• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos3 Stats

Is there a Bug in Safe Mode Scan?

My scan Preformance Profiles setting is set to: FULL SCAN.

I did a FULL SCAN in regular mode and the results were : No Threats Found.

I then did a FULL SCAN in Safe Mode with the following results:

"Top Safe Web Reviewer with over 23,000 Reviews."

Replies

Kudos0

Re: Is there a Bug in Safe Mode Scan?

My scan Preformance Profiles setting is set to: FULL SCAN.

I did a FULL SCAN in regular mode and the results were : No Threats Found.

I then did a FULL SCAN in Safe Mode with the following results:

"Top Safe Web Reviewer with over 23,000 Reviews."
Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?

Hi ProTruckDriver,

There is another thread where something like this was recently reported. Please see this thread. There is nothing official in terms of a bug regarding this. All known isssues affecting customers are listed in the post below.

http://community.norton.com/t5/Norton-Internet-Security-Norton/Known-Issues-with-NIS-19-1/m-p/533014

I'm doing some testing on my test laptop as we speak and will update this thread when I have some results to share.

Best wishes.

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos0

Re: Is there a Bug in Safe Mode Scan?

Similar results here. I have 8 detections in Safe mode. All detections are located in MSI files with 6 of these MSI files being located in the Factory Image partition. Scan comparison example below:

In Safe Mode:

Unresolved Threats:
Risks in compressed file "15421.msi"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\windows\installer\15421.msi] - Not Attempted

In Normal mode:

Scan Statistics:
  Scan Time: 1 seconds
  Scan Targets: C:\Windows\Installer\15421.msi
  Counts:
   Total items scanned: 48
   - Files & Directories: 48
   - Registry Entries: 0
   - Processes & Start-up Items: 0
   - Network & Browser Items: 0
   - Other: 0
   - Trusted Files: 0
   - Skipped Files: 0

   Total security risks detected: 0
   Total items resolved: 0
   Total items that require attention: 0

Resolved Threats:
No risks have been resolved

Unresolved Threats:
No unresolved risks

Kudos0

Re: Is there a Bug in Safe Mode Scan?

I picked up 5 detections during a SAFE mode scan, all in compressed files. I believe all of them were MSI's - I saved a screenshot of them and will check later.

I'm still running other scans. the NBRT scan just completed as I started writing this reply with NO detections.

My next scan will be SAFE mode with networking to see if this makes any difference.

More to follow.

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos2 Stats

Re: Is there a Bug in Safe Mode Scan?

Hello Everyone,

I can't look into this right now, but I can on Monday. Looks like there might be a problem, and I have a feeling scanning with networking on might make a deference. Please let us know AllenM if it does.

Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?

HI michaell,

The SAFE mode with networking appears to have made no difference.

SAFE mode both with and without networking detected 5 heuristic detections, all with MSI files. Now interestingly enough I just noticed that when viewing the details of those detections it actually only shows 3 detections depicted in the final screen. Five were shown as detected during the scan itself, all heuristic.

So to summarize: SAFE mode with and without networking indicated 5 detections, even though only 3 shown on the final screen. NBRT and NIS full scan under Normal mode showed NO detections.

Screenshot below.

Best wishes.

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos0

Re: Is there a Bug in Safe Mode Scan?

Hi ProTruckDriver,

I can say that this is not a bug. Safe Mode scan is most powerfull. In safe mode, only windows files will be loaded.

In normal mode, all files & services are loaded and if you are running a Full System scan there is a chance for getting some Heuristics to get skipped ( If the services are running ).

But in Safe mode, those services will not run and Norton will detect the same. 

RegardsSym_KeN
Kudos2 Stats

Re: Is there a Bug in Safe Mode Scan?


Sym_KeN wrote:

Hi ProTruckDriver,

I can say that this is not a bug. Safe Mode scan is most powerfull. In safe mode, only windows files will be loaded.

In normal mode, all files & services are loaded and if you are running a Full System scan there is a chance for getting some Heuristics to get skipped ( If the services are running ).

But in Safe mode, those services will not run and Norton will detect the same. 


