Norton should be more responsive to new threats

I think it's called "Rapid Release" on the Symantec/Broadcom side for SEP clients. I do know there is information sharing, such as threats between these 2 companies (Norton/Symantec), I'm unaware of what happens behind the curtain @ Norton and if they have some sort of "Rapid Release" for Norton clients.  Would love to know more though.

If anyone finds out, please post.

"Total Cloud Protection requires the Insight feature to be enabled and may have limited or different detection names on older support versions of SEP "

Insight feature is the Reputation Lookup. Often this is done by Proxy, and generally works well to get a reputation on a file before it is actually written fully to disk.

I do know that one issue that SEP has, dealing with reputation, is that once a verdict is reached on a file, the SEP client stores the results away, and even if the reputation of a file has changed, the SEP client will not ask again. The work around is a cleanwipe OR there is a way to reset the local reputation by API call if you know how to do so.

For the OP, if you get another issue like this, consider completely re-installing the client, to see if you get a different result. I don't know enough about Norton, and how it works compared to SEP since the breakup of the to companies.

Vitalik93:

+1 vote from me. Norton Cloud should work better. Kaspersky cloud detection is a good example here for NortonLifeLock.

R U comparing Norton retail real-time detection vs. Kaspersky retail real-time detection?
R U comparing Norton retail on-demand scan detection vs. Kaspersky retail on-demand detection?
You have machine/s running Norton and machine/s running Kasperky? 

What are you calling "Norton Cloud"?

Okay.  I'm still curious what you guys mean by "Norton Cloud"?

Maybe, you want NortonLifeLock Submission Portal < https://submit.norton.com/ > to respond faster, be more responsive and transparent, to users submissions? 

Why comment about Symantec, Kaspersky, other....with NortonLifeLock Community.

Norton offers specialized protection that helps in keeping you and your devices safe. Your PC is protected from viruses, online threats, identity theft and financial scams. 

• Total Cloud Protection - a feature that scans your PC directly using cloud-based virus definitions.

• Static Data Scanner (SDS) - These user-mode modules enable an enhanced security model, improved protection efficacy, and better resource management.

https://support.norton.com/sp/en/us/norton-security/current/solutions/v111382660 - 2020

Introducing Symantec Data Scanner (SDS) Technology 

Norton Security provides its protection in two modes: kernel and user modes (more info).

In kernel mode, Norton Security provides real-time protection by monitoring the activities of all running processes; and performs various security checks on calls made by applications running in user mode. Our antivirus engine running in kernel mode ensures that malicious codes are not making unauthorized modifications to the key areas of OS and user environment. This ensures threats like rootkits are blocked; and infected files are not getting onto the system.  In user mode, Norton Security performs the analysis of memory access and ensures safe execution of applications running in the system. The protection in user mode prevents advanced threats from executing malicious CPU instructions and making memory modifications.

Norton Security PC client v22.7 introduces our next generation antivirus engine featuring Symantec Data Scanner (SDS) technology as well as a newly architected real-time protection system (Auto-Protect). SDS is a user mode only solution targeting modern platforms and products. With the introduction of SDS all file scans will execute in user mode, providing improved security and better resource management.  Beyond improved security, SDS also delivers refined detection technology that enables our Response Ops team to detect threats sooner.

The new engine can monitor the activities of processes and file IOs in kernel mode and scan in user mode without trading off performance of the system. Scanning in user mode provides additional flexibility by removing memory limitations in kernel mode. This also supports other enhancements included in this release such as our enhanced emulator. Moreover, it allows flexibility to develop features that are not possible to do in kernel. Furthermore, SDS can expand the security checkpoints in-memory access by malicious processes and perform more sophisticated repairs under certain conditions.

https://community.norton.com/en/blogs/product-update-announcements/introducing-symantec-data-scanner-sds-technology - 2016

Auto-Protect is the first line of defense against threats by providing real-time protection for your computer. Whenever you access, copy, save, move, open or close a file, Auto-Protect scans the file to ensure that a threat has not attached itself. By default, it loads when you start your computer to guard against threats and security risks. It also monitors your computer for any activity that might indicate the presence of a threat or security risk. Auto-Protect can determine a file's type even when a threat changes the file's extension.

When a threat, threat-like activity (an event that could be the work of a threat), or a security risk is detected, Auto-Protect alerts and takes the necessary steps to either clean, quarantine, delete or leave alone (log only) the detection of a threat depending upon the actions configured for each detection type.

Whenever you access, copy, save, move, open, or close a file, Auto-Protect scans it to ensure that a threat or security risk is not present.

A Full System Scan will detect viruses and security risks by examining all files and processes (or a subset of files and processes). A Full System Scan can also scan memory and load points.  (Note, though, that no AV product can detect threats which exist only in memory and are not written to the disk.)

Note: Auto-Protect does not scan inside compressed files due to the amount of time required to uncompress the container file and scan each file.  A Full System Scan will scan inside compressed files.