• Todas las Comunidades
    • Todas las Comunidades
    • Foros
    • Ideas
    • Blogs
Avanzado

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

I have had the situation recently where a false report against a legitimate  Windows driver update program called Driver Easy has now created a Norton Threat Response called PUA.Drivereasy that goes through and uninstalls the program automatically - without even asking. Not only is this "Threat" wrong - the very existence of this threat and then the response is just plain wrong.

The Norton description of this useful subscription program that helps find and update Windows drivers when requested to do so is wrong.  User request a scan. It doesn't install by itself - you need to install the trial DriverEasy_setup.exe executable after downloading it from their website.

The official "Threat description states - "The application scans the computer for missing and outdated drivers and displays misleading information about how the issues affect the computer's performance.  It then shows a GUI of an unregistered program  - with partial scan results and then states: " The application then asks the user to pay in order to fix the listed issues."

Note This is a subscription program that users can choose to purchase after they trial it. An unregistered program in trial mode will allow users to download drivers, once trial ends you need to have a subscription to gain access to the various Windows drivers.

Not only does whoever reported this program misrepresented what this program does - their further description is malicious and completely unjustified. As a long time user of this program - it is especially useful in assisting with finding the correct Windows drivers after a new Windows installation. While some of their drivers may turn out to not be able to be updated to a more current version - the majority of their choices are correct. As a subscription program I choose whether to extend its subscription or not. This is not an area that NIS should be interfering with.

PUA.drivereasy is not a valid "threat". It should also not be uninstalled by NIS.   It should not even exist within NIS.

Further, Norton's Virus and Threat Reporting programs should not have categorized these programs as Threats and nor should the Threat Response have been created either on the basis of a malicious report against Driver Easy.

There are also a number of other similar malicious "Threat Reports" against similar Windows driver installation assistance programs that should also not exist.  PUA.DriverAssist is a further example of wrongly classifying helpful application programs that a user has voluntarily installed and paid a subscription for - only for Norton to go and potentially also classify these as a threat requiring automatic uninstallation.

Norton needs to go and reexamine the entire PUA. area as it appears a series of a false reports against most of the Windows  driver installation assistance programs have been submitted to Norton and then subsequently Norton deeming them "threats" to be removed now make Norton Internet Security itself as a program partly dangerous to continue to use.

As it stands the credibility of NIS to accurately detect REAL threats is also somewhat at stake as the apparent automatic acceptance by Norton of what are clearly false  "threat" reports with an almost mindless response to then automatically accept that report without a proper check of its validity and then just uninstall that so-called threat - without the entire Report first being validated by a relevant Norton Subject Matter Expert. is wrong. How can NIS be trusted when what are valid application programs are classified as threats to be removed - seemingly at the behest of malicious false reports that have just been blindly accepted ?

Norton needs to stop and re-evaluate all of these so-called PUA "threats" to see how many are valid Windows programs that  have been misreported and then required automatic removal when in the first instance they were manually installed voluntarily by a user and can be manually uninstalled if no longer required.

I need to now search back through Norton Quarantine logs to see how many of my paid-for Windows shareware applications have been wrongly uninstalled by NIS due to this malicious false reporting.

And if the PUA classification area has been  corrupted by false reports - how many other similar type false reports have also been accepted so easily ?

Respuestas

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

https://safeweb.norton.com/report/show?url=drivereasy.com

PUA.Drivereasy is a potentially unwanted application that displays misleading information about the computer's performance. It then asks the user to pay to fix the issues.

: How to report false positives


Filename: drivereasy_setup.exe  as of 5/10/2016
Threat name: WS.Reputation.1
Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe
Very Few Users
Fewer than 5 users in the Norton Community have used this file.
Very New
This file was released less than 1 week  ago.
Medium
This file risk is medium.
File Thumbprint - SHA:
de590bfe0ed34138b46436505d7ab33b3ef7525e87bf1b09db5b04dfd262d681


Symantec WS.Reputation.1
http://www.symantec.com/security_response/writeup

Clarification on WS.Reputation.1 detection
https://community.norton.com/forums/clarification-wsreputation1-detection

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

The PUA.Drivereasy statements are designed to mislead - if you have never used the program you would not understand its purpose.

Driver Easy like Driver Assist of one of a few programs designed to assist a user keep their Windows driver files updated. Nvidia driver versions are constantly being updated - both to fix faults, enhance the performance or support a new hardware version.

That doesn't mean either that I agree with all the results from Driver Easy or Driver Assist as I have used both, and not all of their suggested driver files are suitable depending on your Motherboard type.

The whole purpose of both these programs is just to keep the driver files current - neither programs asks for money to fix issues - just both programs run on a yearly subscription fee. Both programs are shareware - neither installs automatically.

The Norton Description - particularly of Driver Easy appears to have been initiated by a malicious 3rd party trying to demonize all of the driver update assistance programs.

PUA.Drivereasy should not exist as a Norton Virus "threat"

Thank you though for the link to report this False Positive

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

FWIW ~ https://blog.malwarebytes.org/cybercrime/2015/06/driver-updaters-digital-snake-oil-part-2/ ~ YMMV

User feedback Norton is not aggressive re PUA's.
User feedback Norton is too aggressive re PUA's.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

The default setting in Norton Internet Security for any risk like PUA.Drivereasy is quarantine - and in this specific case of PUA.Drivereasy it goes further and uninstalls the application and forcibly irreversibly deletes user saved backups of private archives of driver files that are in the Drivereasy directory tree that now cannot be recovered.

I have now excluded PUA.Drivereasy, PUA.Driverassist, and WS.Reputation.1 and changed the action to Ask Me.

Whether that is enough to control Norton Internet Security AntiVirus's acts of stupidity is another thing.

I have now wasted more of my time in reporting this user application program fake threat category as a False Positive - when the description within PUA.Drivereasy is both misleading and malicious and the Norton Virus vetters will not even address the complete stupidity of user application programs that have been voluntarily installed later being classified as Potentially Unwanted Applications and forcibly deleted. They have now excluded version 5.0.5 of Driver easy (which I reinstalled last night) - excepting the virus definitions won't be updated for a day or more most likely so it got re-deleted last night again - despite that directory tree being excluded from scanning.

I should report this program I know of as it, like Driver Easy asks for money and supplies wrong results too (spam email) as the Norton Anti Virus Logic could then go around uninstalling MS Outlook from within Office365.

After all - even though I have voluntarily installed that program and paid a yearly subscription - because it continues to download unwanted emails some of which are spam - then Symantec should treat it the same way as Driver Easy and uninstall it. Plus delete all your emails everywhere as well. PUA.MSOutlook anyone ?

Of course Symantec won't do that as they know they would be sued for malicious damage by Microsoft.

How is this any different in the case of Driver Easy being classified as a PUA. A voluntarily installed program, with a voluntary subscription fee - deleted forcibly by Symantec plus private data file archives of system driver files are also forcibly deleted as the default behaviour of NIS. The difference of course is this is a shareware program being maliciously targeted as malware and then wrongly deleted by NIS. What chance does a small shareware company have against the might of Symantec Virus creators.

Snake-oil articles  - there is exaggeration in the industry yes - but in the case of Driver Easy I use it only occasionally - a few times a year when making hardware changes and reinstalling some application programs that may need some drivers upgraded.

I use Driver Easy as a means of finding the latest driver updates - mainly only when I have just reinstalled a PC's Operating System. It is a way of making sure I find all the driver files - although inevitably some of those results may be wrong. It is also helpful to periodically run a scan to check whether some drivers may have been updated that you hadn't noticed that have fixed some inherent issue with the driver. For that alone , to me it is worth the subscription fee plus a way of having an archive of the driver files to may it easier reinstalling.yes there is some misinformation - but of the the driver assistance programs Driver Easy is more restrained. An occasional checkup to verify current state is useful -most of the time the only change that will have occurred is the Nvidia drivers being updated.  Even Winzip has a Driver Updater Assistance program - same rabid Symantec response of uninstalling it.

