Antiphishing updates not updating

[JFernan488]

cgoldman-  I'm attempting to further isolate the problem by doing the following:  All the previous times I removed and reinstalled NIS2009, I did it from the CD.  That installed the old version of NIS09 which was then updated by Live Update to the current program version 16.5.0.135.

 

This last time, I uninstalled NIS09 using NRT (as I had done before), downloaded NIS09 Verision 16.5.0.135 directly from Symantec's website, in essence, bypassing the program update done by Live Update in my previous attempts.  I going to give the system a few hours to do the updates by itself, without me initiating a manual live update session.

 

I will post the results when i get them.

 

Thanks

[Compumind]

Hi -

 

Did your post above solve your problem?

 

Please advise.

 

[JFernan488]

I found something interesting.  After the non-updating computer finishes updating NIS09 from 16.0... to 16.5.0.135, the catalog for the web protection definitions (antiphishing updates) is up to the latest version at the time.  Then after that, Live update does not check for updates anymore as the catalog is removed from the list to be checked.

 

Below is a screen shot of the working computer, when it updated via manual live update this morning.  See that the web protection defs catalog is on the list to be checked, and then you can see in history when it was downloaded.

 

 

And the history...

 

 

Here's the screenshots from the non-updating computer...

 

 

Notice that the web protection defs catalogs are not there.  Obviously, the defs will not update ever if Live update is not checking for it.

So after the update by live Update from 16.0... to 16.5.0.135, the web protection defs get updated once by LU, and then the catalogs are dropped from the list, preventing LU to check for web protection defs (antiphishing updates) ever again.  Unless you do what I have been doing.  uninstalling and reinstalling NIS09 every couple of days.

 

Can someone at Symantec explore this issue further?  Obviously it is not happening to every system out there, but I have a feeling that a lot of people have this problem, they just do not know it.

 

Thanks,

JF

 

[edit: Resized images to fit screen.]

Message Edited by shannons on 03-27-2009 07:41 AM

Message Edited by JFernan488 on 03-27-2009 11:31 AM

[mab57]

I have 2009 Norton Internet Security, 16.5.0.135. When I check the Norton console, it says my last anti-phishing update was back on Friday morning on March 20th. This was just before I got the new update. Since I got the new update, my anti-phishing definintions have not been updated. This can’t be normal. I still have the green arrow on my console & it says that I’m secure. The Norton toolbar looks fine & anti-phishing is turned on. Everything else seems to be working fine since the update. Shouldn’t my anti-phishing have been updated in 6 days? 

[JFernan488]

Hi, I'm having the same issue.  I have a thread going on this.  See http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=42222

 

You can try all the suggestions...

 

They have not worked for me.  Hopefully, Symantec will figure out what's going on soon.  The only way for me to get the updated antiphishing definitions is to uninstall, and then re-install.

 

Good luck!!!

[mab57]

Thank you! I hadn't seen that earlier thread. I may try uninstalling, then re-installing or I may just turn off anti-phishing untill Symmantic gets this fixed & use the Firefox & Internet Explorer phishing filters. This obviously has something to do with the new update. This never happened with me before the update. Do you have a link to get the Norton Removal Tool?

 

 

 

 

[JFernan488]

Hi, here's the link for NRT:  http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

 

Follow the other thread as I found something interesting...

 

JF

[JFernan488]

Everyone...Please see message # 23 above.  Somehow a thread was merged with mine and the message is behind the merged ones.

 

JF

[mab57]

I uninstalled NIS 2009 with the Norton Removal Tool & then re-installed NIS 2009 using Symmantic’s website. How do you tell what current definintions number & date are currently installed? Pulse updates are working fine, but I can’t tell what the anti-phishing definitions are right now.

[ghidorah68]

Hi guys, first post here...

 

But I'm not getting the AntiPhishing updates AT ALL!  Mine says never updated.   I just re-installed NIS2009 and noticed that it hadn't been updated and was concerned. 

 

Has anyone figured this out yet?  

 

If there's quite a few of us getting this error, it must be something to do with the program and not something on our end.  I hope it gets figured out quickly.

 

Thanks

Chuck

 

[Compumind]

Hi folks -

 

I would like to request that a Symantec Rep take a look at the history of this thread and lend assistance.

 

Hang tight.

 

Chuck - did you try a Manual Live Update, yet?

