Solved.
Kudos12 Stats

Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 1:18AM · Edited: 31-Dec-2020 | 1:33AM · 60 Replies ·

I have 6 machines in my office and some of the programs I use produce false intrusion signatures. This has not been a problem until recently when I have been able to disable the Intrusion Signatures that have been causing my an issue. However now on 4 of the 6 machines whenever I disable an Intrusion Signature it re-enables itself immediately after I close the Intrusion Signature window. On the 2 of the machines I am able to disable a Intrusion Signature and it stays disabled.

All the machines are running latest Windows 10 Pro and latest Norton 360 and are up to date. This problem has become so frustrating I have just about had it with Norton after 20 years. I have already done the support chat and they had no clue. Uninstalling and Reinstalling makes no difference.

Really at my wits end here - there is something seriously wrong with this product now. Any ideas on what to do about this. Any user should absolutely be able to disable any Intrusion Signature as they wish, and it should not re-enable until I the user re-enable it. I should not have to completely disable Intrusion Protection to use my machines.

Labels: Intrusion Prevention, Norton 360, LiveUpdate
Accepted Solution
Kudos0 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 01-Apr-2021 | 9:09AM · Edited: 01-Apr-2021 | 9:10AM · Permalink

Good news everyone. The patch has rolled to the Public. Run Live Update if you have not seen it yet.

I have tested on several machines and it does appear the problem that has plagued us for over a year HAS BEEN FIXED.

Thanks to everyone who helped in moving this along and commented on this thread.

This issue is closed.

View Accepted Solution in Context

Replies

Kudos3 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 3:49AM · Edited: 31-Dec-2020 | 4:16AM · Permalink

Okay.....appears I can reproduce my side.

1) as test. I opt Disable All + Apply + OK.  All Signature ID Active boxes disable and Notify Me boxes grey.  
Re-opening Intrusion Signatures window....all boxes are enabled.  
2) as test.  I disable Active for Signature ID 11113 + Apply + OK. 
Re-opening Intrusion Signatures window....11113 is enabled.

So, disable Active Signature IDs does not survive re-opening Signatures window

head scratch?

3) as test. I disable Notify Me for Signature ID 11113 + Apply + OK.
Re-opening Intrusion Signatures window....11113 Notify Me remains disabled. 

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 4:14AM · Edited: 31-Dec-2020 | 4:16AM · Permalink

Yes using that particular signature id 11113 - first one in the list. If I deactivate and close the window and reopen it is activated again. The notify check box does work correctly however it is the Active box that does not work as a result connections get blocked. 

The odd thing is that of the 2 of my 6 machines I AM able to deactivate the signature. This is completely bizarre behavior. It is a signature that is detecting a secure logon that is occurring and blocking rendering the machine useless. This problem of not being able to disable any signatures on some machines is fairly recent.

Glad it is not just me.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 4:19AM · Edited: 31-Dec-2020 | 4:29AM · Permalink

We'll try to call attention to your Topic. 

It is a signature that is detecting a secure logon that is occurring

@allknowingeye
Can you share "secure logon" page?  

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 6:09AM · Edited: 31-Dec-2020 | 6:15AM · Permalink

adding: Intrusion Auto-Block Off + Apply + OK ....does not survive.

@allknowingeye
something feels amiss with Intrusion Auto-Block and Intrusion Signatures > Configure ....my side

Norton 360
22.20.5.39
Windows 10 Home
19041.1.amd64fre.vb_release.191206-1406
Norton Autofix Results: 0 item(s)
 

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 9:30AM · Edited: 31-Dec-2020 | 9:37AM · Permalink

Also adding domains to the exclusion does not work either - the exclusion is ignored for all intrusion signatures. All of this worked a few months ago, and was made worse with the Dec.31 signature additions.

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 9:33AM · Permalink

Not really, nothing to share, it's a TLS logon request with the return of a key that is being blocked by the latest Dec.31 Signatures. But this problem started months ago with the basic functionality. The individual signature is not the issue, none of them can be disabled by themselves with the Active box.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 9:36AM · Permalink

Yes something is definitely amiss. It is like the product is overriding your decisions and trying to protect itself.

M5 is that you in there?

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 9:42AM · Edited: 31-Dec-2020 | 10:40AM · Permalink

We'll try to call attention to reported issues re Intrusion Prevention -

btw ~ my spare machine behaves same as reported above - something feels amiss re Intrusion Auto-Block and Intrusion Signatures on my W10 Home 20H2 machines.

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 11:58AM · Permalink

I see the same behaviour on Windows 1904 machines and 20H2 machines so I don't think it's caused by a recent Windows feature change.