Norton should only flag the PUA fake "threat" and ASK whether it is a problem - not as it does now forcibly irreversibly uninstall as a default action. None of these programs are installed other than by the voluntary actions of the user. This automatic background deletion is just plain wrong.

There should also be an easier way of exempting these fake "threats" like PUA - not the extremely slow method today of having to completely reload all the Low Risk Threat table for every single fake "threat" exempted.

This entire PUA category really needs to be reconsidered - else NIS itself soon will be deleted due to its unwarranted interference with valid user programs.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Software Whitelisting Request
Our software whitelisting program offers software authors and vendors the opportunity to periodically submit software for inclusion in the Symantec whitelist of known good software in order to reduce the possibility of false positives.

https://submit.symantec.com/whitelist/

Norton | Learn How Norton Goes Beyond Antivirus 

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

@geoffc: I just uploaded the official download of DriverEasy_Setup.exe (MD5, aee9a8f419094faa28323a35165e828b) to VT here. The exe has been flagged as Hack.Exploit.CVE-2009-2501.a by Rising. Then, I kindly suggest that you or the company need to contact with Rising at the same time.

As for the official site https://www[DOT]drivereasy[DOT]com/ is clean so far. See this URL from VT. Meantime, I just found another sister site@ driversinstaller[dot]com:

  • site is also clean so far, according to this VT file.
  • DriverNavigator_Setup.exe (md5, 7cb1ead41099de7b13f6daac616f4a72) is risk-free so far, as well.

Personally, please consider making more accurate info to the following page@ https://www.drivereasy[dot]com/why-choose-us/

  • Easeware Technology Limited can be found as Microsoft Solution provider ("Application Development") @ this Microsoft Pinpoint page.
  • Seems that there is no valid proof that Easeware is one of Intel Software Partners.

Then, I tested both Driver Easy and DriverNavigator on a Win 10 computer. I'd like to share the following image:

  • I ran Windows' own updater in Device Manager, then I was told that "Windows has determined the driver software for your device (Intel(R) 82574L Gigabit Network Connection) is up to date."
  • both Driver Easy and DriverNavigator informed me that "1 Device(s) Need Updated Drivers", "Found 1 devices have new drivers"

Grammar mistakes or generated info? More, I met a (potentially) undesired desktop pop-up from DriverNavigator.

Furthermore, I'd love to share the following screenshot from Driver Easy: this is another driver game, v12.12.50.6 vs. v12.7.28.0

NS (v22.6.0.142) did not remove Driver Easy automatically, without alert. It did not flag it as threat either.

Closing words:

  • I would rather trust Windows and Norton.
  • Driver Easy can be a PAID driver manager. See more users' feedback here.

  • Agree w/ " Snake-oil", see the found pop-up@ Should You Remove It?.
  • At least, you can consider updating yr NIS to the latest NS. For more help, please feel free to contact Norton Support here.

PUA.Drivereasy is a potentially unwanted application that displays misleading information about the computer's performance. It then asks the user to pay to fix the issues.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Hello

I wouldn't trust Windows with keeping up with drivers. One time I had onboard sound on a computer. They said to install a driver for my onboard sound. Believing that Windows is correct, I let it install the driver. It totally messed up my sound. I then noticed they had given me a driver for some other company than the company I needed. Windows has been behind in recommending drivers especially for NVidia video cards that I have had.  I have found over the years, it is always best to go to either the company who made the computer or to go directly to the manufacturer of the hardware. Don't try beta drivers unless on a test machine.. You can set most needed software to let you know when you need a driver, but let me decide to download and install it.

Windows is constantly telling me know to install a driver for my keyboard that came out in 2013. My drivers are up to date and those drivers are now installed automatically with no choice to change that. No way would I install a driver from 2013 now in 2016 when my keyboard is working fine and has newer drivers installed..

Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.18.0.213 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

@20750065 Repeating the same tired rubbish does not make it truth.

As a long time user of Driver Easy I am familiar with this product - a commercial shareware program with annual subscription - you though seem to wish to perpetuate the drivel submitted to Symantec purporting to be a "threat".

Having had Norton Internet Security uninstall this program WITHOUT WARNING TWICE (2 times) - with NIS (22.6.0.142) with essentially default settings via the overnight background scans and also received NO warnings of any kind when I reinstalled Driver Easy 2 days ago after I found its forcible deletion only to then find that next day it forcibly deleted again !! -  I believe I have more experience with this situation than you do - especially when you repeat the misleading rubbish that constitutes the "threat".

I have no relation to Easeware and only wish to be able to use, on occasion, the commercial shareware programs that I have purchased annual subscriptions to. That does not mean that I agree 100% with all aspects of Driver Easy - but if you use it as intended - as a guide to the upgrade of drivers where relevant - then it does fulfill a useful role.

I certainly don't need your 5 minute hatchet job on how evil Driver Easy is and we must protect those poor cretins who might voluntarily choose to install this wicked program onto their PC's. You didn't have the program installed long enough to find out whether it would be uninstalled by NIS overnight plus this is before the very recent white-listing again of version 5.05 so I do not appreciate being called a liar.

Driver Easy is a commercial program to which you pay an annual subscription. It is voluntarily installed and can be used (or not) to assist with installing drivers in a Windows PC.  Like it, or not - it is still our right to install such a program and not expect Norton  to subsequently uninstall it without asking.

So far, I had not needed to alter the NIS configuration - until this new category of "threat" was invented where the majority of these Driver Assistance programs are now demonized and then worse - what is in my view inexcusable - the forced uninstall of an entire program area by Norton AND wrongly removing personal driver archives of my PC held within that same area all without asking. And don't tell me it never happened - I have now lived through it twice. This is fundamentally wrong. Allowing bigots to demonize all driver assistance programs and then manipulate the "threat" list to include those same programs by misleading and malicious "threat" reports is wrong. Having Norton then, by default, and without asking uninstall those same programs all without asking is wrong.

Norton needs to properly review their so-called threat list and in particular the entire PUA category as the reporting mechanism of real threats has been misused to wrongly classify certain types of programs as PUA - yet those same programs have also been voluntarily installed by users.

Norton should also have ensured that the NIS settings were such that no PUA programs should have been uninstalled without first asking - and certainly none of this overnight stealth deleting. I have now altered NIS settings - whether this is sufficient to stop this wrong behaviour I don't know.

Whether you like Driver Easy or not is not the issue. The issue here is the misuse of the Virus Reporting system to wrongly classify all driver assistance programs as "threats" and for Norton to then also subsequently remove that so-called "threat" by stealth without asking. And seeing how badly the PUA classification has been corrupted makes me wonder what else in Norton's AV list might also have been wrongly added ?

While I generally like NIS and have it installed on all PC's - it won't take much more of this unwarranted interference with valid software installations before the next software removal will be NIS itself.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Geoff,

I mean no offense, but in the time it took to write all of your posts you could have learned how to exclude an item from Norton's scans.

https://support.norton.com/sp/en/au/home/current/solutions/v3672136_ns_retail_en_us

Windows 10 x64 1903
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Actually, the better method to exclude this is to add it to the Signatures to Exclude from All Detections.  This PUA is listed, you just need to scroll down the list (be patient, the list takes a minute or two to populate) to PUA.Drivereasy, select it and add it.

https://support.norton.com/sp/en/au/home/current/solutions/v54298598_ns_...?

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Thanks - I had in fact excluded the Easeware install folder as well as the associated one under AppData in my account shortly before writing the first post. At the time I didn't think it also necessary to exclude PUA.Drivereasy as it was meant to be "safe" with 5.05

Once the re-installed Driver Easy installation was then deleted the 2nd time that next night (despite the folder exclusions AND not receiving any warnings at all on installing 5.05 of Driver Easy in the first place) I then went in and found where to exclude the specific PUA.Drivereasy "threat" definition as that appears to override folder exclusions.

