve the problem.

When you (Allen) ask if I have interruptions to my internet connection, I'm a little unsure what you mean. I very rarely ever loose the connection. That is, the internet and the DSL light on my router seldom ever drop out, unless there are freak static conditions like a thunder storm, but if I am looking at something on YouTube  for instance which involves sound and pictures, the system will xon/xoff regularly, but there are never any errors. If I do have to download a large file, such as NIS 2011 the other day, the connection is usually very stable, and no errors occur. So I can't understand why LU should cause me this problem. When it does fail, it's usually only on a small update of a few kb initially, The trouble is once it's failed, it then wants to download everything from scratch.

 It's interesting to note that when you forced a failure, a rerun of LU only updated the files it missed the first time. This is where things seem to go wrong for me. It also seems odd that if I switch to Smart Definitions, (which is how I've left it for the time being) it will not only download the initial 55mb without trouble, but I haven't experienced any failures with updates. It is though, too early to draw any conclusions from this.

Thanks too for your thoughts on the security of Smart Def. It seems such a good idea in principle, but I do note it's not the default setting.

Regards.

Accipiter

[AllenM Norton Fighter]

Hi Accipiter,

Can you confirm that your system clock is correct?

When you've noticed that Live Update wants to download the 90MB + definitions, does NIS show Secure at the top of the main interface window?

Make note of this and then next time it happens double check that your system clock is correct.

Best wishes.

Allen

[Accipiter]

Hello Allen

If by System Clock your referring to the time display in the bottom right of the task bar, then it is always correct and remains steady. As for the Norton System Status, again, it always shows as secure. 

Regards

Accipiter

[AllenM Norton Fighter]

Hi Accipiter,

Yes, that is what I meant by system time. Just something I wanted to double check because if for any reason your computer time went backwards in time too much (as could occur for example if your BIOS battery were going bad), then NIS would want to download the entire definition set again.

I have done a fair amount of testing with NIS 2011 on my test laptop and have still not been able to reproduce this problem. I actually restored a Ghost image which was created about 40 days ago and this was far enough back NIS wanted to download the entire set of definitions again which for the anti-virus portion of the definitions was probably about 90MB or so worth of download. This allowed me to interrupt the live update session multile times in the middle of downloading anti-virus definitions.

In each case live update picked up where it left off instead of starting over again. For example where I started with something like 90MB, I interrupted the live update after downloading about 40MB. When I launched live update again it started to download only about 50MB. Then I interrupted it 3 more timesat different point and each time it just picked up where it left off.

So I am not seeing anything which looks like an inherent problem with NIS in this regard.

A couple of other possibilities I would recommend that you try:

1. Please run chkdsk to check for any hard drive errors. As a precaution if you have any image backup program, you might want to make a fresh backup. To run chkdsk please bring a DOS command window and enter the command chkdsk c: /r. You will be prompted to schedule the chkdsk for the next restart. Answer yes to this and reboot your computer. Chkdsk will then run while Windows is booting up. More information on chkdsk can be found here. An on screen report will be generated after chkdsk completes. If the computer reboots again before you are able to see the results of chkdsk you can find out after the fact whether Windows found any errors on your hard drive via the Windows Application events. More on viewing events in XP can be found here.

2. If chkdsk does not find a problem then I would suggest uninstalling and reinstalling NIS with the use of the removal tool as indicated below. I have been reluctant to suggest this before now since you have a limited download quota with your ISP. But since I cannot reproduce this I think we need to try this at some point to see if it cures the problem. If chkdsk DOES find any problems then turn OFF Smart Definitions again, run live update and monitor the situation over time to see if the problem is still there. I know you ran the Norton removal tool before but this time we really should delete all Norton/Symantec directories after running the removal tool to make absolutely sure that it is cleaned off properly before reinstalling NIS.

Please click on the spoiler tag below for the removal tool instructions.

Spoiler

If you use Identity Safe you should back up this data first. Please see this link for details on how to do this.

Before you use the removal tool, please download the full version of NIS 2011 from here. Please note that this is the English version so please let me know if you need a different language and I will provide the appropriate link. NOTE that if you already have the NIS 2011 installer saved you can skip this step.

Once you have downloaded NIS, you can proceed with use of the removal tool as indicated below.

Please NOTE that this removes ALL Symantec products so be sure to have your license keys ready as you will need to reinstall all your Symantec software products. You can get your Norton product key from your Norton Account.

Once done please download the Norton Removal Tool from Symantec from this link.

For your protection, disconnect from the Internet before continuing.

Do a conventional uninstall of NIS via the Control Panel and then restart your computer.

Run the Norton Removal Tool and once it is completed, please reboot your computer. Once up please run the Removal Tool one more time and once again reboot.

Please remove all Norton/Symantec directories found. Of particular importance are the following:

C:\Program Files\Norton Internet Security

C:\Documents and Settings\All Users\Application Data\Norton

C:\Documents and Settings\All Users\Application Data\NortonInstaller

C:\Documents and Settings\All Users\Application Data\Norton Installer

Please note that you need to have Windows Explorer options set to allow viewing of hidden files and folders. More on doing this can be found here.

Then please install NIS 2011 from the full version downloaded earlier. Once installed please reconnect back to the Internet and run Live Update repeatedly (rebooting as requested) until it reports there are no more updates.

Hope this helps and please let me know how it goes.

Best wishes.

Allen

[Accipiter]

Hello Allen

Thank you for your sterling efforts to solve this problem for me. I am pleased to have your help.

I ran chkdsk, and it showed no errors and 0KB in bad sectors; as a matter of fact I ran it twice. I will follow your instructions as listed in the spoiler, and get back to you. It might be a day or so before I do it, as I'll make a point of doing it between midnight and 8 am when I can download as much as I like without it adding to my paid for total.

Thanks again,

Accipiter