Kudos2 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Dec-2020 | 12:03PM · Permalink

Hopefully, after Holidays we'll hear from Norton

Kudos4 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 04-Jan-2021 | 5:42PM · Permalink

Just bought a 3080 GPU and trying to do some mining and I'm having the same issues. It will not allow me to deactivate intrusion signatures with the word Bitcoin in them, is about 15 of them. After I uncheck them all ,hit apply and okay and then come back and they're all back on again. Also intrusion autoblock will not turn off. So I just turn intrusion prevention completely off for good.
Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 04-Jan-2021 | 9:51PM · Edited: 04-Jan-2021 | 9:51PM · Permalink

We are trying to avoid disabling the feature outright, after all we paid for it. Up until a few months you could disable any intrusion signature you wanted, and that is the way it should be. There is an issue with the product.

Kudos2 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 04-Jan-2021 | 10:25PM · Permalink

Right! Makes no sense to turn off entire features. They need to correct it
Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 17-Jan-2021 | 5:50PM · Edited: 17-Jan-2021 | 5:51PM · Permalink

..................

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 24-Jan-2021 | 7:44PM · Permalink

-------------

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 24-Jan-2021 | 9:19PM · Permalink

Is the ------------- just to keep this alive. It certainly has not been fixed.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 25-Jan-2021 | 12:26AM · Edited: 25-Jan-2021 | 12:27AM · Permalink

allknowingeye:

Is the ------------- just to keep this alive. It certainly has not been fixed.

Yes, to keep this alive.  
Yes, has not been fixed. 

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 30-Jan-2021 | 10:13AM · Permalink

Jan 30 - Still no fix.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 30-Jan-2021 | 10:23AM · Permalink

Yes, still no fix.

I'll try to bump.  

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 30-Jan-2021 | 10:32AM · Permalink

NOTHING! I have everything turned off for GPU mining..hence paying for Norton and not using it
Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 30-Jan-2021 | 5:30PM · Permalink

Same issue here! Norton 360 v22.20.5.39

 Settings...Firewall... Intrusion and Browser Protection

- If you set Intrusion AutoBlock Off + Apply + OK <- the setting does not save

- If you uncheck to deactivate certain Intrusion Signatures + Apply + OK <- the setting does not save

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 30-Jan-2021 | 6:47PM · Permalink

Yes it is very frustrating. What's worse is that it is not consistent. I have 2 of my 6 machines where I can change them and the changes stick - all the same version of Norton.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Jan-2021 | 6:40AM · Permalink

I have not read this whole thread so I apologize if this has been talked about but have you tried shutting off  "Norton tamper protection" for awhile and then seeing if the changes stick?

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Jan-2021 | 3:13PM · Permalink

I have tried disabling everything in there. What do you mean by Tamper Protection - please be specific.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Jan-2021 | 3:28PM · Permalink

Open Device Security.

Settings.

Quick Controls.

Norton Tamper Protection.

I do not know if it would have any effect on your issue but I have had to shut off Norton Tamper Protection to delete some obsolete registry entries left over after several Norton installs. If I did not shut off Tamper Protection the entries would show back up immediately after I deleted. In fact I think they were never deleted because this software protected them.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Jan-2021 | 4:59PM · Permalink

No that is not it. I tried that previously and just reconfirmed it. There are several deeper similar settings as well that also make no difference. Support directed me to try a bunch of things and none of them had any impact.

So it is still broke.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 31-Jan-2021 | 5:15PM · Permalink

I hope you can find a resolution soon.

And if it is a programming bug then you will be spinning your wheels until some Norton programmer figures it out and makes the fix. At least they are aware of it .

Good Luck.

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 09-Feb-2021 | 6:19AM · Edited: 09-Feb-2021 | 6:22AM · Permalink

Just popping in to say that I'm facing this issue too. I'm trying to run NiceHash which is a Bitcoin miner, I'm unticking the boxes that say things like "system infected: activity 16" or something, after reopening intrusion signatures it ticks itself even though I don't want it to.

Had a chat with a Norton customer service, poor guy couldn't fix it either, really fustrating.

I've seen someone saying that clicking the "stop notifying me" button fixes it, it doesn't fix it for me, the checkmark box tick by itself again.

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 09-Feb-2021 | 9:23AM · Permalink

Yep that is exactly the issue. I have 6 machines running - on 4 of them this is the case, but on two of them it works correctly. All have the same latest versions of Windows and Norton so it's not even consistent. 6 months ago it worked fine, and has worked fine for years. 