The reason I submitted the post was not to expect to receive a solution - but more to raise awareness of what I perceive as the increasing corruption of the PUA.AppName list of "threats". Vested interests and bigoted program category haters seem to be able to easily add "threats" by submitting bogus claims which then get mindlessly accepted and soon after a "threat" removal process is then added into the AV scanner. The AppName owners must then fight to get whitelisted again - but that may then apply to only a version of the AppName. Later AppName updates will possibly default to a threat again.

I am not claiming that Driver Easy or Driver Assist or any of the similar programs are perfect  - just see that Norton now extending its role to deciding which programs should be installed on your PC and irreversibly uninstalling that program without warning when it determines otherwise is wrong.

As a user, if I have decided to install a program on my PC I do not want Norton to then unilaterally decide to later uninstall it - especially when the "threat" is similar in nature to the bogus PUA.Drivereasy entry. I also intend to review the entire PUA.AppName classification as there seem to be many unwarranted entries in there that may cause issues in the future.

As is stands now I just have to hope that further programs won't disappear because I haven't known in advance of a PUA being assigned to then subsequently remove that program by a background scan once a "threat" removal method has been developed. If one program can be uninstalled despite installing successfully that same day then it concerns me that NIS may no longer be a safe program to use.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

> Actually, the better method to exclude this is to add it to the Signatures to Exclude from All Detections.  This PUA is listed, you >just need to scroll down the list (be patient, the list takes a minute or two to populate) to PUA.Drivereasy, select it and add it.

https://support.norton.com/sp/en/au/home/current/solutions/v54298598_ns_...?

------

Thanks - I found this method - unfortunately it is very limited in its add option.

First you need to either scroll down the list or guess the category that the PUA entry belongs to THEN you can only add one entry at a time. Scrolling the list or else grabbing the cursor was what I eventually did to scroll down near WS.Reputation.1 as that is always a pain (if it is a real threat it will have a unique entry of its own.)

Each time you want to add an entry you have to wait and wait and wait for the Threat list to reload - then only 1 entry per reload cycle. I had hoped CTRL click or even SHIFT click to add a few or multiple entries would work - but unfortunately not.

So you can add multiple PUA definitions - but at the pain of multiple delays.

Based on the lack of credibility of some of the PUA entries of Apps that I have used  I would very much like a way to add a PUA.* entry to the exclude list - though I may change that if I do find any PUA entries that might be needed.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Dear all, this is Sophie from Easeware, the company that owns Driver Easy. First and most important of all, we would like to extend our great appreciation to our valued customer @geoffc, who has been working so hard helping us with this false positive issue. The false positive has already been removed by Symantec by now, thanks to our customers' consistent help and request.

I could testify that what @geoffc said was totally true, including that Norton would completely erase all the information of Driver Easy without asking when reboot, which was so frustrating because after the delete, Symantec would stop you from downloading Driver Easy again.

Long story short,  we had been in contact with Symantec for about a month to finally get this false positive removed. (If you are interested, you could check the blog with more detailed information on this issue. " https://www.drivereasy.com/a-statement-on-nortonby-symantec-false-positi...") The cause of the problem was the false conversion of the date and time, which was rather confusing since it could only be counted as a bug, not a threat. Wrongly listed a bug of a software as a threat is something that we could not understand, since bug are so commonly seen on almost every software, especially when Norton itself has bug too, please refer to the webpage "http://www.zdnet.com/article/symantec-antivirus-products-vulnerable-to-h...".

It should be noted that we are not accusing Symantec of anything, but similar to what @geoffc mentioned, we do believe that Symantec should at least improve their reporting system. As a big and responsible company, there is a process of handling problem like this in Symantec. We totally understand that it would take them some time to deal with such a problem, but when we sent them emails after emails wanting to know the exact problem so we could deal with it right away, all we got was the template replies and ambiguous or even wrong direction. This process could have been a lot shorter if Symantec had more specific information on its webpage or provided more detailed directions by its support after we contacted them.

Again, many thanks to our so warm-hearted customer @geoffc. You are playing a very important part in helping us release the false positive report. Your effort is highly appreciated by us all in Easeware.

@20750065 I would like to answer your question one by one. 

1. We have made contact to Rising company with regard to the report of Hack. Exploit.CVE-2009-2501. This false positive is noted by Rising support team and they assure us to take care of it at their earliest convenience.

Here is the false positive report details if you are interested. http://bbs.ikaka.com/showtopic.aspx?page=end&topicid=9335415#12165518

2. As for the "why-choose-us" webpage information, it should be made clear that Intel has recently merged their cooperation plan so the link here is no longer available as you can see from the screenshot that taken from Intel. Therefore, you might find it "invalid to view software as one of Intel Software Partners".

3.  As for the different driver version, this could happen when these two drivers are provided by different manufacturers who have different marking system, just as shown on the picture below.

4. As it is mentioned above, Driver Easy indeed would be erased by Norton without giving any notification before the false positive was removed. This had happened to a lot of our users and colleagues in our company as well. We are curious how your Norton manage to keep Driver Easy on your system.

The following pictures show the notification of Norton to Driver Easy and their way of dealing with this "threat".

First, when tried to download Driver Easy, notification like this will pop up:

When you chose "View Details", here was what was shown. The threat names were changed from WS. Reputation to PUA to PUA.GEN4 to WS.Reputation again.

Even after it was added to the white list, run the scan again, notification like the following would still show up.

Next thing you know is what have been mentioned already, Driver Easy was erased totally the next time you restart your computer.

If you have any doubt, here is a link for our older version of Driver Easy, you could have a try at it to see for yourself.

www(dot)drivereasy(dot)com/tmp/DriverEasy_Setup(dot)exe

Here is what you will see in Horton Security's history.

5. There are two officially released versions of Driver Easy, paid professional version and free version. Free version could be used to download and install drivers needed for your computers as the paid version, but it will take a little bit more work and time for you to use the free version since it will requires you to install the drivers by yourself. Here is how you could manually install the drivers after the download: " https://www.drivereasy.com/help-v5/update-drivers-by-free-version/".

Free version of Driver Easy is an option that we offer to users who would like to try our product before buying it or users who are used to free product online. The free version will satisfy their need and requirement without costing them any money.

Professional version is designed for our users to have a much faster and much easier update experience. Our users are not forced in any form to buy our product. It is totally your choice whether or not to use the professional version of Driver Easy.

If I was not making myself clear enough, please feel free to ask.

Again, thanks a million to users who have been speaking for us and standing with us, it is our great pleasure to have you as our customers.

Thank you for your reading. Have a great day.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Hello @20750065

Please see          Permalink  Response from Driver Easy. Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.18.0.213 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

@floplot: Thank you. I've just read the company's comment above. For more, view Kevin's blog post later.

It’s hard to believe that Symantec should be this careless of their company image, even harder to believe that they would totally ignore a customer’s request like this.

@Sophie: Your company can consider making the following corrections to your current version of Driver Easy (MD5, aee9a8f419094faa28323a35165e828b):

  • Application name: Driver Easy Limited Version would be better - remove the word "Free".
  • Scan result(s): avoid (possible) simple grammatical errors, or generated info.

Again, please review this "PUA.Drivereasy" page for future reference.

Well, I re-tested your product (v5.0.5.0) on a CLEAN Windows 10 computer:

  • Test shows that the downloaded driver cannot be installed. See the 1st img above.
  • Your D.E STILL informed me that "All drivers on yr computer are up-to-date!".

I can direct download the driver for Intel(R) 82574L Gigabit Network Connection here, NOT ANY MICROSOFT SITE.

BTW, yr D.E. is clean so far, even I am using an old version of NIS.

PS: Yr word "Horton" is not correct. It'd be Norton, instead. Kind regards...