NBRT also does not find any problems with these same MSI files.

I also do not recall NIS 2011 reporting these issues during a Safe mode scan but I can test this again on my test laptop tomorrow if desired.

Best wishes.

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos2 Stats

Re: Is there a Bug in Safe Mode Scan?

AllenM, could you do that? Would be interesting to see if there is a difference. I am still going to test it myself Monday to double check this.

Kudos0

Re: Is there a Bug in Safe Mode Scan?


michaell wrote:

AllenM, could you do that? Would be interesting to see if there is a difference. I am still going to test it myself Monday to double check this.


Hi michaell,

Sure, will do.

Thanks

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?

Same problem here! Safe mode scan finds several Heuristic Virus and ONLY in compressed files. NPE, NBRT, Normal Mode full scan and a checking by VirusTotal online find nothing.  Also a Normal Mode Custom Scan and a Reputation Custom Scan of the same files find nothing.

Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?

Same here. Did a normal full scan yesterday, nothing detected. Did a full scan in safe mode yesterday too, five items detected; However, all five of them were in perfectly ligitimate files, MSI's from Sun (ODF plugin for MS Word) for example and a couple of Lenovo system files downloaded by Lenovos updater, go figure. Doesn't need to mention I did not let them take care off...  Another one was in one of Mobile Masters files, which is a paid-for cell phone managing application. Since I don't use that anymore and it therefore was already uninstalled a couple of weeks ago, I manually removed the remnants of it, so they're gone.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

i experienced the same kind of results too

detected those files ending with .msi as virues

and i removed them cause i no longer in use.

i also not sure whether they are real virues or not

Kudos0

Re: Is there a Bug in Safe Mode Scan?

NIS12 Safe Mode Full Sys Scan

Does Aggressive Heuristic come into play ...are these FP because of Aggressive Scan Heuristic or should I Resolve all Unresolved Threats.   Or, go to bleeping.  

Scan Statistics:
  Scan Time: 2,512 seconds
  Scan Targets: Entire computer
  Counts:
   Total items scanned: 451,837
   - Files & Directories: 449,770
   - Registry Entries: 263
   - Processes & Start-up Items: 1,154
   - Network & Browser Items: 645
   - Other: 5
   - Trusted Files: 0
   - Skipped Files: 0

   Total security risks detected: 13
   Total items resolved: 0
   Total items that require attention: 13

Resolved Threats:
No risks have been resolved

Unresolved Threats:
Risks in compressed file "wiscddcbbf1270346bc938bbcc81a1eeaaa_4_35_0_1002.msi"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\program files\common files\wise installation wizard\wiscddcbbf1270346bc938bbcc81a1eeaaa_4_35_0_1002.msi] - Not Attempted


Risks in compressed file "hp active support library.msi"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\swsetup\sp41377\hp active support library.msi] - Not Attempted


Risks in compressed file "unhide.exe"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\users\bjms\desktop\programs\unhide.exe] - Not Attempted


Risks in compressed file "sp41119 hp total care advisor update 2009-03-16.exe"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\users\bjms\downloads\hp compaq\sp41119 hp total care advisor update 2009-03-16.exe] - Not Attempted


Risks in compressed file "488217f.msi"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 8 Files
[c:\windows\installer\488217f.msi] - Not Attempted


Risks in compressed file "60b5b6c.msi"
 Type: Compressed
 Risk: High (High Stealth, High Removal, High Performance, High Privacy) 
 Categories: Heuristic Virus
 Status: Not Attempted
 -----------
 1 File
[c:\windows\installer\60b5b6c.msi] - Not Attempted