I went through the online support route several times and it was just a big waste of time, not that they weren't trying but nothing they suggested worked. And that is why I opened this thread - there is something quite wrong with the product causing this issue.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 09-Feb-2021 | 11:09PM · Edited: 09-Feb-2021 | 11:11PM · Permalink

 FWIW ~ my understanding is that a ticket has been logged for this issue....with no timeline for fixes - 

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 14-Feb-2021 | 11:27AM · Permalink

Exactly!  For now, I am forced to keep Intrusion and Browser Protection disabled, because of this Norton issue...I cannot turn off Intrusion AutoBlock or enable all the "Intrusion Signatures" used by the crypto-mining program (NiceHash) and it's plugins.  I have excluded the "C:\Users\<username>\AppData\Local\Programs\NiceHash Miner" directory and it's subdirectories from Auto-Protect, Script Control, SONAR, Download Intelligence Dectection, and AntiVirus scans, and trusted all the EXEs under that directory in the Firewall settings... Program Control, so that mining will still work and I will still be protected by Anti-Virus and Firewall functionality. 

The only annoyance is that whenever I manually update NiceHash or any miner plugins get (I have all automatic updates disabled), I have to go back into Norton, in the Firewall settings... Program Control... and trust and allow the new EXEs for NiceHas or any of its mining plugins.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 14-Feb-2021 | 12:28PM · Permalink

It's best to disable all the antivirus and firewall stuff before you do an update or install and then turn it on afterwards. Though personally I leave everything off. all my antivirus and all my firewall all the time at this point. I have a ubiquiti security gateway anyways on my network for the firewall
Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 14-Feb-2021 | 9:59PM · Permalink

That has nothing to do with this issue. It is also somewhat foolish as you will have the protection active to keep something bad out. Router security while not completely useless is pretty close to just that.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 14-Feb-2021 | 10:14PM · Permalink

I agree, I have a pfsense firewall to keep all the bad stuff out. The way I look at it, using Norton Firewall and Program Control is not really about keeping something bad out, it is more about preventing a installed program from reaching out. For example, if there is a brand new virus or malware that AntiVirus does not catch yet, it installs without you knowledge, and it is trying to reach out to the Internet, Norton Firewall, via Program Control will block its access because it will not be trusted by default. You can also use Program Control in many different ways, and do things that you cannot do on a firewall between your home network and the Internet.
Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 16-Feb-2021 | 8:43AM · Permalink

With respect Please keep this on topic which is the serious product defect related to the disabling of individual Intrusion Signatures. 

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 16-Feb-2021 | 5:04PM · Permalink

Same problem here,

Very frustrating.... i used to have a different antivurs (Comodo internet suite) and everything was fine, now i changed to norton and i can't do what i want, i do understand that the software is trying to protect me from potential attacks but this software is well known and is not a malware.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 19-Feb-2021 | 4:55PM · Permalink

20.02 and I also still have the problem.

I can turn off the entire "Intrusion Signatures" feature but just making enabling some of them in the "Configure" does not work. It just does not save. Kinda bummer that we have to turn off the entire feature even tho the functionality to whitelist some of the signatures IS there and worked. 2 months of NO support or fix in sight is kinda sad. If I'll have to turn off entire blocks of Norton protection it might be better to just not use it entirely, why pay for something that I have to turn off? 300 PLN (81 USD) per year is not little for broken product :/

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 19-Feb-2021 | 5:12PM · Permalink

I have been with Norton since Peter owned it about 15 years ago, I'm so fed up with it I have uninstalled it and requested a one year refund. I was loyal even though there's other products just as good maybe even better but now I'm done
Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 19-Feb-2021 | 5:46PM · Edited: 19-Feb-2021 | 5:47PM · Permalink

I here you Michael. I have 10 licenses and I am quite tired of all the hoops you have to jump through with this product. I am giving them a chance to fix what is a seriously defective product, if they can't do it or don't give a crap about this issue then I will dump all 10 licenses. So far I am giving them a chance but there really hasn't been anything said except what has come from more senior forum members. I haven't yet discussed this with my thousands of blog readers but I will have to if it comes to point of having to dump it.

I believe the computer function that is running afoul of the Intrusion Detection engine is the SSL/TLS Secure Logon Handshake sequence. This is used in a lot of functions, a number of people have mentioned they are miners on this thread, and the SSL/TLS handshake sequence is used to connect to a lot of pools. If you use a different method you may find some temporary relief to this issue possibly.

Kudos2 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 24-Feb-2021 | 2:38PM · Edited: 24-Feb-2021 | 2:40PM · Permalink

So it looks like one of these issues has been corrected with today's update v 22.21.1.151.  You can now go to Settings...Firewall...Intrusion and Browser Protection... and if you turn Intrusion Prevention on you can go to Intrusion AutoBlock and turn AutoBlock off (and save it, and it will remain off), BUT, being able to deactivate certain Intrusion Signatures is still a problem! (so if this is the functionality you are waiting for like the rest of us, you still cannot leave Intrusion Prevention on). 