Here is what you will see in Horton Security's history...

PSS: As for this thread's title "False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!", you guys can review this thread regarding PUA.OpenCandy (utorrent). And, there IS difference between Uninstall (a word from Jack Bicer) and Remove.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

So now Driver Easy is at fault because an Intel driver installation fails ?  Driver Easy is a guide to assist with the checking and installation of new drivers. You cannot expect it to be perfect.

You are, once again - missing the whole point.

Just because a single scan result from a single computer shows results that are not perfect for that reason alone you state that it should be removed by Symantec and hence PUA.Drivereasy is valid ?

There is a complete difference between a program maliciously installing viruses and grammatical errors or the wrong choice of drivers being shown. I can equally show scans from various PC's where the scans are correct - and where I find a driver offered is wrong I can report it to Driver Easy for them to investigate why the potentially wrong result is shown.

Driver Easy can either be registered and run in a Free mode or you pay a subscription and have some additional features that help with the installation of programs. You know that - yet you twist the truth in your continuing vendetta against these type of programs.

You may wish to troll the community with specious complaints about all the driver assistance programs - but what you are doing is wrong.

What Symantec is also doing with allowing their previously valid Anti-Virus Database to be corrupted by wrongful entries against certain classes of programs by invalid PUA.appname entries is frankly doing great harm to their reputation.

At the rate this is going I will be looking at removing all Norton AV programs due to their continued un-justified removal of non-threat programs.

Symantec AV scanners should not be flagging any PUA.appname fake "threats" and certainly should not be invoking irreversible uninstallation  / deletion routines against applications that have been  voluntarily installed in a PC -  especially when the origin of those so-called "threats" is inaccurate malicious "threat" reports that should never have been accepted as genuine threats in the first instance.

If a single spelling mistake or wrong driver choice can be justification for a PUA.appname "threat" then Symantec AV is doomed to failure.

Allowing the trolls to classify any application they dislike as a Symantec PUA "threat" with seemingly blind acceptance of those "threats" by Symantec, escalated to "threat" removals - all without proper oversight within Symantec - merely makes their AV scanners second-rate with multiple invalid false positives which will again not be removed by those same blind acceptors when reported as wrong.

Symantec has a real problem now - the PC user community should not be harassed by Symantec AV scanners wrongly removing applications voluntarily installed - all on the basis of these fake threats. Symantec might have originally considered adding the PUA classification to try and remove a genuine class of "threat" - but  they clearly did not do enough to ensure all PUA entries were properly vetted before being accepted - resulting in this current mess.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

@geoffc: I can fully understand what you had experienced. We cannot expect Norton to be perfect, as well. Somehow, there are more solutions than than there are problems.

In d meantime, @Sophie, this Software Whitelisting Request should address your issue here the efficient way.

To avoid running into such "PUP.Threat" trouble, Sophie you can also read the following content:

A PUP (potentially unwanted program) is a program that may be unwanted, despite the possibility that users consented to download it. PUPs include spyware, adware, and dialers, and are often downloaded in conjunction with a program that the user wants.

and, when it comes to Norton, please provide users with more accurate information. Personally, generated information or misleading info could easily trigger the anti-virus software (e.g., MBAM, ESET, etc.) into recognizing the computer program as if it was a unknown/ flagged threat, because of current principles of behaviorism +(or) clouded based virus protection +(or) Host-based Intrusion Prevention System (HIPS). Please review the direct deletion of uTorrent here.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

I did a quick review of the current Symantec PUA.Appname entries - specifically looking at what entries pertain to driver assistance routines and the original "threat" report summary.

PUA.DriverAssist - displays inaccurate information about issues

PUA.DriverBooster - displays inaccurate information about issues

PUA.DriverDoc - displays misleading information about issues, asks user to pay to fix issues

PUA.DriverEasy - displays misleading information about issues, asks user to pay to fix issues

PUA.DriverNavigator - displays misleading exaggerated information

PUA.DriverPack - installs optional program (This is under user control whether to accept)

PUA.DriverPro - displays misleading information about issues, asks user to pay to fix issues

PUA.DriverScanner - displays exaggerated information about issues, asks user to pay to fix issues

PUA.DriverSupport  *** no entry found (this used to be called DriverDetective)

PUA.DriverUpdPro - displays misleading information about issues, asks user to pay to fix issues

PUA.DriverWhiz - displays misleading information about issues, asks user to pay to fix issues

PUA.TweakbitDrvUpd - displays misleading exaggerated information

PUA.WinzipDriverUpdtr - misleading application - displays inaccurate information about issues

I believe these descriptions are accurate - I tried to capture the words used from the somewhat sparse "threat" description and after a while the sameness of the entries started to blend in.

There are possibly other entries for further Driver Assistance applications - but even from just these 13 entries there is a similarity between the majority of the submissions with the same catchphrases being used.

All of these entries lack credibility - their author(s) have themselves aimed to mislead Symantec AV in raising these false "threats" - when these are all application programs voluntarily installed by end-users.

As it stands the Symantec PUA Classification is riddled with false entries like these - and once established it is then virtually impossible to remove as a seemingly automatic acceptance of submitted threats then get escalated to automatic "threat removals - all on the basis of these original false claims by a few (?) users with a seeming vendetta against Driver Assistance applications.

This needs to be fixed.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

First of all, thank you so much for your valuable feedback and comment. Users feedback has always been highly appreciated by us. We have also been working hard to improve our product to ensure our users with an excellent user experience.

I would like to answer the problems you mentioned in your post, hope this could clarify the doubts.

1. As for the name of the program, as mentioned earlier, there are two official versions of Driver Easy, free version and professional version. These two versions are recognized by our company. You mentioned the word "limited", which is used to name another version of Driver Easy, "Driver Easy Professional (Speed Limited)". It should be made clear that this is not an official version of ours. To see more detailed information about this version of Driver Easy, you could check the following link.

https://www.drivereasy.com/supports/#What_is_Driver_Easy_Professional_Sp...

2. As for the "misleading information" you mentioned with this screen shot:

From what we could see,, the screen shot you took was the information under the "General" bar which shows that the manufacturer is Intel Corporation:

The information displayed on Driver Easy is from "Driver" tab. As you can see for yourself, it shows that the driver provider is Microsoft.    

It is assumed that you might have made a tiny mistake for mistaking the driver provider as the driver manufacturer. In this case, the driver is provided by Microsoft instead of its original manufacturer.

3. Thank you for your suggestion of adding it to the white list in Norton Security. But just as mentioned in our earlier post, this was not helpful somehow, since Driver Easy would still be removed from the computer the next time you started it. 

This was our first try when we were scratching our heads how to deal with problem as such. Yet it could only last until the next restart of the computer.

4. It is always suggested that you contact us via the feedback interface in Driver Easy with the box before "Export System Information for Deep Analysis" ticked, so we will be able to provide our help when you have any technical problem.

Last but not least, we would like to say that as a manufacturer, we are entitled to know the exact reason why our product would be treated as a threat and then removed completely. Plus, Geoff made it quite clear that it is the choice of the users how to deal with their programs on their computers.

Security program is chosen by users when they are in need of protection. It is like the security system of a family. It is expected that the system keeps bad people out and make sure that your family is safe. The false positive is like the system decides that one of the couples is a threat based on a small argument they had earlier that day. Then he or she is locked out of the house and could not find a way in. Nor could the person inside the house manage to help with this situation since it is impossible for him or her to overwrite the security system. This is clearly not how things should be done. We could only ask for your understanding.

Again, we are more than welcome to any constructive suggestions from you. If there is anything you still want to add, please feel free to contact us.

Wish all of you have a great day. 