 Category: Unresolved Security Risks
Date & Time,Risk,Activity,Status,Recommended Action,Path - Filename
2011-09-18 4:21:00,High,"Risks in compressed file \"60b5b6c.msi\" detected by Virus scanner",Attention Required,Remove this Security Risk now.,c:\windows\installer\60b5b6c.msi
2011-09-18 4:19:38,High,"Risks in compressed file \"488217f.msi\" detected by Virus scanner",Attention Required,Remove this Security Risk now.,c:\windows\installer\488217f.msi
2011-09-18 4:18:42,High,"Risks in compressed file \"sp41119 hp total care advisor update 2009-03-16.exe\" detected by Virus scanner",Attention Required,Remove this Security Risk now.,c:\users\bjms\downloads\hp compaq\sp41119 hp total care advisor update 2009-03-16.exe
2011-09-18 4:17:09,High,"Risks in compressed file \"unhide.exe\" detected by Virus scanner",Attention Required,Remove this Security Risk now.,c:\users\bjms\desktop\programs\unhide.exe
2011-09-18 4:14:37,High,"Risks in compressed file \"hp active support library.msi\" detected by Virus scanner",Attention Required,Remove this Security Risk now.,c:\swsetup\sp41377\hp active support library.msi
2011-09-18 4:04:57,High,"Risks in compressed file \"wiscddcbbf1270346bc938bbcc81a1eeaaa_4_35_0_1002.msi\" detected by Virus scanner",Attention Required,Remove this Security Risk now.,c:\program files\common files\wise installation wizard\wiscddcbbf1270346bc938bbcc81a1eeaaa_4_35_0_1002.msi




Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:

NIS12 Safe Mode Full Sys Scan

Does Aggressive Heuristic come into play ...are these FP because of Aggressive Scan Heuristic or should I Resolve all Unresolved Threats. 



I've scanned my files (those found infected by heuristic virus in Safe Full Scan) using Aggressive Heuristic mode in Custom Scan: No Virus Found. It happens only in Safe Mode Scan ed only with compressed files.

Kudos0

Re: Is there a Bug in Safe Mode Scan?


noghere wrote:

I've scanned my files (those found infected by heuristic virus in Safe Full Scan) using Aggressive Heuristic mode in Custom Scan: No Virus Found. It happens only in Safe Mode Scan ed only with compressed files.

Granted, and I've had the same results...

Aggressive Heuristic Full System / Full Profile Scans -- Normal Mode ~ 0 Threats

I was just wondering if by being in Safe Mode with fewer processes running.   Aggressive has the chance to be more thorough.  The same way a Safe Mode scan is likely to be more thorough than a Normal Mode scan just by virtue of the fact that there is less disk activity detracting from a thorough scan.   Hope, you understand what I'm trying to say.   I do notice... now that you pointed me to it.  That the threats are all Compressed files.    Have you moved your Unresolved to Quarantine and watched for smoke.   Or, are you thinking this is a False Positive anomaly solely caused by Safe Mode & all / certain compressed files.  Did the Safe Mode scan detect all my compressed files as threats or is there some commonality to my 13 detected threats / 6 Unresolved threats (one has an 8 count). 

Also ran NPE v 2.1 tool w/wo Rootkit  & NBRT v 4.1 Norton Advanced Recovery Scan with NPE Recovery Scan (set to scan inactive operating system)  ~  No threats found

So, either I leave em' in Unresolved or Quarantine em' and watch for smoke or Clear Entries or Run Quick Scan from Unresolved.

Or, wait for further Community posts.

Never had any Unresolved...so, this is kinda' interesting.  NOT!

Thanks, ProTruckDriver for posting Topic!

Kudos0

Re: Is there a Bug in Safe Mode Scan?


timboyboy wrote:

i experienced the same kind of results too

detected those files ending with .msi as virues

and i removed them cause i no longer in use.

i also not sure whether they are real virues or not


So, you moved the threats to Quarantine?

Kudos0

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:

 Or, are you thinking this is a False Positive anomaly solely caused by Safe Mode & all / certain compressed files. 



They are surely False Positive and I did'nt move them to Quarantine (it could be a problem for the system). They remain Unresolved in my Chronology, even if there isn't anything to resolve. I'm going to delete that Chronology, so I have no more  to see that issue....

Kudos0

Re: Is there a Bug in Safe Mode Scan?


noghere wrote:   They are surely False Positive and I did'nt move them to Quarantine (it could be a problem for the system). They remain Unresolved in my Chronology, even if there isn't anything to resolve. I'm going to delete that Chronology, so I have no more  to see that issue....

