• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Confused about Norton Insight Scan?

When I set scan performance profiles to high trust trust  and check Insight it says scan needed for 3%. When I then run a full scan it scans 517K files almost as much as when trust level is set to standard. 3 %  should be around 18000 files, but it isdd not.?

 

Can anyone explain what is happening?

Replies

Kudos0

Re: Confused about Norton Insight Scan?

When I set scan performance profiles to high trust trust  and check Insight it says scan needed for 3%. When I then run a full scan it scans 517K files almost as much as when trust level is set to standard. 3 %  should be around 18000 files, but it isdd not.?

 

Can anyone explain what is happening?

Accepted Solution
Kudos2 Stats

Re: Confused about Norton Insight Scan?

The Insight 'meter' that you see by clicking Insight on the main page is only giving you the relative percent of files loaded in memory (running processes) that are Trusted / Need scanning.  This is not the percent of total files on your system.  Does this help?
Win10 x64; Proud graduate of GeeksToGo
Kudos1 Stats

Re: Confused about Norton Insight Scan?

Yes that clears it up. Thanks.

It would seem logical to me that Symantec should change this in the next release to also show the toatal percentage of files that are trusted. Do you agree?

BTW. Do you reccomend setting the profile to standard trust or high trust? and why

Kudos0

Re: Confused about Norton Insight Scan?

I am not sure when the 'All Trusted files' percentage or whatever display will be incorporated.  I know this has been discussed before and will most likely be included in the future but I don't know when.

As to the Scan Trust level, I leave mine on Standard but then my Full scans are over night so it doesn't bother me if it takes 2 hours to finish.  High Trust would exclude those files with a Level 3 digital signature which is very hard to get and is only on independantly highly tested files.  This would shorten the scan time but I would think not very significantly.  However I wanted you to know that if you choose the High Trust that you will be just as safe but it may not make much difference in the total overall scan time.

If you need anything else, just ask.

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Confused about Norton Insight Scan?

When you set it to High Trust, this is where the Community have Rated Files as Trusted and these are Added, so, some Files may be wrongly Trusted, so, that is why I would suggest Standard Trust.

Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Kudos0

Re: Confused about Norton Insight Scan?

What's missing from the 'Norton Insight' graph is a title that displays what it represents, for example, 'Trust Level for Running Processes' would clarify what the graph is displaying. This would clarify what the graph represents and would not lead to the misconception that the Trust Level relates to a proportion of all files on the computer.

In my experience, 'Norton Insight' seems pointless for laptop users. The 'Trust Level' of files scanned by a 'Full System Scan' isn't saved to disk and does not persist over a reboot. Consequently, after a reboot, all files need to be scanned again, negating any of the time-saving trust benefits provided by the previous scans. If this is an issue unique to me, then let me know.

Kudos0

Re: Confused about Norton Insight Scan?


elsewhere wrote:

What's missing from the 'Norton Insight' graph is a title that displays what it represents, for example, 'Trust Level for Running Processes' would clarify what the graph is displaying. This would clarify what the graph represents and would not lead to the misconception that the Trust Level relates to a proportion of all files on the computer.

In my experience, 'Norton Insight' seems pointless for laptop users. The 'Trust Level' of files scanned by a 'Full System Scan' isn't saved to disk and does not persist over a reboot. Consequently, after a reboot, all files need to be scanned again, negating any of the time-saving trust benefits provided by the previous scans. If this is an issue unique to me, then let me know.


Perhaps you can suggest this in the "Norton Internet Security Suggestion Box".

Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Kudos1 Stats

Re: Confused about Norton Insight Scan?


elsewhere wrote:

In my experience, 'Norton Insight' seems pointless for laptop users. The 'Trust Level' of files scanned by a 'Full System Scan' isn't saved to disk and does not persist over a reboot. Consequently, after a reboot, all files need to be scanned again, negating any of the time-saving trust benefits provided by the previous scans. If this is an issue unique to me, then let me know.


The 'Trust Level' of files scanned do persist past a system boot.  It is lost (or discarded) by either the files changing (thus the SHA256 hash is no longer valid) OR a FULL virus definition Update has been performed (either by doing a manual trigger or an Automatic trigger).  Thus, even on a desktop system that is left on for 24 hours, the scan Trusted files' status would only survive for about 8 hours or so.  The files in the Insight Trust graph 'area' (for lack of a better term) are the only files at present who's Trust level survives the Full Virus Definition Update cycle.

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Confused about Norton Insight Scan?


dbrisendine wrote:
The 'Trust Level' of files scanned do persist past a system boot.  It is lost (or discarded) by either the files changing (thus the SHA256 hash is no longer valid) OR a FULL virus definition Update has been performed (either by doing a manual trigger or an Automatic trigger).  Thus, even on a desktop system that is left on for 24 hours, the scan Trusted files' status would only survive for about 8 hours or so.  The files in the Insight Trust graph 'area' (for lack of a better term) are the only files at present who's Trust level survives the Full Virus Definition Update cycle.

Based on your information, I scanned, rebooted (ensuring there wasn't an internet connection in order to prevent a definition update) and scanned again. The 'Trust Level' of the previously scanned files did persist over the reboot as there were a significant number of 'Skiipped Files' in the scan results.

Thank you for clarifying how this works.

Kudos0

Re: Confused about Norton Insight Scan?


Floating_Red wrote:

When you set it to High Trust, this is where the Community have Rated Files as Trusted and these are Added, so, some Files may be wrongly Trusted, so, that is why I would suggest Standard Trust.


Good point F_R but the Standard Trust includes some of that also.  The real question is, is the Standard Trust just "Norton and Community" files (files with both votes) or a combination of Norton Trusted files and Community Trusted files? 

This is from the Help file for NIS2009.  I think we will need to get some clarification on this.

Standard Trust

Lets Norton Internet Security exclude from a scan the files that are Norton Trusted and Community Trusted

Norton Internet Security scans only those files that do not have a trust level.

High Trust

Lets Norton Internet Security exclude from a scan the files that are Norton or Community Trusted or the files that have known digital signatures.  Norton Internet Security scans only those files that do not have a trust level or a class 3 digital signature.

HHmmmm.... Looks like it goes either way.

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Confused about Norton Insight Scan?

Thank you all for the feedback on the Norton Insight feature!

Some comments on my side:

- As dbrisendine pointed, the Insight 'meter' that you see by clicking Insight on the main page is only giving you the relative percent of files loaded in memory (running processes) that are Trusted / Need scanning.  This meter is mostly related to QuickScan. Think of it mostly as an indicator on how the Quick Scan is optimized vs. the Full System Scan. Quick Scan runs on the user's system more often than the Full System Scan...

- The Trust Level persists reboots. The trust level for a file is refreshed if the file changes, if Symantec revokes the Trust Level or after a timeout. It does not need to be refreshed every time you get new definition updates on your system.

- High Trust is the same as Standard Trust + we exclude the files that have a class 3 digital signature.

Kudos0

Re: Confused about Norton Insight Scan?

Athena -

Thanks for verifing some of the Insight information.  But I have got to ask what constitues a "timeout" that you mentioned that causes a file to lose its Trust level?

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Confused about Norton Insight Scan?

The "timeout" is like "Time-to-Live". It is not the same for every file. It can be anywhere from 8 hours to infinite.
Kudos0

Re: Confused about Norton Insight Scan?

Thanks for clearing that up, Athena.
Win10 x64; Proud graduate of GeeksToGo

This thread is closed from further comment. Please visit the forum to start a new thread.