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Sophie.Luo,
FWIW ~ Driver Easy Free v5.0.5 download / install / scan for me. YMMVDevelopers Easeware Technology Limited
Version 5.0.5.0
Identified 5/23/2016 at 10:59:54 AM
Few Users
Hundreds of users in the Norton Community have used this file.
New
This file was released 13 days ago.
Trusted
Norton has given this file a trusted rating.
http: //cdn . drivereasy.com/DriverEasy_Setup . exe
Downloaded File DriverEasy_Setup.exe from drivereasy.com
File Thumbprint - SHA:
de590bfe0ed34138b46436505d7ab33b3ef7525e87bf1b09db5b04dfd262d681

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

driver assistance routines

I have been doing online computer/Windows support since the 1980's on CompuServe and elsewhere and it is the informed opinion of many of my technically experienced colleagues that the background scanning of one's computer and automated updating of hardware related files is unnecessary and in many cases positively disadvantageous.

There is rarely a need to upgrade a hardware driver that is working satisfactorily.

Relying on any program can cause problems, depending on how it decides that a newer driver should be installed, since especially on notebooks and similar devices the apparently standard drivers are often tailored by the driver source at the request of the device manufacturer specifically for a particular generation of model of the device which is why the only satisfactory source for hardware drivers on such devices is the manufacturer of the equipment and not the manufacturer of the component.

I have seen too many devices "disabled" or "handicapped" by unnecessary installation of the latest driver .... or other software for that matter. "If it ain't broke, don't fix it"

I am not against background surveying, obviously, since my A/V protection depends on it but unless something is a positive and known danger then I hope any utility it will tell me what it finds and ask me what I want to do. That's why many of us are glad that Norton has removed registry scanning and "cleaning" from the Norton A/V programs.

Hugh
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Below are some suggestions for thinking about "PUP threats":

  • Keep the product as clean as possible (avoid using some adware installer such as the mentioned OpenCandy, DownloadAdmin, etc.); contact antivirus program vendor in time when you encounter possible false alarms; avoid running into affiliate spam or aggressive CPI marketing, always. Examples are, avoid bundling, or get bundled. @Luo, when it comes your D.E., please keep an eye on your affiliate program memberS, as well.

Driver Easy doesn’t bundle any extra programs. Its installation process is clean and hassle-free.

  • Never cross d bottom line(S). @Luo, Please avoid displaying potentially incorrect system report(s)/ results (even due to some possible application bug), depending on the current Norton and/or other security programs' "Threat Behavior Analysis" and/or other protection modules. Please review my TEST,  "All drivers on your computer are up-to-date!", above.

PUA.xxx is a potentially unwanted application that displays misleading/ inaccurate information...

Thank you all.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

@Hugh,

You are missing the point.

It is not how good or bad the results from Driver Easy or any of the other Driver Assistance programs are, nor how often you use it, or in what way. This is about the rights of a PC owner to use applications that they have purchased and voluntarily installed with out Symantec NIS removing that program as a result of an apparent campaign of false report(s) against a particular class of applications.  Even a single error in driver detection is now deemed as being one of these "threats"  - according to the control-freaks.

The issue here is that, on the basis of specious AV "threat" reports that Symantec AV scanners have then deemed DriverEasy and  a number of other Driver Assistance programs as "threats" to be removed from the PC environment and what is worse - without any prior request of the PC owner before doing so. As a minimum they should be ASK ME - not quarantine, delete, reboot to remove.

Let's make it quite clear.

These fake PUA's are not real Virus "threats" or trojan diallers, - these programs have all been voluntarily installed - they have not been falsely installed by a 3rd party installer - these are genuine commercially produced PC application programs and most with some sort of subscription payment scheme since the ongoing maintenance of databases of available drivers is not something that can be done for free. And no-one is requiring that you install these programs yourself.

The real PUA's will be ones that install surreptitiously and are difficult to remove afterwards and that don't do what they state. Those deserve to be removed. The problem now though is that the PUA submission process is so lax that the wrongfully entered apps dominate this category making it difficult to distinguish the real from the fake.

This is about the fundamental right of individuals to use whichever application program they wish to - not to be prevented from doing so by a Symantec AV program due to an apparent deliberate campaign of lies and misinformation demonizing particular applications.

While the latest DriverEasy version may have been deemed safe previously it was not - that caused me to initiate this complaint. With PUA.DriverEasy on ignore and ASK ME set where possible I hope to prevent further wrongful interference.

As it stands I no longer trust Symantec's PUA list and given a choice would opt-out of the entire category which as yet is not possible and the "ignore" per-entry-option too painfully slow to be a practical alternative.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

That may be your point but it's not mine .....

 I hope any utility it will tell me what it finds and ask me what I want to do.

Hugh
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

PUP vs. PUP.Drive(r) @ Symantec

1. PUA.DriverAssist

2.  PUA.DriverBooster

3. PUA.DriverDoc

  • MD5 9426c811b8bece2da711db50e091db57
  • VT reports: Detection ratio:24 / 56; Detection ratio:25 / 56 ( * variant of SystemTweaker, offering downloads of Advanced System Optimizer 3, RegClean Pro, and other 7 products.)
  • When it comes to RegClean Pro, see the following sponsored installs: Amazon Browser Bar, MyPCBackup (MyPC Backup), Advanced System Protector

4. PUA.DriverEasy = PUA.DriverNavigator

5. PUA.DriverPack, clean, so far. Contact Norton?

6. PUA.DriverScanner

  • MD5 b4a5221b9e2e98c3af3ebb6685726cf3
  • VT reports:Detection ratio:12 / 56 (e.g., Trojan.Kryptik!o33MBmVt8a4 by Yandex, W32.HfsAdware.F6D4 by Bkav); 
  • Bundled by KeyPlayer.

7. PUA.DriverSupport (from Slimware, personally), has a Detection ratio:1 / 56, which could be found after running adware installer.

8. PUA.DriverUpdPro, is the variant of Optimizer Pro (aka, PC Utilities Pro) or SpeedingUpMyPC (aka, GoFastPC) and/or Smart PC Cleaner (MD5, 72351c23793b32cb473256e45a96ea4d), which has Detection ratio of 26 / 56 now.

9. PUA.DriverWhiz = PUA.DriverSupport (by Symantec)

10. PUA.TweakbitDrvUpd (TweakBit Driver Updater), Trojan.Zbot.Win32.188628 by Zillya.

11. PUA.WinzipDriverUpdtr (WinZip Driver Updater)

MORE? DriverMax 7. Plz feel free to name it.

Closing information:

A PUP (potentially unwanted program) is a program that may be unwanted, despite the possibility that users consented to download (and/or install) it. PUPs include spyware, adware, and dialers ( * now, trojware, e.g., TweakbitDrvUpd, !), and are often downloaded in conjunction with a program that the user wants.

PUA.Drivereasy is a potentially unwanted application that displays misleading information about the computer's performance. It then asks the user to pay to fix the issues.

PS: PUP is different with (Computer) Virus.

PUA.Drivereasy should not exist as a Norton Virus "threat"

 A computer virus is a malware that, when executed, replicates by reproducing it self or infecting other programs by modifying them.

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

@20750065

The original PUA. Driver* "threat" reports are both false and misleading and you continue to want and demonize these classes of programs.

Use them, don't use them - but at least allow other individuals to install whichever programs they wish to - - that is after the reason why some of us wish to live in a free society to decide for ourselves  ...so please just troll elsewhere.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Dear All, 


This is Kevin from Easeware, the company that develops Driver Easy. Thank you all for your attention to this post and this issue, especially some of you have proposed some constructive suggestions to help Driver Easy be better, please allow me to extend me thanks to you on behalf of Easeware. 


We are listening and we have recorded the suggestions that you proposed, which are very valuable to us. We are working to improve our product and hoping that we could provide a better user experience than you are looking for. 


I personally adore computer technology industry very much. When I was a high school student, I built up a computer of my own, which was a AMD 486Dx100. My first job was to help people build their computers. The number of the computers built by me could count to thousand. Later on, I became a system administrator of a company and managed hundreds of computers. At that time, dealing with computer problem was a big part of my job, among which, solving driver problem was inevitable. 


