Solved.
Kudos0

Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 7:58AM · 20 Replies ·

I just had a weird thing happen for the first time:  I have a very innocuous program installed on my laptop - Quilt Pattern Indexer.  It indexes longarm quilt design files, so I can see thumbnails and organize my longarm quilting stitch files.  I tried to execute a search of all my longarm stitch files using Keywords that are assigned to all my designs.  Norton suddenly popped up a Data Protector screen saying "Data Protector blocked a suspicious action by quiltpatternindexer.exe".  Norton has never done this, before.  Not sure what has changed, but I do NOT want Norton to block me using my QPI program.  On the pop up window, I only have two options, 'Exclude Process' or 'File Insight'.  There is no definition of what 'Exclude Process' does.  I want Norton to leave my QPI program alone and ignore it.  What do I do to get Norton to stop suddenly blocking my use of my file indexing QPI program? 

Patty S.

Labels: Application Blocking
Accepted Solution
Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:06AM · Permalink

"Exclude Process" adds that process to processes excluded from Data Protector.
Presumably "quiltpatternindexer.exe" 

"Exclude Process" is reversable.  

View Accepted Solution in Context

Replies

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:28AM · Edited: 06-Jul-2022 | 8:37AM · Permalink

"Exclude Process" adds that process to processes excluded from Data Protector
Presumably "quiltpatternindexer.exe" 

https://support.norton.com/sp/en/us/norton-360-deluxe/current/solutions/v130571264

FAQ: Norton Data Protector
https://support.norton.com/sp/en/us/home/current/solutions/v132149446

Please review: related thread where I've posted Norton Insight, Process Exclusions, Data Protector pics
https://community.norton.com/en/forums/program-blocked-data-protector

Please review: Data Protector is protecting AppData\Local\Temp folder
https://community.norton.com/en/forums/data-protector-protecting-appdatalocaltemp-folder

Regarding the "innocuous program installed on my laptop - Quilt Pattern Indexer"
Please check File Insight against all file types that File Insight checks...for example: exe, sys, dll.
Please check Norton Insight -> Untrusted Files -> Unproven/Poor and if file/s are trusted (by user) -> click the trusted file -> click Trust Now -> Refresh page. 
for example:

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:36AM · Edited: 06-Jul-2022 | 8:40AM · Permalink

So, the first link suggests "If you trust the application that you are using, then add it to the white list to exclude from scanning. "  But no explanation as to how to add the app to the "white list"??  Need more explanation.   I want Data Protector to ignore this program entirely.  Instead of overloading me with info, can you answer two questions?

1.  What does "Exclude Process" mean?  Does that mean, if I click that button, Data Protector will ignore QPI when it executes a search?  Or, will "Exclude Process" exclude the search entirely, not allowing me to use the search function?  It's not clear what that button does.

2.  How do I add my QPI program/app to the White List, which seems that if I do this, Data Protector will just ignore this program all together, so I'll never get another pop up  from Norton when I use this program??

This action from Norton is just inexplicable.  I've had both installed on my laptop for a long time, and now, all of a sudden today, Norton doesn't seem to like QPI.  No updates to QPI, and none to Norton that I'm aware of.  Very frustrating.

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:38AM · Permalink

"Exclude Process" adds that process to processes excluded from Data Protector
Presumably "quiltpatternindexer.exe" 

https://support.norton.com/sp/en/us/norton-360-deluxe/current/solutions/v130571264

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:39AM · Permalink

hoosierquilt:

So, the first link suggests "If you trust the application that you are using, then add it to the white list to exclude from scanning. "  But no explanation as to how to add the app to the "white list"??  Need more explanation.   I want Data Protector to ignore this program entirely.

Data Protector excludes by process.  Data Protector does not exclude by folders/programs.  

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:41AM · Permalink

Huh?  Still not answering my question.

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:42AM · Edited: 06-Jul-2022 | 8:43AM · Permalink

Is Quilt Pattern Indexer a free publicly available download/install?
Maybe, I can try to reproduce.  IDK

If you feel it may help. 
Please post related: Security History -> Data Protector

change file type from (*.mcf) to text (*.txt)

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:44AM · Edited: 06-Jul-2022 | 8:45AM · Permalink

hoosierquilt:

Huh?  Still not answering my question.

Sorry.  Maybe, I'm not understanding your question. 
Please restate your question/concern.  

Is file Auto-Protect blocked?
Is file Data Protector blocked? 

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:48AM · Permalink

Please tell us what Norton is telling you regarding this event.
For information regarding event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste.

For second opinion choose File &/or Search hash at VirusTotal 

Act on quarantined risks or threats
https://support.norton.com/sp/en/us/home/current/solutions/v6200305

Turn off or turn on Download Intelligence
https://support.norton.com/sp/en/us/norton-security/current/solutions/v23920640

Exclude files and folders from Norton Auto-Protect, SONAR, and Download Intelligence scans
https://support.norton.com/sp/en/us/home/current/solutions/v3672136

Fix problem detecting a file or program as a threat even after you exclude it from scan
https://support.norton.com/sp/en/us/home/current/solutions/v115455517

Configure Exclusions/Low Risks settings
https://support.norton.com/sp/en/us/norton-360/home/solutions/v15457075

Exclude files with low-risk signatures from Norton scans
https://support.norton.com/sp/en/us/home/current/solutions/v15463085

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:49AM · Edited: 06-Jul-2022 | 8:53AM · Permalink

Quilt Pattern Indexer is a purchased app.  It is perfectly safe.  I've been using it for years along w/Norton on my laptop.  So, this pop up today is inexplicable to me, unless Norton had a recent update (as in, last night). 