Thanks for your reply.  I will leave my so called Threats in Unresolved for now.  Symantec may want info. Community Watch may submit info from Unresolved.  I agree and suspect them as FP or an anomaly...but, I may Quarantine and restore from Quarantine after Symantec chimes in.  Or, just Clear Entries after Symantec chimes in.   Interesting, I had not considered moving to Quarantine could be a problem for the system.

Thanks

Kudos0

Re: Is there a Bug in Safe Mode Scan?


Sym_KeN wrote:

Hi ProTruckDriver,
I can say that this is not a bug. Safe Mode scan is most powerful. In safe mode, only windows files will be loaded.


Hello Sym_KeN

Since you say this is not a bug.  What do you suggest we all do with our Unresolved Threats.  Since, you say this is not a bug.  Then perhaps scanning from Safe Mode (at some interval) should be posted as a Symantec recommendation.   Since, this is not a bug then the default monthly Full Sys Scan should be from Safe Mode.  Since, this is not a bug.  NIS12 may be a better mouse trap than we realized... before ProTruckDriver posted this Topic.  Since, this is not a bug. 

Respectfully

bjm_

Kudos0

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:
   Interesting, I had not considered moving to Quarantine could be a problem for the system.


It may be. My situation is:
  1. A file data1.cab in Java 1.0.7 folder;
  2. A file updater (Adobe Air installer) in Adobe AIR folder;
  3. An appleapplicationsupport.msi in Apple folder;

And I prefer to leave the files in their own position.... Other kinds of file could be moved to Quarantine, even if I think it is useless.

Kudos0

Re: Is there a Bug in Safe Mode Scan?


AllenM wrote:

   I also do not recall NIS 2011 reporting these issues during a Safe mode scan

I don't recall this issue in the 2008,09,10,or 11 while I have WinZip installed. I figured this was a bug when I seen WinZip files flagged as a threat. Hopefully this will be resolved Monday.

"Top Safe Web Reviewer with over 23,000 Reviews."
Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?

Hello Everyone,

For now all your detections you see in safe mode scan from zip files I would let them be for now. I don't know if this is a bug or not but I will for sure do some testing on Monday and email some people so that we can get to the bottom of it. In mean time please be patient while we look into this, thanks.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

Can one of you who has the issue do the following, in the scanning options turn on scanning of compressed files  turn off Intelligent skup and see if Norton detects anything in one of the zip files flaged in the safe mode scan? I forgot that the scanner in normal mode will not scan compressed files by default that have no detections.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

Hello michaell

Um, not sure what you're requesting.....

quote: Computer Scan

By default, Compressed Files Scan option is turned on. In this case, Norton Internet Security scans and detects viruses and other security risks in the files within compressed files. When Norton Internet Security performs such a scan, it extracts a file and then checks for threats inside the file.

The other options in this section are configurable only when you turn on the Compressed Files Scan option. These settings include the following:

Intelligent Skip Scanning

Norton Internet Security extracts and scans maximum of 2-GB data from a compressed file. This way, Intelligent Skip Scanning prevents the scan from being stuck up with a single compressed file that contains a large amount of data. Therefore, Norton Internet Security scans your computer faster.

By default, the Intelligent Skip Scanning option is turned on.

By automatically scanning all compressed files, Norton Internet Security maintains a higher level of security.

Thanks for your interest

bjm_

Kudos0

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:

Hello michaell

quote: Computer Scan

By default, Compressed Files Scan option is turned on. In this case, Norton Internet Security scans and detects viruses and other security risks in the files within compressed files. When Norton Internet Security performs such a scan, it extracts a file and then checks for threats inside the file.

The other options in this section are configurable only when you turn on the Compressed Files Scan option. These settings include the following:

Intelligent Skip Scanning

Norton Internet Security extracts and scans maximum of 2-GB data from a compressed file. This way, Intelligent Skip Scanning prevents the scan from being stuck up with a single compressed file that contains a large amount of data. Therefore, Norton Internet Security scans your computer faster.

