This forum thread needs a solution.
Kudos0

Norton Mobile's conflicting results

Posted: 14-Dec-2018 | 7:34AM · 31 Replies ·

Norton Mobile on my smart phone began to exhibit a strange behavior; it shows the message "Ransomeware detected", then a few minutes later i runs an automatic scan and shows the message "No Malicious software detected". Which of these should I take seriously? How can Norton display two conflicting results ? Should I worry or not? I would appreciate it very much if someone explains this behavior and what to do resolve this issue, if it is indeed a serious  matter.

Replies

Kudos1 Stats

Re: Norton Mobile's conflicting results

Posted: 14-Dec-2018 | 8:47AM · Permalink

Are you using the internet when this pops up? It is possible that NMS is catching some ransomware on a site you are visiting and is blocking it. Then a scan done will show no results as it never got to your device.

Can you grab a screenshot of the ransomeware message and post it here.   

Instructions to post screenshots can be found here
https://community.norton.com/forums/how-post-image-forums-0

Also check the Activity Log in NMS to see what is reported. Tap on the three bars at the top left of the NMS screen and tap on Activity Log.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 15-Dec-2018 | 4:23AM · Permalink

Yes, there was a Web site I logged on to in Chrome,which refused to close despite my repeated taps on X, so much so that I had to restart my phone. There was no ransomeware warning in the Activity Log. Now the warning ceased to come on screen so I assume that the site in Chrome was indeed malicious. Since restart I haven't seen ransomeware warnings on the screen. 

Thank your for your remarks. If I encounter a similar situation I will try to grab the screenshot, if I can.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 15-Dec-2018 | 4:50AM · Permalink

I had a "randsomeware detected" message appear as the newly updated NMS started on my Samsung tablet. Message appeared on top line of screen, for a short period. Nothing in the log. I ran a scan and nothing is detected. It appeared again just after reboot, and a supsequent reboot, but nothing since. Repeated scans find nothing and again nothing in the log.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 15-Dec-2018 | 9:14AM · Permalink

I had exactly the same situation with my Samsung tablet. It only shows up when rebooted for a couple of seconds then disappears, nothing shows on the scan or the activity log.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 15-Dec-2018 | 10:23PM · Permalink

Same here. NMS is reporting no malware followed by ransomware detected but no record in the log. I believe it's something to do with version 4.4 as it only started happening after the upgrade. I can't screenshot as the ransonware report only appears on screen momentarily. My mobile system functions as expected with no signs of a ransomware attack
Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 6:31AM · Permalink

Can anyone remember the web sites they were visiting when these messages popped up? Please break up any link you post with spaces between dot and com.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 9:36AM · Permalink

No website is being accessed, it happens just as the tablet completes its startup process.

This started happening as soon as updating to NMS 4.4.0.4300

The message briefly appears on the top status line, to be replaced by "Norton Mobile Security", which also then disappears.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 10:10AM · Permalink

I understand this appears briefly, but can you try to grab a screenshot of the message. Have your fingers at the ready as the device starts up in case you can get the message to appear again.

If it has stopped, I would suggest that whatever had been detected has been removed.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 10:15AM · Permalink

I keep gett ing the same ransomeware detected warning once in a while,followed by no malware report, nothing in the activity log. I wasn't connected to any web site when the warning showed up at the top line of screen, so I assume that the cause lies with the latest update, if Norton agrees.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 11:48AM · Permalink

It's impossible to get a screenshot as the message isn't there long enough - only about a second. As others have reported it is on start up so no websites are being visited.  It seems strange that there are a few of us getting the same, & probably more people who are not members of the Norton Community. 

Are all these instances only on Samsung devices - could this be a common denominator?

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 11:59AM · Permalink

Hi Linda,

My phone is ZTE, not Samsung, so I don't think the issue is limited to Samsung. I wonder why Norton hasn't stepped in since quite a few of us have reported the incident. I also believe that it has to do with the latest upgrade

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 4:47PM · Permalink

Have any of you recently received an update to your devices to Android 8?  I have a Samsung Tab A that just got updated to Android 8.1 with NMS ver 4.4.0.4300 and I am not seeing this message. If you do not yet have NMS v 4.4.0.4300, please keep trying as it is being released in a phased manner. See the product announcement here. 

Do you have a PIN set up to access your device? I do.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 16-Dec-2018 | 8:01PM · Edited: 16-Dec-2018 | 8:04PM · Permalink

I'm getting this on a Lenovo tablet (Android 5.0.1, NMS 4.4.0.4300), but it appears at every startup even when it isn't connected to the internet (wifi off, in airplane mode, and no wifi access point in sight).

Nothing in the activitiy log and subsequent scans with both NMS and Malwarebytes come up clean.

Then when I immediately restart the tablet, the whole cycle repeats.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 17-Dec-2018 | 6:22AM · Permalink

Those that are still seeing this message displayed.

First thing to check is the actual wording of the message. Could it be saying you need to turn on the setting for Ransomware detection? Open the NMS app and tap the three bars at top left. Tap on App Settings and then scroll down to Scans section and check that the Ransomware Recovery setting is turned on. 

