• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Norton Insight and Vista SP2

I downloaded and installed the latest service pack for Vista. I then ran Norton Insight and it said 55% of files trusted 45% need scan. When I had Vista SP1 Insight said 98% trusted and 2% need scan. I attributed this difference to the probability that SP2 installed some files that Norton Insight does not yet recognize as trusted. I then ran a full scan with NAV 2009 fully expecting that the scan would be slower because Insight recognizes far fewer files as trusted in SP2. I was therefore surprised when the scan completed in almost exactly the same amount of time that it did in SP1, 22 minutes on a 500 GB hard drive. Obviously I have no complaints about the scan time, 22 minutes is excellent. My question is why did'nt the discrepancy in Norton Insight make any difference? My understanding of Insight was that more files trusted = faster scans, less files trusted = slower scans. Has anyone else noticed this after installing Vista SP2?

Replies

Kudos0

Re: Norton Insight and Vista SP2

I downloaded and installed the latest service pack for Vista. I then ran Norton Insight and it said 55% of files trusted 45% need scan. When I had Vista SP1 Insight said 98% trusted and 2% need scan. I attributed this difference to the probability that SP2 installed some files that Norton Insight does not yet recognize as trusted. I then ran a full scan with NAV 2009 fully expecting that the scan would be slower because Insight recognizes far fewer files as trusted in SP2. I was therefore surprised when the scan completed in almost exactly the same amount of time that it did in SP1, 22 minutes on a 500 GB hard drive. Obviously I have no complaints about the scan time, 22 minutes is excellent. My question is why did'nt the discrepancy in Norton Insight make any difference? My understanding of Insight was that more files trusted = faster scans, less files trusted = slower scans. Has anyone else noticed this after installing Vista SP2?
Kudos0

Re: Norton Insight and Vista SP2

Insight only rates what files and processes are running in memory.  These are the files that will not need to be scanned again initially.  Usually, one would have about 5 ~ 10K files in memory.  This will let Norton react very fast to scanning the memory processes but for scanning the files on the hard drive will actually have a lesser affect.
Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Norton Insight and Vista SP2

I just checked and have trusted 48% scan needed 52% lol didn't do a full scan yet
----------------------------------NIS 20.2.1.22Windows 7 64bit
Kudos0

Re: Norton Insight and Vista SP2

Hi dbrisendine -

Could you please clarify your post a bit?

I don't quite understand the memory part - I thought that Insight looks at your HD.

TIA

CompumindNIS 2009, XP-SP3, Vista-SP2, IE 8
Kudos0

Re: Norton Insight and Vista SP2

Presently, Insight scans the files and processes loaded and running in memory at the time the Insight scan runs.  It then calculates the SHA256 hash values for each object, compares this to a Insight backend database (via a secure connection to Symantec) and records the Trust level of each object in a encrypted file on the user's local system.  Typical levels for now are Norton Trusted (meaning the file has been analyzed by Norton and found to be perfectly safe) and Community Trusted (meaning the file has been found on so many Community Watch systems that are virus free and clean running).  Any scans on the user system after Insight has assigned the Trust levels (and the parameters are correct for this) will not scan the files that are Trusted as long as 1) still listed as Trusted and 2) the SHA256 hash value for the files remains the same as when the file was rated.  This scans also include the Auto-Protect scanning of every file as it is accessed.  Processes in memory are constantly being accessed so this process reduces the load on the system by Norton as it protects and scans every file when accessed.

This is sometimes confused with the "scanned" local Trust that Norton makes as it scans a hard drive for files not in the Insight Trusted database.  If the files are found clean, there is a temporary SHA256 value and a local Trust level assigned.  If the user scans the files again and the 1) files has not changed (so the SHA256 hash value is the same) and 2) the virus definitions have not cycled through a Full Update (not Pulse Update but a Automatic Live Update or a manual Full Update where you see the Virus Definitions have been updated) then the file will keep its temporary local Trust value and scanning will skip that file.  This is how the scanning speed on Norton 2009 products have been increased so dramatically and still have high level of protection with a low level of system resource impact.

Also, Compumind see this post in your thread from yesterday which describes some of the workings on the Symantec side (server) of this: http://community.norton.com/norton/board/message?board.id=nis_feedback&view=by_date_ascending&message.id=53284#M53284 

And this is the full article: 

http://community.norton.com/t5/Norton-Protection-Blog/Norton-Insight-A-solution-to-performance-improvement-without/ba-p/20642#A190

Message Edited by dbrisendine on 05-27-2009 09:49 AM
Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Norton Insight and Vista SP2

Hi dbrisendine -

Yes, I read that great article and understand the general mechanics. Thanks.

However, I am a bit perplexed on the methods that Insight uses, based on the initial post above.

There is such a discrepancy compared to the pre-SP2 *trust* levels.

How can it be accounted for?

Message Edited by Compumind on 05-27-2009 10:02 AM
CompumindNIS 2009, XP-SP3, Vista-SP2, IE 8
Kudos0

Re: Norton Insight and Vista SP2

The loaded process files are all new (SP2 changed them) so the SHA256 hash values do not match the Insight database values.  The lower values result in Insight doing what it is supposed to.  In a few weeks, after many new Community Watch submissions of the new SP2 files, this will return to the higher values.  Again, just as stated, Insight doing the work it is here for.
Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: Norton Insight and Vista SP2

Hi dbrisendine -

Got it.

Thanks.

CompumindNIS 2009, XP-SP3, Vista-SP2, IE 8
Kudos3 Stats

Re: Norton Insight and Vista SP2

Unfortunately, I've seen this common mis-understanding of Norton Insight frequently in this forum and this thread seems like as good a place as any to make some clarifications.

Norton Insight ratings apply to all "files of interest" on a system. The definition of "files of interest" is complex and I won't go into it here but suffice it to say that these are file types that are likely to hide malware. Some time after performing a full system scan, all of the files of interest should have some sort of Insight rating, even it is untrusted. Other scans will cause files to be rated but a full system scan ensures that all files get rated.

Where the common confusion comes in is the 2009 product's Norton Insight user interface. That display only concerns the processes that  are currently running. Have a high trust value in this UI means that quick scans are likely to run quickly but doesn't give much information about how it will affect a full system scan's performance. Currently, even though the information is stored on a system and used by the product, there is not a way to find out how many files on a drive are trusted or not.

The reason why scan time for the original post didn't change significantly is probably due to the comparatively small number of files that changed in SP2 relative to the overall number of untrusted files on the entire drive.

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Norton Insight and Vista SP2

Hi Reese -

Thank you for your clarifications.

Will the Norton Insight user interface logic be updated to display a more realistic percentage of what is trusted on a system (i.e. Processes and Files resident on the HD?)

 

CompumindNIS 2009, XP-SP3, Vista-SP2, IE 8
Kudos0

Re: Norton Insight and Vista SP2


Compumind wrote:

Will the Norton Insight user interface logic be updated to display a more realistic percentage of what is trusted on a system (i.e. Processes and Files resident on the HD?)


I can't comment on what will or won't be in future releases or even if there will be a future release but I have brought this issue up to the responsible team quite a while ago and they were already aware of the issue and confusion.

Message Edited by reese_anschultz on 05-28-2009 09:14 AM
Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Norton Insight and Vista SP2

maybe or maybe not in the next beta for version 2010 ?
"All that we are is the result of what we have thought"

This thread is closed from further comment. Please visit the forum to start a new thread.