By default, the Intelligent Skip Scanning option is turned on.




Sorry that is what I meant. Can you try it with out Intelligent Skip on and see if that makes a difference?

Kudos0

Re: Is there a Bug in Safe Mode Scan?


michaell wrote:

Sorry that is what I meant. Can you try it with out Intelligent Skip on and see if that makes a difference?


So, turn off Intelligent Skip Scanning and run a Full Sys Scan from Safe Mode. 

Clear Entries first or leave Unresolved as is. 

Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?


michaell wrote:

Can one of you who has the issue do the following, in the scanning options turn on scanning of compressed files  turn off Intelligent skup and see if Norton detects anything in one of the zip files flaged in the safe mode scan? I forgot that the scanner in normal mode will not scan compressed files by default that have no detections.


HI michaell,

When I ran the scans last night in Normal mode I made sure Compressed File scans was turned ON and also set Scan Performance Profiles to FULL scan.

I noticed that Intelligent Skip Scanning was also turned ON but I don't think this would make a difference on this since MSI files are not listed in the documentation as being skipped and none of the Safe mode detected files are > 2GB.

Just to cover all the bases though I just turned Intelligent Skip Scanning OFF and am rerunning a full scan for which I'll post the results as soon as it is done.

Thanks

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos0

Re: Is there a Bug in Safe Mode Scan?


michaell wrote:

Sorry that is what I meant. Can you try it with out Intelligent Skip on and see if that makes a difference?



Same result as the other Scan modes: NO virus found with Intelligent Skip off. It happens only using the Safe Mode scan.

P.S.: I've scanned in normal mode only the three files found infected using the Safe Scan mode.

Kudos0

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:

michaell wrote:

Sorry that is what I meant. Can you try it with out Intelligent Skip on and see if that makes a difference?


So, turn off Intelligent Skip Scanning and run a Full Sys Scan from Safe Mode. 

Clear Entries first or leave Unresolved as is. 


In normal mode please. But AllenM is already doing that so we can wait for him and see if it makes a difference.

Kudos0

Re: Is there a Bug in Safe Mode Scan?


noghere wrote:

michaell wrote:

Sorry that is what I meant. Can you try it with out Intelligent Skip on and see if that makes a difference?



Same result as the other Scan modes: NO virus found with Intelligent Skip off. It happens only using the Safe Mode scan.

P.S.: I've scanned in normal mode only the three files found infected using the Safe Scan mode.


Thanks noghere.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

What does 'Clear Entries' do.  

Does 'Unresolved Security Risks' have a discrete backup folder akin to QBackup.

Does 'Clear Entries' clean just the Security History log or does Clear Entries also clean the backup folder for 'Unresolved Security Risks' (if there is a backup folder)


I tried Search Support ~ 'Clear Entries' from Viewing items in Security History

Bad Request

 Your browser sent a request that this server could not understand.

Reference #7.5ee1ab42.1316403756.0


Waiting for reply ~ Symantec Employee Sym_KeN  ~   (Sym_KeN message)

Waiting for further instructions  ~ Symantec Employee michaell

Respectfully submitted

bjm_

Kudos0

Re: Is there a Bug in Safe Mode Scan?

Hi bjm_

The Clear Entries will clear both the history and also remove the file from the quarantine area if applicable.

Best wishes.

Allen

Windows 7 Ultimate SP 1, 64 bit, 32 GB * NIS Vers. 21.6.0.32* Ghost 15 * IE 9, Firefox, Safari. Test laptop with W7 Home Premium 64 bit * NIS Vers. 21.6.0.32
Kudos0

Re: Is there a Bug in Safe Mode Scan?


AllenM wrote:

Hi bjm_

The Clear Entries will clear both the history and also remove the file from the quarantine area if applicable.

Best wishes.

Allen


Files are only in Unresolved Security Risks.  I did not move to Quarantine.  So, while files are listed only in Unresolved is there also a backup folder somewhere.  Or, is Unresolved just a waiting area without a backup folder like Qbackup. 

Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:

  Or, is Unresolved just a waiting area without a backup folder like Qbackup. 



Unresolved is only a warning list in Chronology. No other action taken by NIS. The files remain in their own position till you decide what to do (move to quarantine, delete, clear the unresolved list and so on).

Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?


noghere wrote:

bjm_ wrote:

  Or, is Unresolved just a waiting area without a backup folder like Qbackup. 



Unresolved is only a warning list in Chronology. No other action taken by NIS. The files remain in their own position till you decide what to do (move to quarantine, delete, clear the unresolved list and so on).


Thank you... so, Unresolved is only a warning list awaiting user action.  Thanks.


Maybe, you know why my Unresolved Security Risks from Safe Mode scan (w Intelligent Skip Scanning ~On) are deemed ~~ "Compressed Threats"

The files are not Compressed.  I have check'd each with More Details > Locate ...and I see no zip'd folder, no zip'd file, no extract option w dialog menu.   *.msi and *.exe does not appear to be compressed ....?

Why does File Insight > Threat name: > Compressed threats > Locate ... find a non compressed file.  Just *.msi and *.exe

Shouldn't there be a user option to Submit to Symantec.   Since, user action is required.  User should have option to Submit to Symantec.  Submit for further testing. 

Wouldn't it be nice if Norton products included a 10mb product User Manual pdf.  ... answering all my silly questions.  


Kudos1 Stats

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:
Maybe, you know why my Unresolved Security Risks from Safe Mode scan (w Intelligent Skip Scanning ~On) are deemed ~~ "Compressed Threats"

The files are not Compressed.  I have check'd each with More Details > Locate ...and I see no zip'd folder, no zip'd file, no extract option w dialog menu.   *.msi and *.exe does not appear to be compressed ....?

Why does File Insight > Threat name: > Compressed threats > Locate ... find a non compressed file.  Just *.msi and *.exe



That is a good question!!! My files too are not really "compressed" (.dat, .msi., .exe) even if the Safe Mode Scan says they are compressed (and infected...). We need a Symantec expert help....

Kudos0

Re: Is there a Bug in Safe Mode Scan?


noghere wrote:

bjm_ wrote:
Maybe, you know why my Unresolved Security Risks from Safe Mode scan (w Intelligent Skip Scanning ~On) are deemed ~~ "Compressed Threats"

The files are not Compressed.  I have check'd each with More Details > Locate ...and I see no zip'd folder, no zip'd file, no extract option w dialog menu.   *.msi and *.exe does not appear to be compressed ....?

Why does File Insight > Threat name: > Compressed threats > Locate ... find a non compressed file.  Just *.msi and *.exe



That is a good question!!! My files too are not really "compressed" (.dat, .msi., .exe) even if the Safe Mode Scan says they are compressed (and infected...). We need a Symantec expert help....


@ Topic

So, are we all waiting for further instructions.  

What have users that posted here done with your Unresolved Security Risks.

Symantec Employees volunteer their time.  Sometimes, they may not return to a Topic. 

The Norton Community is a first and foremost a User to User Community.  

So, from one user to another ....what have you done with your Unresolved Security Risks.

My Risks remain where NIS12 reported them ~ Unresolved Security Risks.

Thanks for everyone's time and interest....

bjm_

Kudos2 Stats

Re: Is there a Bug in Safe Mode Scan?

I am going to spend some time today looking into this and I report back whats going on. Is it correct that Safe Mode scan is reporting that msi and exe files are compressed threats?

Kudos0

Re: Is there a Bug in Safe Mode Scan?


michaell wrote:

I am going to spend some time today looking into this and I report back whats going on. Is it correct that Safe Mode scan is reporting that msi and exe files are compressed threats?


Yes that is correct. Thank you for looking into this.

"Top Safe Web Reviewer with over 23,000 Reviews."
Kudos4 Stats

Re: Is there a Bug in Safe Mode Scan?