Can someone answer my question:  What does "Exclude Process" do?  I have a pop up window asking me to make a decision.  Should I click on "Exclude Process" button?  What does that do?  Once I clear this pop up window, I will try to figure out how to add this app to the White List, where ever that is.  But first, I need to clear this pop up window in some manner. I would add a screen snip of the pop up box, but can't figure out how to attach an image file.

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:51AM · Edited: 06-Jul-2022 | 8:52AM · Permalink

hoosierquilt:

Can someone answer my question:  What does "Exclude Process" do?  I have a pop up window asking me to make a decision.  Should I click on "Exclude Process" button?  What does that do?  Once I clear this pop up window, I will try to figure out how to add this app to the White List, where ever that is.  But first, I need to clear this pop up window in some manner.

"Exclude Process" adds that process to processes excluded from Data Protector.
Presumably "quiltpatternindexer.exe" 

https://support.norton.com/sp/en/us/norton-360-deluxe/current/solutions/v130571264

FAQ: Norton Data Protector
https://support.norton.com/sp/en/us/home/current/solutions/v132149446

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:53AM · Edited: 06-Jul-2022 | 8:55AM · Permalink

Exclude files and folders from Norton Auto-Protect, SONAR, and Download Intelligence scans
https://support.norton.com/sp/en/us/home/current/solutions/v3672136

Fix problem detecting a file or program as a threat even after you exclude it from scan
https://support.norton.com/sp/en/us/home/current/solutions/v115455517

Configure Exclusions/Low Risks settings
https://support.norton.com/sp/en/us/norton-360/home/solutions/v15457075

Exclude files with low-risk signatures from Norton scans
https://support.norton.com/sp/en/us/home/current/solutions/v15463085

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:57AM · Edited: 06-Jul-2022 | 9:50AM · Permalink

Curious, are you running QPI 1.5? or 1.1?

​​​​https://www.quiltpatternindexer.com/download.html
Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 8:59AM · Permalink

Yes.

File Attachment: 
PDF icon Data Protector Pop Up Screen.pdf
Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:05AM · Permalink

1.5, which I've been running for several years.  I think I have fixed it.  By clicking on Exclude Process button, it placed my entire QPI exe file in the exclusions section, for Data Protector to just ignore the app all together.

File Attachment: 
PDF icon Exclusion Screen.pdf
Accepted Solution
Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:06AM · Permalink

"Exclude Process" adds that process to processes excluded from Data Protector.
Presumably "quiltpatternindexer.exe" 

"Exclude Process" is reversable.  

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:06AM · Edited: 06-Jul-2022 | 9:08AM · Permalink

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:16AM · Edited: 06-Jul-2022 | 9:47AM · Permalink

FWIW ~ as test: 

Filename: qpisetup1.5.exe
Full Path: C:\Users\bjm\Desktop\qpisetup1.5.exe

Developers 
MK Quilts LLC

Identified 
7/6/2022 at 11:56:35 AM

Few Users
Fewer than 100 users in the Norton Community have used this file.

Mature
This file was released 1 year 10 months ago.

Good
Norton has given this file a favorable rating.

Source File:
qpisetup1.5.exe

File Thumbprint - SHA:
b6f45061c905072279110de1573e78e59a4f717a4656c96402975f3aa3587c4d
File Thumbprint - MD5:
0360dfffda3c33d987ac210df8161ab4


Smart Screen objects to 1.5 setup file
and Norton objects to QuiltPatternIndexer.exe

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:24AM · Permalink

Yup, did this quite a while ago, when I first purchased QPI.  Which is why I was so perplexed as to why, all of a sudden today, Norton Data Protector decided to block my using the program when I executed a search.  I have sent Norton and email asking them to please add QPI to their white list as well.

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:28AM · Edited: 06-Jul-2022 | 9:48AM · Permalink

Filename: QuiltPatternIndexer.exe
Full Path: C:\Users\bjm\Desktop\QuiltPatternIndexer.exe

Version 
1.5.0.0

Identified 
7/6/2022 at 12:25:11 PM

Few Users
Fewer than 100 users in the Norton Community have used this file.

Mature
This file was released 1 year 10 months ago.

Good
Norton has given this file a favorable rating.

Source File:
QuiltPatternIndexer.exe

File Thumbprint - SHA:
ee32c2f21377d22bd24646358abee15484f7b3050fb5f1cf554c6bd85c80c777
File Thumbprint - MD5:
8c258bd5cde600fbfc60e7b93fcf0c2a

@hoosierquilt

QuiltPatternIndexer.exe does not appear to be signed.

Maybe, Norton Firewall Alert - Quilt Pattern Indexer does not have a valid digital signature is related to your Data Protector block event.  IDK  
Sorry, I'm not familiar with QPI. 

Kudos0

Re: Data Protector - Blocked Suspicious Action

Posted: 06-Jul-2022 | 9:41AM · Permalink

FWIW ~ the 1.5 setup file appears signed - not countersigned

This thread is closed from further comment. Please visit the forum to start a new thread.