Norton Internet Security / Norton AntiVirus

[MsParanoid]

I have 2012 NAV running on WinXP32 Pro.  I have used my computers with Autorun/Autoplay turned off for some years now - through gpedit.msc / Computer Configuration / Administrative Templates / System / Turn off Autoplay: On all drives.  This is also reflected in my registry as follows:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer: "NoDriveTypeAutoRun"=dword:000000ff

A few days ago I inserted a friend's USB thumb drive into the USB port with full confidence that nothing will autorun or autoplay, which it didn't.  In Explorer I could single-click on the Plus (+) next to the device name to display the root folders in the left window and folders and files in the right Explorer window.  Still fine.  I could see, amongst others, autorun.inf and driver.exe in the root.  (I have Display Hidden and System files turned on, and also Hide Known File Extensions turned off.)

I wanted to create a new directory on that USB drive into which I wanted to copy a file, so I right-clicked on a blank area of the right-hand side Explorer window to get the context menu to create the directory.  Stuff started happening.  Norton piped up about having detected a threat in driver.exe.  I thought it had done an autoscan of the contents of the root of that thumb drive.

But no, and this is what troubles me:  Norton then reported that it had fixed 58 registry actions which this infected driver.exe had performed on my machine.

1.  Why did Norton allow any registry activity from this infected file in the first place?  It would have been better if activity had been prevented, surely?

2.  Can anyone reveal why the autorun.inf or driver.exe files actually executed at all?  I have previously right-clicked in right-hand Explorer windows with autorun.inf files in the root (genuine files, not malware) and the autorun.inf which would've kicked off a Setup or Install of software definitely has never run.  Why now on this thumb drive?

Feedback definitely appreciated.

[MsParanoid]

Well, I've discovered the answer to my second question. 

This is a new machine I built in January and I thought I had applied all the Windows Updates.  Not as such.  The missing one was KB967715.  It creates an extra registry entry alongside the "NoDriveTypeAutoRun" one under Explorer - it's called "HonorAutorunSetting" and should have a value of 1.  It fixes exactly the behaviour I had experienced where the autorun.inf is executed by Explorer on a right-click.

So be sure you have BOTH entries in your registry for Autorun/Autoplay to be effectively disabled.

Scary stuff.

[MsParanoid]

To anyone who has the answer to my topic question:   I'd really like to know the answer, please.

I'd feel much safer if the typical Norton Antivirus action was to PREVENT a virus from infecting my computer, rather than allowing it to infect and then attempt to clean up afterwards.

Can anyone tell me?  I'm a new NAV user so I don't have much experience with the way it's supposed to work.

Many thanks.

[dickevans Super RootKit Eradicator]

---

MsParanoid wrote:

To anyone who has the answer to my topic question:   I'd really like to know the answer, please.

I'd feel much safer if the typical Norton Antivirus action was to PREVENT a virus from infecting my computer, rather than allowing it to infect and then attempt to clean up afterwards.

Can anyone tell me?  I'm a new NAV user so I don't have much experience with the way it's supposed to work.

Many thanks.

---

Hi,

If you find a virus BEFORE Symantec/Norton completes the testing of an identifying signature/definition then it will infect you. When the next pulse update runs and provides the signature/definition to the quick scan that runs when the update is installed it will do its job and remove the virus.

It is impossible for any one product to protect you from every threat all of the time. It is worth the time and effort to consider the possible ways to layer protection so that you are in a protected position which will provide the least possible target for infection. Keeping your security software up to date, keeping your operating system up to date, possible adding Norton DNS to your system or router, having another scanner like Malwarebytes or SuperAntiSpyware on the desktop to run at interval, or whenever you feel the need will do all that can be done by the machine. The most important part of any security scheme is the chair keyboard interface. If it is not current and fully engaged then the rest of the components are just so many computer programs.

Hope this answers your question. We'll be here when you need us. Til then

Stay well and surf safe

[MsParanoid]

Hello dickevans

I can understand that if I introduce a virus to my machine BEFORE Symantec/Norton completes the testing of an identifying signature/definition then it will infect. And that a Pulse Update later could find a new signature with instructions to clean it. But this was not the state of affairs in the scenario I sketched.

1.  The virus is a relatively old one - see Symantec's page from 2007 here:  http://tinyurl.com/apx2kp

2.  A Pulse update couldn't have suddenly found a new signature in the 3 seconds between infection and cleaning because I wasn't even close to the Internet at the time. (I use a dial-up modem on a different UNIX machine which wasn't even turned on.)

So unless I'm missing something, my question remains: since Norton already had the identifying signature of W32.SillyFDC in its database on my machine, why did it allow execution of the virus instead of preventing it?

[SendOfJive Norton Fighter]

Hi MsParanoid,

While this worm has been around for awhile, it mutates constantly in order to avoid detection.  It is quite likely that you encountered a new variant of the threat, for which no signature was yet available.  If you look at the Antivirus Protection Dates on the writeup page for W32.SillyFDC, you'll see that the latest definitions for this threat were released today.  Rather than being a dormant holdout from years ago, this malware is an active, continually evolving threat for which new definitions are being created on an ongoing basis.

http://www.symantec.com/security_response/writeup.jsp?docid=2006-071111-0646-99

[MsParanoid]

Hello SendOfJive

Thanks also for your contribution to the discussion, I do appreciate it.

I understand that this virus mutates and that new signatures are required to identify each variant.  But I don't understand how that answers my question.

Maybe I'm not clear enough in explaining the context of my question.  At the risk of labouring the point, I'm going to try again. 

1.  There was NO internet access (which means NO Signature update or Pulse update) in the 3 seconds between infection and detection (and disinfection). 

2.  I must therefore assume that Norton already had all the necessary signature information (definitions) required to identify and disinfect  this particular version of the virus.   (right?)

3. Then why did Norton allow this known virus to infect my machine?

[Mitka Spam Squasher]

I think you all are the missing the key point MSParanoid is trying to make.

Norton was ABLE to identify the W32.SillyF​DC (it notified her afterall) but it still ALLOWED the virus to perform registry changes.

Mitka

[SendOfJive Norton Fighter]

---

MsParanoid wrote:

I must therefore assume that Norton already had all the necessary signature information (definitions) required to identify and disinfect  this particular version of the virus.   (right?)

---

There is always a period of vulnerability during the time between the release of a new threat variant and the creation and dissemination of a signature that will detect it.  Malware writers actually test their work against the major antivirus products to make sure that their latest creations will not be immediately detected - it does them no good to release a new malware variant if antivirus programs can already spot it and block it.  If your machine was infected, then no, Norton did not have a signature that would recognize it at the time.  Some part of the malicious code had been changed in a way that made it able to evade detection based on then-existing signatures.

[Mitka Spam Squasher]

I want to say fair point but are you saying that although Norton identified the virus it wasn't able to detect the changes made by it because the virus signature definitions wasn't up-to-date?

Also, MsParanoid indicated that she was not connected to the internet.

Mitka