If you are familiar with solving driver problem like me, you would probably find it a nightmare to see an "Unknown Device" in device manager especially when there was no Internet and the usual problem was caused by some missing drivers from the CD back then. At that time, the idea of finding a tool to save me from this abyss was taking root. This became the foundation of Driver Easy. 


I highly agree with @huwyungr that drivers are only supposed to be downloaded from official websites of the manufacturers when needed. That is why we only download drivers from the official websites and always take priority to collect drivers that have passed WHQL. (https://en.wikipedia.org/wiki/WHQL_Testing


This is part of the reason why Driver Easy have won the endorsement of many professional users, who are IT support members from big firms, owners of computer repair shops and even employees of hardware manufacturers. They are far more experienced than I am on driver issues. I believe that there are reasons why they choose to trust and use our product and continue to use our product for such a long time. 


When we first launched the first version of Driver Easy in 2010, it was only a simple interface product and there was only a free version. We keep improving and developing more features for the professional version and then Driver Easy becomes what it is now. But one thing never change, users are able to use Driver Easy to get the drivers they need for free. It should be made clear that the drivers free users get are the same with what the paid professional users get. The difference is that professional users enjoy more features, a better service and could save more time. 


So when notification of Driver Easy becomes

"PUA.Drivereasy is a potentially unwanted application that displays "misleading information" about the computer's "performance". It then asks the user to "pay to fix the issues. "

I found it so hard to understand. Then I made contact to Symantec as a CEO of Easeware by sending Symantec email after email, but as mentioned earlier, there was no helpful information from them. 


As the publisher of Driver Easy, we could not yet get the exact reason that could trigger this false positive. Despite so many speculations made by you and us, no one could tell exactly what went wrong. We could not express how frustrated we were when being ignored by Symantec. All we want to do is to find out the cause and try to improve it and make sure things like this will never happen again. 


This problem has gone now. But I would like to point out that if the process of dealing with requests like this remain unchanged, there will be more manufacturers like us taking unnecessary blames even though they are more than willing to get the problem fixed. 


Lastly, a million thanks to those who have made constructive suggestions to our product Driver Easy. Suggestions on this post will be followed up by us. 


PS: I'm not a native English speaker, so this message is translated by Sophie. 

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Kevin.Zheng:

Dear All,
This is Kevin from Easeware, the company that develops Driver Easy.
I highly agree with @huwyungr that drivers are only supposed to be downloaded from official websites of the manufacturers when needed. That is why we only download drivers from the official websites and always take priority to collect drivers that have passed WHQL. (https://en.wikipedia.org/wiki/WHQL_Testing

PS: I'm not a native English speaker, so this message is translated by Sophie. 

Dear -----,
Thank you for contacting Driver Easy Support. I appreciate the opportunity to assist you.
It is totally your choice whether or not to update your drivers by using Driver Easy. The program is not forcing you to do it.
We have cooperation with a lot of manufacturers who will supply us with the latest versions of drivers that have passed the WHQL but not yet released on their official website.
These are the drivers that we provide to our users.
Again, it is your choice whether to do it or not.
If we can be of any further assistance, please feel free to let us know.
Have a nice day.
Yours sincerely,
Sophie
Technical Support Department
mailto: support at drivereasy dot com

bold by me 

Windows hardware certification (aka Windows Logo Program for Hardware or WHQL) helps you build products that customers trust and want to buy.

https://msdn.microsoft.com/en-us/windows/hardware/gg463010.aspx 

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

bjm_:

bold by me 

Windows hardware certification (aka Windows Logo Program for Hardware or WHQL) helps you build products that customers trust and want to buy.

https://msdn.microsoft.com/en-us/windows/hardware/gg463010.aspx 

WHQL Driver Packages:

 

https://msdn.microsoft.com/en-us/windows/hardware/gg463010.aspx 

Driver packages that pass Windows Hardware Certification Kit (HCK) testing can be digitally-signed by WHQL. If your driver package is digitally-signed by WHQL, it can be distributed through the Windows Update program or other Microsoft-supported distribution mechanisms.

Obtaining a WHQL release signature is part of the Windows Hardware Certification Kit (HCK). A WHQL release signature consists of a digitally-signed catalog file. The digital signature does not change the driver binary files or the INF file that you submit for testing.

Obtaining a WHQL release signature consists of the following:

  • Testing the driver package with the Windows HCK to verify that the driver package is compatible with Microsoft Windows. Once the HCK is installed, the Driver Test Manager (DTM) is run to test and verify the driver package. For more information, see the Windows Hardware Certification Kit (HCK).

  • Submitting DTM test logs to the Windows Quality Online Services to obtain a WHQL release signature for the driver package. For more information, see the Windows Hardware Certification Kit (HCK).

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

I believe DriverEasy and through them Easeware have been going out of their way to attempt to resolve this situation in an open and fair manner. As a company producing commercial programs there is a somewhat large disparity between the size and hence power of Easeware versus that of Symantec/Norton - whose mode of operation here with respect to the PUA Category seems to be one of ongoing harassment of voluntarily installed application programs and the Companies producing them - the basis of which - the initial false and misleading so-called "threat" reports submitted to Symantec that would not hold up in a Court of Law.

Here we have a large Corporation (Symantec/Norton) establishing a mechanism (Virus/"threat" Reporting) without proper checks and balances which is now being used to wrongly delete/uninstall programs of a number of small commercial programs from PC's without asking the owners of those PC's and also simultaneously damaging the Interests of these program's Business owners. When the Business attempt to have Symantec/Norton remove their application from being considered a "threat" Symantec/Norton have another False-Positive mechanism also without proper checks/balances that is vague in response as to what the actual so-called "wrong-doing" is.

Any fair review of the initial threat report by a Subject Matter (SME) expert with respect to programs like Driver Easy  would have prevented PUA.DriverEasy from ever being considered as a true threat in the first place given the false and misleading nature of the initial "threat report". Disliking an application programs is not valid justification to then raise False "threat" reports against that application.

I am all for Symantec/Norton detecting true Viruses/Threats. I do not support the current situation where the reporting system has been misused to wrongly classify certain applications as PUA which then results in an automatic quarantine/removal of that application.

We should not be in this current situation where a number of applications have been wrongly classified as PUA all on the basis of false "threat" reports. This just allows the continued harassment of these application business owners and very many PC owners prevented from using these legitimate applications that have been wrongfully classified.

At the same time this further damages the integrity of Symantec/Norton AV system and its reputation.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

geoffc:  I believe DriverEasy and through them Easeware have been going out of their way to attempt to resolve this situation in an open and fair manner. 

... your situation regarding DriverEasy appears resolved....
I'm able to download/install/run DriverEasy.  
Even if DriverEasy was flagged as WS.Reputation.1 or PUA or XYZ. 
I'm able to download/install/run DriverEasy. 
Norton is not harming me nor inconveniencing me.
Quarantine Restore is easy option.  
Quarantine Restore with Signature exclude is easy option.
Norton Community reads your well represented thread. 
Symantec/Norton is not harming you or your favored program. 
Norton may not satisfy all users, all the time. 
Norton is mass market offered AS IS. 
DriverEasy is mass market offered AS IS. 
Thank you for sharing your concerns with the Community.  


Please rate your experience with Norton
Your feedback is valuable in helping Norton build better products.
Thank You

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

I would agree that since 5.0.5 of DriverEasy has been released and the Symantec AV dataset updated that DriverEasy 5.0.5 is no longer being quarantined or forcibly removed by Symantec AV - as far as I can tell.

That doesn't of course solve the underlying problem of PUA.DriverEasy in the first instance as it is likely that any future DriverEasy release may be as susceptible to quarantine/removal unless PC owners take active measures to prevent further issues from the AV scanner routines.