If that is not the issue, go into the NMS app and tap on the three bars at the top left. Tap on App Settings, and scroll down to Logging section and turn on Enable Debug Log. Then close all apps and restart your device to re create the message. When the message has been created, Go back to the Logging section again and tap on Send Error Report With Log Files. That will send logs to the NMS team for analysis. 

Kudos0

Re: Norton Mobile's conflicting results

Posted: 17-Dec-2018 | 7:10AM · Edited: 17-Dec-2018 | 7:11AM · Permalink

Same problem here, as I'm not familiar with how this forum works, I'll wait for the next update

Kudos0

Re: Norton Mobile's conflicting results

Posted: 17-Dec-2018 | 7:35AM · Permalink

Same thing happens after turning debug on. No reported ransonware attack exists in the log. This problem only started after the recent NMS update. Sometimes this reported detection occurs in isolation but usually after no malware is reported in a scan.
Kudos0

Re: Norton Mobile's conflicting results

Posted: 17-Dec-2018 | 11:14AM · Permalink

Same thing happens after turning debug on.

The debug setting is not supposed to fix the issue. It just records extra debug logs that you then send to Norton for examination. These are logs that users cannot access, not the Activity log.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 3:38AM · Permalink

On my Galaxy A7 NMS displays a notice from the very top notification bar (where the clock is) "ransomware detected". This notice drops from the notification area with the NMS icon in front of it. When I pull down that notification bar (like when receiving email), there is no notice displayed. Opening NMS shows no issues, and a scan shows everything is ok. Installed another AV scanner and malwarebytes and ran a scan and they scanned ok. Any way to identify what is causing the notice?
Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 5:20AM · Permalink

Here are some screenshots:

Got this when viewing NMS activity log:

Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 5:27AM · Edited: 18-Dec-2018 | 5:28AM · Permalink

I am having the same issue. Found this after I created a thread: Norton Mobile Secutity ransomware detected.

I was able to screenshot it:

Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 2:27PM · Permalink

Browndwz

Thanks for the screenshot. Can you submit debug logs as I described above? 

Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 2:39PM · Edited: 18-Dec-2018 | 2:41PM · Permalink

To all

I have asked my Norton contacts to look into this thread. 

We also have to be ready to believe that there was actually some real malware that was detected and removed by NMS.  I have asked if this is the case, if it should be showing up in the Activity log.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 3:41PM · Permalink

peterweb:

Browndwz

Thanks for the screenshot. Can you submit debug logs as I described above? 

Using NMS 4.4.0.4300 - There is no setting in the app settings for a debug log.

I regularly install Malwarebytes and run scans.  I have not seen this notification till the last NMS update was installed.

Device: Galaxy A7, android 5.0.2 (NMS 4.4.0.4300)

My tablet running android 4.1.1 (NMS 4.4.0.4300) does not show this notification.

I also get the notification when in NMS:

Kudos0

Re: Norton Mobile's conflicting results

Posted: 18-Dec-2018 | 4:36PM · Permalink

Using NMS 4.4.0.4300 - There is no setting in the app settings for a debug log.

It does show up on my tablet. You need to scroll down near the bottom of the App Settings screen.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 19-Dec-2018 | 7:59AM · Permalink

I am now having the notification RANSOMEWARE DECTECTED on my tablet and now returned on my phone.

Kudos2 Stats

Re: Norton Mobile's conflicting results

Posted: 20-Dec-2018 | 8:56AM · Permalink

Hi Everyone,

Thanks for reporting this issue in Norton Community Forums. We are aware of the experience “Ransomware detection alerts/notifications in Norton Mobile Security on Android” and our team has identified the cause. We will update once we have more information on a fix.

Sunil_GA | Norton Community Administrator | NortonLifeLock
Kudos0

Re: Norton Mobile's conflicting results

Posted: 21-Dec-2018 | 10:53AM · Permalink

Received NMS update: 4.4.0.4302 - scanned, power off/on, restarted, scanned, opened several apps (all several times) and received No 'ransomware detected' notifications on this device.  The "No Malware Detected" was the only notification received.

Thanks Norton team.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 21-Dec-2018 | 12:41PM · Permalink

Thanks Norton - I've updated to 4.4.0.4302 & Ransomware alert has now disappeared.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 21-Dec-2018 | 7:00PM · Permalink

Thanks for reporting your positive results with this latest version of NMS.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 23-Dec-2018 | 2:33AM · Permalink

I have also upgraded to 4.4.0.4302 and the ransomeware message has stopped.

Kudos0

Re: Norton Mobile's conflicting results

Posted: 26-Dec-2018 | 8:18AM · Permalink

I had the same experience, using version 4.4.0.4300, except the notification icon (white X on red circle) wasn't readily identifiable as Norton. (But neither are other Norton push notification icons eg "Scanning...", "No malware detected" - identified as Norton by the drop-down messages.)

Norton seem to confirm, in a separate thread ( https://community.norton.com/en/forums/announcing-norton-mobile-security-4404302-android ), that this was a false alarm, which they have fixed with an update (version 4.4.0.4302). I have installed this, and the ransomware notification has gone.

This thread is closed from further comment. Please visit the forum to start a new thread.