 

 

 

 

 

 

Message Edited by Compumind on 03-27-2009 11:32 PM

[ghidorah68]

Yes, I've tried everything...I noticed in my history that the Intrusioin Prevention Engine version is 4.1.0.61 Definitions Set Version 20090318.001 Intrusion Prevention is monitoring 1337 signatures. Driver version 9.0.3.10

 

It looks like it is just stuck at that.  I assume it is still working but not with updated signatures.

 

I really do think they need to check this out.

 

Thanks for the help though...

Chuck

 

[Compumind]

Chuck -

 

Look at the History Logs.

 

When was the last successful update?

 

[ghidorah68]

It doesn't actually say that there was a successful update..see below.

 

[Compumind]

Hi -

 

Did you ever try to cleanly uninstall and reinstall NIS 2009?

 

Your pics above don't make sense.

 

[ghidorah68]

I'll try doing an a fresh install and then post an update....

 

 

[Compumind]

Hi -

 

Did you do it *cleanly* ?

 

Hope so, Chuck.

 

Let us know.

 

[mab57]

When you say "clean" install, do you include Safe Web? I used the Norton removal tool yesterday, but it didn't uninstall the beta version of Safe Web. According to my program list, Safe Web now on my computer was installed back in October, when I originally installed NIS.

 

By the way, I checked my history in NIS & my definitions are exactly the same as Chuck's. 30090318.001. Since I re-installed yesterday, there have been no new anti-phishing updates. There have been none since the new 16.5 update. 

 

Anti-Virus & pulse updates are fine. I now have SONAR & tamper protection, which I didn't have before the update. The phishing filter is working, but on old definitions.

 

There must be more people with this problem. I never would have known this if I hadn't checked the CPU Usage and seen that anti-phishing updates were 6 days behind. NIS still says that I'm secure, even though I know I'm not really completely secure.

[ghidorah68]

Ok..here's my update..this is like a soap opera...

 

I uninstalled the normal Windows way through the control panel.  That went fine no problems.  Then I used the Norton Removal Tool.  No problems.

 

I think, in my opinion, that it still does leave traces of itself on your computer even after the NRT.  I turn on show hidden files and if you go to Program Data you can see, what I believe is, your install history.  

 

So, I do have a question though.  Is IPS the same thing as AntiPHishing.  I don't believe so.  I have a virtual machine set up with Norton 360 V3 and it is working beautifully although I don't really care for it.  I don't have it on my main PC....

 

I must say though, I am very impressed with NIS2009.  I love how light it feels.  

 

I've always been a NOD32 user (I hope I can say that) but switched back to Norton after trying NIS2009 out.

 

Just please update my AntiPhising definitions....

 

I know they will fix it soon.

 

Let me know what you guys think.

Chuck

 

[JFernan488]

Hello,

 

The IPS definitions are not the antiphishing definitions.  The antiphishing defs fall under web protection defs.

 

From what I can see happening on my computer that updates without a problem, the web protection defs are updated two to three times A DAY.

 

As of right now, on the computer that updates, the antiphishing defs (web protection defs) have a version # of 20090328.001.

On my other computer that does not update the web protection defs, the version is sitting at # 20090327.002, which is what it got after I uninstalled and reinstalled NIS09 yesterday afternoon.

 

The problem, as I have been able to determine, starts when NIS09 gets updated by Live Update from version 16.0.0.125 to version 16.5.0.135.  Right after that update, and the required reboot, the instruction to check for web protection definitions gets deleted from the master list of update checks that Live Update does.  As a result, unless that instruction gets added to the list of checks for updates, then Live Update will never update the web protection definitions because LU doesn't know it needs to check if a new version of the definitions is out.

 

I can see it clearly in the LOG.LUE from yesterday on my non-updating computer.

 

I will be more than happy to forward the complete log to a Symantec employee, then they will be able to see in the log that the instruction to check for web protection definitions is missing right after the upgrade to version 16.5.0.135.

 

The thing is, the status of NIS09 will remain green, even thought in reality, you have outdated web protection definitions on your system.

 

You can navigate on your computer to C/program data/norton/{program identifier}/norton/definitions/webprotectiondefs/

The folder under webprotectiondefs is the latest defs.  For example, on my nonupdating computer, that forder is 20090327.002  that's from yesterday.  On my computer that updates fine, that folder changed this morning to 20090328.001, after a live update was done and new antiphishing defs were downloaded.  By the way, If new antiphishing defs are downloaded, it shows in the history window of NIS.

 

Once again, I ask a Symantec employee to investigate the reason why after the update to 16.5.0.135, the instruction to check for web protection defs is dropped from the list of update checks to be done.

 

Thanks,

 

JF