Kudos3 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 27-Feb-2021 | 7:01AM · Permalink

Chiming in as another Norton user experiencing intrusion signature configurations resetting after deactivation. Like many users I am trying to mine through NiceHash. Hard to believe this has not been fixed for 2+ months. Seems like a fundamental feature of the software .

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 04-Mar-2021 | 8:52PM · Permalink

Having the same issue, specifically with NiceHash as well. I had an agent try and help with LogMeIn and he didn't really know what to do lol, he said he will "escalate to support level two to help with the issue" I'm not sure what that means but I hope it'll help lol. 

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 04-Mar-2021 | 10:08PM · Permalink

This has been going on for lot longer than 2 months. I began seeing the issue over 6 months ago. But it is inconsistent, of 6 machines I am actively running, all on the latest versions of Norton and Windows I have two were it works ok, and 4 where it does not. The two where it works ok were  originally installed over 4 year ago, so I think there is something in hidden registry settings causing this problem. And yes it is completely unacceptable the Norton has done squat about this. I have therefore put all new purchase of Norton Products in my entire company on hold until this problem is solved. We must be able to count software working as specified or we ban it, it is that simple, this is a waste of people's time fooling around with this.

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 04-Mar-2021 | 10:12PM · Permalink

It didn't help when they told me the same thing last summer. So I gave up on support and opened this thread cause they told me I was the only having the problem, and that is clearly not the case. However as I believe it is TLS secure logon that is running afoul of the intrusion signatures and many regular users never use that so many will never see this very obvious critical flaw in this product. TLS is used for many things, secure logins, and mining are two. It is shameful they have not fixed this yet.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 05-Mar-2021 | 9:33AM · Permalink

Same lol. I wanna use Nicehash but I'm unable to because of Norton. I've been going back and forth with Norton support, I got in touch with level 2 support and they took the Norton logs and they've escalated to Level 3 engineering team, I was told I'd get a callback within 48 hrs but didn't so I contacted again and they said they'll contact when they figure out the solution or something. We could be here a while lol. As others have mentioned this issue is only on my gaming PC, this issue doesn't occur on my laptop and my dad's laptop running on the same Norton version number.
Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 06-Mar-2021 | 2:20AM · Permalink

Found this thread which is TWO MONTHS old now. And still not resolved! Does Norton even read these?

I am trying to deactivate an Intrusion Signature ID. After unchecking the active block, clicking "Apply". Then searching for it again, it still shows "Active".

The deactivate function for Intrusion Signatures is NOT working.

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 11-Mar-2021 | 8:44AM · Permalink

I am having the same problem. Norton support needs to take a hold of this urgently or we may have to address to consumer protection authorities here in the EU. And you know what happened to apple that tried to tackle over stuff like that in the EU...

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 15-Mar-2021 | 1:57PM · Permalink

Hi All,

I have the same problem as discussed, I have tried to disable the signatures which block the nicehash program but they just reactivate themselves. I can however get it all working if I just turn off Settings>Intrusion and Browser... >Intrusion Prevention, start the mining and then turn it back on again everything is fine. It's not a solution but at least Norton is happy while my PC is mining away. 

Hope we get a proper solution soon, but I've got a comfortable workaround for now.

Kudos0

Re: Intrusion Signatures not able to be disabled.

Posted: 17-Mar-2021 | 6:49PM · Permalink

I have a similar issue. I want to deactivate one of the signatures to allow a program to send its traffic, but when i deactivate and close the window, i come back to check the signature and it is reactivated. I can momentarily just disable Intrusion Prevention and my application will start working, I then turn Intrusion Prevention back on and I am running OK, but i will get notifications for the signature being violated every few seconds. I can turn the notices off, but they still get logged in the Recent history every couple seconds. Deactivating Intrusion Prevention rules did work fine for me a week or so ago, then just suddenly in the last few days it no longer lets me turn them off. I did a reinstall of the Norton 360 with the Norton Remover and Reinstall application and I still get the same behavior. Really super annoying

Kudos1 Stats

Re: Intrusion Signatures not able to be disabled.

Posted: 24-Mar-2021 | 1:21AM · Permalink

24th March 2021 and still nothing from Norton.

I thought I was going mad and not disabling the right signatures until I read this thread. Such basic functionality not working is pathetic. 

This thread is closed from further comment. Please visit the forum to start a new thread.