So - if there is an application program subject to a PUA. category that you wish to use - it is recommended that that PUA entry be placed on the ignore list - along with WS.Reputation.1. That doesn't preclude one of a myriad of other general AV catch-alls too - but that hopefully won't be necessary and Ws.Reputation.1 has its own uses too - so its being ignored too may not always be ideal for other program updates. Also ensure that ASK ME applies for all "threat" Removals - and that may work depending on how the "threat" has been classified.

This is a problem area that needs to be properly addressed as PUA.DriverEasy is just one among many with questionable "threat" reports - hopefully one day it will be.

In any event - the problem has been raised - a point version exclude for Driver Easy 5.0.5 applied and all is now right with the world

Despite what I see as some areas of difficulty with PUA and Symantec/Norton due to false "threat" reports- my preferred AV routine is still Norton Internet Security - one could also hope that there will be stronger "threat" vetting in the future to prevent further wrongful PUA reports.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Kevin

Thanks for

I highly agree with @huwyungr that drivers are only supposed to be downloaded from official websites of the manufacturers when needed. That is why we only download drivers from the official websites and always take priority to collect drivers that have passed WHQL. (https://en.wikipedia.org/wiki/WHQL_Testing (link is external)

It would help me to know if you can differentiate between say the graphics chip

ATI Radeon HD 3300 Graphics

on my ASUS  M4A78T-E (AM3) desktop motherboard and a similar chip installed in say an ASUS notebook or elsewhere and then go to the notebook manufacturer's website for update downloads rather than to the AMD website since the drivers may differ.

Thanks

Hugh
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Hello @Kevin.Zheng

If you fill out the Whitelisting form before you release a new version of your program, it will allow Symantec to test it out in advance of your release. If the program is clean, this should avoid any future issues like this one.

https://submit.symantec.com/whitelist/

Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.18.0.213 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

huwyngr:

It would help me to know if you can differentiate between say the graphics chip

ATI Radeon HD 3300 Graphics

on my ASUS  M4A78T-E (AM3) desktop motherboard and a similar chip installed in say an ASUS notebook or elsewhere and then go to the notebook manufacturer's website for update downloads rather than to the AMD website since the drivers may differ.

Thanks

To answer the question, please download the latest driver from AMD website, since I could not find any custom function on ASUS official website. 


Some manufacturers of the PC may have some added value features since using general features might loss some custom features. If you don't know what the custom feature is, it is more likely that you are not using it. So the advantages of the latest driver outweigh its disadvantages. 


In the example that you raised, the latest version of the driver for on ASUS website was released on 06/14/2009, version number is 8.630.0.0000. It was released by ATI for Windows 7 operating system. Actually there is another mainboard which was released in 2010 using the same chipset, but I could not find the driver for Windows 10 OS on ASUS website. AMD, on the other hand, released a driver for this chipset in 2012 (Windows 7) and 2015 (Windows 10). 


Here is a concept that needs to be made clear, product support life cycle. Generally speaking, there is a 1 to 3 years warrant for a product and the support life cycle of it is 5 years. In many cases, the update process for a driver is much shorter that the product support life cycle, which means that you might not get the latest drivers from official websites. 


Chipset manufacturers will keep releasing new drivers to their great many customers, who are mostly big companies like HP, Dell, Lenovo, ASUS, etc. But not all the chipset companies will publish their latest drivers on their own websites, Realtek is such an example. Some chipset manufacturers won't even publish drivers on their own websites, take Conexant as an example. 


In this example, Driver Easy will help you find the 2010 driver which was offered by ASUS, but we can add a deep scan function in the future, if this is what our customers want, and we will be able to help you get the 2012 or 2015 driver from AMD. 

PS: Thanks Sophie help me translated and reorganize this message.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Kevin

To answer the question, please download the latest driver from AMD website, since I could not find any custom function on ASUS official website. 

You won't for that graphics chip since it is very old -- current numbers are up in the 7000 I think and it's been a while since AMD did have an updated driver for that version of its chip.

I wasn't being nasty -- I just chose that graphics identity because its title was available to me via Speccy.

Speaking generically then there can be a difference between the same general version of a graphics chip installed say on an HP notebook and on a Lenovo or Toshiba notebook with what looks like the same chip.

So can you dig down and point a specific user to say Lenovo rather than to Toshiba or HP .... or an ASUS motherboard if that is what that user running your utility has .... ?

I ask because as I said earlier I do online support and many of my colleagues really are scornful of driver updating via a utility scan rather than having a problem ... or at least knowing that there is something that needs to be fixed whereas I tend to have a more empirical approach ....

So it seems that DriveEasy can tell me there is (or isn't so far as it is aware) a new driver but it won't go out and automatically install the newest driver "just because it's there"?  If it leaves the decision to the user then I might try it and see what comes up but because of the support work I do on this desktop I don't want to risk upsetting it!

Hugh
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Hi, Huwyngr. Thank you for your question. We believe that you are a very experienced computer user and a skilled technique support, that's probably why you would feel software like Driver Easy are not always as reliable as your experience.

When it comes to providing drivers, Driver Easy will automatically choose the best matched drivers for your computer. If this best-matched requirement could not be fulfilled, Driver Easy will then go to choose the second best, chipset.

As you can see here, Driver Easy is developed to make sure that people who do not know much about computer could enjoy the convenience that computer brings without being bothered by the trivial problem that drivers bring. We hope to help our users to save more time and more energy for something else and leave their driver problems to us, since we are more experienced than most of our users when it comes to drivers.

We add more features to it to make it more functional in every new version whilst simplify the operation so it would be very easy to use. We know that there are still a lot that we could do to catch up with the top-ranking companies, but we are working step by step to catch up.

We believe that a skilled and experienced computer users like you would not find it hard to tackle some computer problems like missing drivers, but this could be a horrible experience to some. Our goal is to help these group of users to fix their computer problem without casting much time or energy.

Again, thank you so much for your question. If you would like to have further discussion of any question with us, it is always welcome that you send us email to our email address <Support@drivereasy.com>. We look forward to hearing from you.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

why you would feel software like Driver Easy are not always as reliable as your experience.

It's not my experience from using such software but that of users who come along saying they downloaded, especially a new video driver, and now their PC does not work ...... Restoring the previous driver usually puts things right. These are not "trivial problems"!

These are just the unskilled users who naturally would tend to use automated solutions ..... 

I'm not against utilities -- I use them all the time when many of my colleagues go digging in deep and doing things manually. That's why I'm asking for clarification on whether you do identify at the detailed level the driver for the specific model of PC rather than for the generic name of the chipset.

And having identified the "best driver" does it give the user the opportunity to say "Not just now -- I'm busy" or "No thanks" ? 

Hugh
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

With DriverEasy - the first thing you do is run a scan. (I am describing Professional System)

Once the scan completes DriverEasy will match current with available drivers off their database and returns a list of all the current drivers with the ones there appears to be an available driver for at the head of the list.

You can then look at each of those available drivers and do nothing, click to examine the detail of that proposed driver and then from there decide to do nothing, install that driver manually or get the DriverEasy routine to install it automatically (though that driver install might still ask you to answer some questions) - then you can choose to update that driver which will result in the install file being downloaded and from there you choose to go ahead with an automatic install, or decide on a manual install from the downloaded file location.

Or you can select Update All for DriverEasy to automatically install all the listed drivers in the Automatic mode - which, without knowing necessarily what the offered drivers are, is not something I would recommend. On my main system with lots of devices there are 205 drivers total - 199 are up to date and 6 are in the list that have updates. Of those 6 updates 3 relate to my dual Nvidia590 graphics card plus audio driver, two are due to the HP Universal Printing PS driver being updated and I still have two printer devices running the earlier driver (old and new can coexist)  so don't strictly need to be updated - so these two I can "hide" so DriverEasy won't list them again - and the last entry is a new driver that has first appeared tonight for a Logitech download assistant for a USB device which makes little sense. That probably needs to be reported. I also have a couple of faulty USB devices - so this may be a partial solution to those entries.

