• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Constant data upload by NIS

I've experienced a problem with my mac constantly uploading data (my monthly internet upload quota was exceeded).  My mac runs NIS 5 & being suspicious of malware I run a full system scan with no issues identified.  To help me determine what was uploading data, I bought a program “Little Snitch”.  To my amazement the application is “symdeepsight-extractor” which is uploading data to the server “upload3.symantec.com”  I find it hard to believe that it was necessary for Symantec to collect 1.7Gig of data from my mac.  Has anyone else had this issue?  Does Symantec have a comment on what data they are collecting off my system?  I have now used Little Snitch to block this traffic.

Replies

Kudos0

Re: Constant data upload by NIS

I've experienced a problem with my mac constantly uploading data (my monthly internet upload quota was exceeded).  My mac runs NIS 5 & being suspicious of malware I run a full system scan with no issues identified.  To help me determine what was uploading data, I bought a program “Little Snitch”.  To my amazement the application is “symdeepsight-extractor” which is uploading data to the server “upload3.symantec.com”  I find it hard to believe that it was necessary for Symantec to collect 1.7Gig of data from my mac.  Has anyone else had this issue?  Does Symantec have a comment on what data they are collecting off my system?  I have now used Little Snitch to block this traffic.

Kudos0

Re: Constant data upload by NIS

This submission can also be controlled within the Norton Firewall settings.  Under the Advanced Protection there is a setting for "Norton Deepsight (tm) Community Submission".  There are also buttons further explaining this feature, as well as the privacy policy.

Kudos0

Re: Constant data upload by NIS

In the privacy policy for the deep sight community, it states that the firewall log will be uploaded at periodic intervals.  Surely a firewall log will not be 1.7 gig of data (file compression is common place isn't it?)???  Is there a way to locate the firewall log file and find out it's real file size?  I'm not convinced with the explanation thus far.  What is really going on Symantec?

Kudos0

Re: Constant data upload by NIS

That does sound high to me, was it 1.7 Gb in a single upload, or over the month?  I'll need to confer with someone else on the content since I'm not that familiar, mostly my intent was to give you another way to disable submissions.  Little Snitch may cause some other conflicts when running alongside Norton Firewall.

Kudos0

Re: Constant data upload by NIS

I've disabled Deep sight community as per the information provided.  Thanks! 

The 1.7 Gig of data was over approx a 6 hour time frame. (as reported by Little Snitch and confirmed by software in my router)  Please keep in mind that in my LAST ISP billing period, my upload usage was 17.8 gig (no torrent activity in this time frame either) which is what started me on this hunt for what was uploading data as I was concerned about a malware attack.

I don't propose to run with two firewall programs long term.  Little Snitch was used primarily to determine what application was uploading data.

Kudos0

Re: Constant data upload by NIS

Any update from Symantec???

Kudos0

Re: Constant data upload by NIS

Sorry, I thought there was going to be a response from elsewhere.  I did learn that the data upload is supposed to be throttled, so this amount sounds very high.  I'll try to get a more detailed response later today.

Kudos0

Re: Constant data upload by NIS

This post has been moved to the forum devoted to Norton Internet Security
Kudos0

Re: Constant data upload by NIS

Apologies to bdsh, I've been meaning to find this out for a week or so...the log that gets uploaded is:

/Library/Application Support/Symantec/DeepSight/FirewallEvents.log

So you can check if that is getting extraordinarily large.  If so, that would lead to some further questions, we can have you send some additional info if you want to pursue it.

Kudos0

Re: Constant data upload by NIS

Hi Lee, I've checked the "FirewallEvents.log" file and it's 50.6MB  It has events from approx July 2012 to very recently.  It appears to be consecutive lines with Date, Time, IP address, Integer, Integer, Integer. 

This file size is drastically smaller than the upload of 1.7GB

I hope this helps determining whats going on.

Kudos0

Re: Constant data upload by NIS

Unfortunately, that doesn't tell us much except that it is unlikely Deepsight is responsible for the large upload (if it's behaving as designed, in any case).  It's hard to say if Little Snitch is giving inaccurate info about the responsible process, or if something more subtle is going on.

If you go to the Help menu in one of the NIS products, there is a "Gather Support Information..." option that will gather some data about your configuration.  I'll send a private message with an email address where you can send the output.

Kudos0

Re: Constant data upload by NIS

Hi Lee, I've just emailed you the request file.  Hopefully this has some useful info in diagnosing what's gone on.

When Little Snitch identified the task “symdeepsight-extractor” as the one uploading data it listed the server “upload3.symantec.com” as the destination.  Data upload was stopped by using Little Snitch to prevent this task accessing the internet.  This was verified with traffic monitoring in my router as well as with ISP data usage information.  Exact data volumes may be slightly inaccurate but the shear volume of data uploaded is excessive.

Thanks,

Bruce

This thread is closed from further comment. Please visit the forum to start a new thread.