Norton Internet Security / Norton AntiVirus

[abro]

Hi - We've been looking at this issue since it was reported yesterday. Here's what we've found.

The right-click option has an issue where it tries to determine the reputation of downloaded *non-executable* files. This issue is limited only to the right click scan, and only when the file was downloaded.

We are currently working on a solution to this which will be deployed shortly. In the meantime, the best workaround is to avoid right-click Insight scans of non-executable files. There isn't any added benefit of right clicking these files, since Insight protection is already properly applied (without this non-exe/exe issue) when the file is first downloaded.

[bwoirhaye]

---

mgbmike wrote:

Noticed this problem this morning. Any *.zip files downloaded with Firefox 3.6.3 are auto scanned with download statusbar and deleted by Insight.

I'll leave them quarantined until I get a definitive response from the Norton engineers.

---

mgbmike,

Can you confirm that you are not right clicking these, but they are being automatically quarantined?  Can you give a link to an example .zip you're downloading?

Are you using any firefox download managers, or just default firefox 3.6.3?

[LibraryAdam]

I may not be Mike (boo on me!), but I can confirm that the files are auto-scanning and auto-quarantining in Firefox 3.6.3.  Only addons are the Norton IPS service, .Net Framework Assistant, Java Console & Quickstarter, and Adblock Plus with the Element Hiding Helper.  I can also confirm that the file is clean (scanned with two other AVG programs on other systems, from a trusted, password-protected site with tech support that I've spoken to).

-Adam

[abro]

Note that we are seeing a separate issue regarding FireFox - sorry, I missed mgbmike's post. We're working on this one - there is a separate thread going here:

http://community.norton.com/t5/Norton-360/ws-reputation-1-detections-on-Firefox-DEV-builds/m-p/22821...

-Adam

[mgbmike]

---

abro wrote:

Hi - We've been looking at this issue since it was reported yesterday. Here's what we've found.

The right-click option has an issue where it tries to determine the reputation of downloaded *non-executable* files. This issue is limited only to the right click scan, and only when the file was downloaded.

We are currently working on a solution to this which will be deployed shortly. In the meantime, the best workaround is to avoid right-click Insight scans of non-executable files. There isn't any added benefit of right clicking these files, since Insight protection is already properly applied (without this non-exe/exe issue) when the file is first downloaded.

---

I'm not right clicking any file downloaded. Firefox is setup to auto scan every file downloaded and Insight still quarantines files when scanning.

[mgbmike]

---

bwoirhaye wrote:

---

mgbmike wrote:

Noticed this problem this morning. Any *.zip files downloaded with Firefox 3.6.3 are auto scanned with download statusbar and deleted by Insight.

I'll leave them quarantined until I get a definitive response from the Norton engineers.

---

mgbmike,

Can you confirm that you are not right clicking these, but they are being automatically quarantined?  Can you give a link to an example .zip you're downloading?

Are you using any firefox download managers, or just default firefox 3.6.3?

---

No right clicking. Yes, automatically quarantined.

I'm using an addon called Download Statusbar.

Example zip(s) I've D/Led can be found at Flightsim.com

[abro]

mgbmike - We've tried out download status bar but aren't seeing this issue - have you configured it to automatically run an Insight scan on download (there's a feature in the options that seems to allow you to do this)?

Any more details is definitely appreciated - we want to solve this ASAP.

[LibraryAdam]

Further attempts: tried downloading using IE8, no addons, and getting the same result.  NAV 2010 is automatically quarantining the file as soon as it finishes downloading.  

I realize that I could probably just get around this by closing the software for a few minutes, but I really don't want to get my new program installed and then find out that I'm still getting false positives from it.

-Adam 

[abro]

LibraryAdam - What kinds of files are you downloading? Are your downloads always being made over SSL (https address)?

Thanks for your help.

[mgbmike]

---

abro wrote:

mgbmike - We've tried out download status bar but aren't seeing this issue - have you configured it to automatically run an Insight scan on download (there's a feature in the options that seems to allow you to do this)?

Any more details is definitely appreciated - we want to solve this ASAP.

---

My setup for download statusbar (version 0.9.6.8) is as follows on the virus scan tab:

Program location is C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\navw32.exe

Arguments is %1

No other virus setup options I see with this version.

Insight runs automatically once D/l finishes.

Thank you for getting on top of this problem. I have to go out for a while but will check back in later.