However - the install files are just a cab file with no  documentation at all so not sure why this has presented. Something to escalate to Support. My first  preference is though to find the actual USB hub with faulty device and try and resolve that first as if the device is faulty a new driver won't really help.

This scan was only run so as to make sure I was describing its present operation accurately as DriverEasy is constantly being enhanced with slight changes here or there.

DriverEasy is also setup so that you can control which drivers you update and how you update. A RestorePoint is generally created with all Automatic updates of a driver so that there is always a fall-back if things go badly wrong.

There is also the free manual mode of operation about which I can now only vaguely recall - that was by design slower with the downloads, doesn't do the updates for you and is also lacking in other areas - but it has now been a number of years since I used that mode as I first subscribed to DriverEasy in 2010 so you would be best downloading DriverEasy and trying it in free mode to gain an idea of that mode for yourself. For the subscription cost involved, and the time it saves with determining obscure drivers DriverEasy is, in my view, quite worthwhile.  But, like all Driver Assistance programs be careful in choosing which driver to install as some systems may return results that cause the wrong driver files to be recommended and that might even cause the affected system to crash as a result - hence the reason to choose carefully and be prepared to use the Recover via the Restore Point option if needed.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

geoffc: With DriverEasy - the first thing you do is run a scan. (I am describing Professional System)

FWIW, I ran scan Permalink and will do nothing sans knowing specific issues I'm having that are specifically caused by each of my reported 21 devices that will be specifically fixed by driver update.  

Q: do drivers usually update wo system restart..? 
I can maybe try driver update in Shadow Mode if restart is not required.  
Otherwise, I'd need to image before (and test after) each of 21 updates and I'm not feeling any deprecation by 21 so called dated drivers.   
YMMV  Thanks

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Thanks Geoff for the detailed description which answers most of my questions .... if it applies to the free version as well!

Thanks also for confirming

But, like all Driver Assistance programs be careful in choosing which driver to install as some systems may return results that cause the wrong driver files to be recommended and that might even cause the affected system to crash as a result - hence the reason to choose carefully and be prepared to use the Recover via the Restore Point option if needed

If you don't know it's broke don't try to fix it ..... And ask your questions before and not after ......

Hugh
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

This is the reason I call them driver assistance programs and I would want to examine each of the drivers to decide whether that driver even needs to be updated, and whether if it is updated there are any adverse affects. You might be required to update the driver in order to support an updated Application install that requires certain new driver features.. And you won't know that until you try installing the new app. Plus the driver install routines will generally be those from the manufacturer of the original device - so if they are low level device drivers you may be required to reboot after removing the old driver before installing the new driver AND then again before installing any further drivers. While Microsoft has improved system patch chaining, the same cannot be said of PC's given the multiplicity of devices and coding techniques.

I would want to know what sort of driver is even flagged as requiring being updated - 21 dated drivers seems a lot - but multiple instances of the same driver could reduce that install down to a simple single pass install. It is all in the detail ..and knowing what to do.

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

geoffc:  I would want to know what sort of driver is even flagged as requiring being updated - 21 dated drivers seems a lot - but multiple instances of the same driver could reduce that install down to a simple single pass install. It is all in the detail ..and knowing what to do.

and does Driver Easy Pro know what to do....or, does follow-up with Driver Easy support guide user.   I was suspicious by 21 since home page drivereasy is 21. 
I didn't look.  Is there way to export scan to text for support/expert to review...?

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Hi @geoffc, @Kevin.Zheng & @Sophie.Luo,

Thanks for letting us know about this. I'm glad it has been fixed. As for the time to review, it's something our team is looking into. I've made them aware of this thread and your comments, so they can better understand the frustration. Thanks again.

Sunil_GA | Norton Forums Administrator | Symantec Corporation
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Driver Easy should just be using the driver setup.exe or similar type file that comes with standalone driver installation files. They need to have an escalated environment and then Create a new restorePoint - then run the installation program which, if necessary, will ask the user the questions that you as a user would running it manually. It would again depend on the driver if a silent installation file had been created - in which event there would be no questions.

Usually, in its simplest form, when updating a driver you have the new files in a directory and then a new-driver.inf file which you apply to upgrade the old driver installation. That inf file will then do whatever is required to upgrade the old drier - running other exe programs to make all the needed changes.

Where there are options there will be questions, if not it is pretty much an A, B, C approach and the install is complete.

If the install fails then the routine will uninstall the new driver automatically; if the error in the new driver was detected separately (by you because the system crashed on next boot) then it would be up to you to Run system restore and back-out that change.

So yes, that procedure is straight forward.

You are possibly using the free manual install scanner - so the result of 21 drivers needing updated if I assume what the display looks like is horizontal    drivers to update(21)   >  prompt - which if you click on, should produce a list scrolling downwards listing all the individual drivers.  so then header line will end in    V  with all 21 driver updates listed from there down.

Is that correct with the manual version you are using and its scan output?

So please try expanding the > arrow so it turns downwards like a  V

So for most of the drivers DriverEasy will follow standard procedures to Escalate to RestorePoint, install, it might ask was it ok Yes/No -if No the driver will be uninstalled via the restore method.

For others like more complex Intel drivers DriverEasy install files will include the relevant Intel driver install routines and special files including their setup.exe that they would use to install.

The big difference between the "free" DriverEasy and paid Professional version is that the Professional version handles creating all the restore Points and all the install from the driver file packages it specifies it will use.

Also - on the DriverEasy Window - with menu at lower left hand corner - immediately above those horizontal lines the icon is the submit button - click on that and you can raise a Support call and Deep Analysis if needed so that they can provide assistance with specific drivers.

However, I think if you expand all your needed driver updates that is only 10% of an expected total number of drivers of around 200 drivers - which is what my system has. I don't know if that is a typical number or not though.

If you can list the 21 entries - we should be able to explain most of them hopefully and it won't seem to seem so many driver updates being needed.

Kudos1 Stats

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

geoffc:  If you can list the 21 entries - we should be able to explain most of them hopefully and it won't seem to seem so many driver updates being needed.

Ran scan again before reading your latest reply.  Looked for export to text....no joy.
So, I did the export Deep and sent feedback that I'd like export to text...,etc.  
First I do on new machine is disable vendor updates. I've been borked by HP
So, updating devices when none are complaining is not my norm. 
Cheers

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Can you expand your total of 21 drivers needing updates  - summarized in one line to instead be at least 21 separate lines scrolling down the page by clicking on the >  ?

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

geoffc: Can you expand your total of 21 drivers needing updates  - summarized in one line to instead be at least 21 separate lines scrolling down the page by clicking on the >  ?

been there, done that....after each scan.  I've explored Free product.  Not finding export to text scan results. Not finding export to text detailed info.   

Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

I reversed mine - down from 12 lines to 1 just by a single click.

Please see pdf - was only way I could see to easily show this

Screen Print into Word isn't that user friendly either.

File Attachment: 
Kudos0

Re: False Norton "Threat" PUA.Drivereasy uninstalls legitimate Windows program !!

Sorry - stupid question time - of course you did

- you can do screen prints but way too messy as an option

and it still doesn't display a lot of useful information

If this is a brand name PC -  I would be trying to search for exact drivers on brand website not necessarily relying on DriverEasy as brand may have a better match - and/or fixed other issues.

Where I am looking for an updated motherboard chipset driver - that is where Drivereasy can find them on a similar PC with same chipset which I would not have a hope of finding.

But I also like to know where the driver has come from and if it isn't clear i would rather not risk it.

My main PC is fairly stable - so swapping key drivers out can cause some real pain when random BSOD start happening afterwards.

This thread is closed from further comment. Please visit the forum to start a new thread.