I tested it today, and I am getting false positives. Looks like the safe mode scan is more aggressive by default then it would normally is when you are not running in safemode. I am going to talk with devs on the AV team and see what they have to say about this and I will report back here what I find out. Thanks for your patience while we look into this.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

My recent scan in SafeMode

Computer #1 - Windows 7 Home Premium 64-bit SP1 IE11 NIS Version: 22.5.5.15 Malwarebytes`Anti-Malware - free (on demand) SAS - free (on demand) #2 - Windows 7 Home Premium 64-bit SP1 IE11 NIS Version: 22.5.5.15 Malwarebytes`Anti-Malware - free (on demand) SAS - free (on demand)
Kudos0

Re: Is there a Bug in Safe Mode Scan?


michaell wrote:

I tested it today, and I am getting false positives. Looks like the safe mode scan is more aggressive by default then it would normally is when you are not running in safemode. I am going to talk with devs on the AV team and see what they have to say about this and I will report back here what I find out. Thanks for your patience while we look into this.


This issue is not yet a "known issue". Why?

http://community.norton.com/t5/Norton-Internet-Security-Norton/Known-Issues-with-NIS-19-1/m-p/533014

Kudos0

Re: Is there a Bug in Safe Mode Scan?


noghere wrote:

michaell wrote:

I tested it today, and I am getting false positives. Looks like the safe mode scan is more aggressive by default then it would normally is when you are not running in safemode. I am going to talk with devs on the AV team and see what they have to say about this and I will report back here what I find out. Thanks for your patience while we look into this.


This issue is not yet a "known issue". Why?

http://community.norton.com/t5/Norton-Internet-Security-Norton/Known-Issues-with-NIS-19-1/m-p/533014


Because we dont have a bug filed on this, also might not be a bug since the default setting might be making the scanner more aggressive in finding threats. I still need to find that out tomorrow.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

Hello Everyone, I just finished talking with Dev with AV engine. This is unexpected behaviour since the scanner is the same and should detect same files. What would be helpful is if you all of you that have posted in this thread can send me a private message and let me know what files are causing the false positives on your machine. We are going to need some files to test with here so we can find out why this is happening. Thanks.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

So, info from Message 14  and from posted screen shots is not what you need. 

All I would know how to send in PM to you is same info I posted in Message 14.

Can I attach the actual file within PM environment.

afaik there is no way to attach file in PM

Perhaps, I would need to upload the files to the secure symantec online storage facility located at https://www.swapdrive.com/login.htm.

or, some other Symantec venue. 

Kudos0

Re: Is there a Bug in Safe Mode Scan?


bjm_ wrote:

So, info from Message 14  and from posted screen shots is not what you need. 

All I would know how to send in PM to you is same info I posted in Message 14.

Can I attach the actual file within PM environment.

afaik there is no way to attach file in PM

I would need to upload the logs to the secure symantec online storage facility located at https://www.swapdrive.com/login.htm.

I'm thinking you need to provide login creds


Yes I might be able to find some of those files online, but not everyone on this thread was as detailed about posting the information about the false positives as you were. I am not looking for logs though, I am looking for links so that I can download these files from the internet because looks like these are exe and msi files that are widely available to the public.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

michaell

So, what are asking for ? 

Computer #1 - Windows 7 Home Premium 64-bit SP1 IE11 NIS Version: 22.5.5.15 Malwarebytes`Anti-Malware - free (on demand) SAS - free (on demand) #2 - Windows 7 Home Premium 64-bit SP1 IE11 NIS Version: 22.5.5.15 Malwarebytes`Anti-Malware - free (on demand) SAS - free (on demand)
Kudos0

Re: Is there a Bug in Safe Mode Scan?

What files are causing the false positives, what program they belong to, and if they can be downloaded from the internet, what is the url for the site. Please send me a private message with the information, do not post it here.

Kudos0

Re: Is there a Bug in Safe Mode Scan?

Um, how would I locate a link for > 60b5b6c.msi   9/06/2008   Windows Installer Package

I'll try to PM links for exe's

My Installer Folder has many, many folders and files.  The alpha numeric codes must mean something to someone.

Um, to me it's all a non native language. 

This thread is closed from further comment. Please visit the forum to start a new thread.