Data Protector keeps blocking executable even though it is listed on exclusion list

Archive
1

Hi,

(This is a follow-up to https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list because of not being able to uploading logs there for more than 3 months. Neither via NortonMAT (admin not able to access data) nor upload to the forum thread (AJAX HTTP error occurred). Very frustrating. Trying to upload logs here upfront.)

I have an executable that is triggered by an SVN source code client on updating the working copy, a so-called hook script, implemented as executable (.exe) rather than a true script. The hook is triggered each time the working copy shall be updated. The hook's job is to set some file's time stamp to the original time stamp when the file initially got added to the repository, i.e. the executable modifies some file's time stamps.

Norton 360 Data Protector detects this as "suspicious process has tried to modify the attributes of a Data Protecter protected file" (translated from German) and blocks the hook's executable. So far so good. I then added the executable to the exclusion list [Antivirus > Data Protector > Excluded Processes]. Still good.

But then, even after having restarted the system, Norton360 Data Protector still blocks the hook's executable. I think this is a bug in Data Protector.

The only way to circumvent this is to disable all file extensions for Data Protector [Antivirus > Data Protector > File Types].

Attachments:

  • This screenshot shows subsequent blockings. The screenhot clearly shows that Norton "knows" the process is on the exclusion list, indicated by [Aus Ausnahmen entfernen] = [Remove from exclusions].
  • This screenshot shows that the process in question indeed is listed.

Please fix ASAP, or let me know how to work around this issue.

Norton 360 22.22.11.12 on Windows 10 21H2.

Thanks,
Matthias

PS: Tried to upload the .sbdz/.zip log as "<FileName>.zip[is_the_true_extension].pdf", but again failed:

An AJAX HTTP error occurred.
HTTP Result Code: 503
Debugging information follows.
Path: /en/file/ajax/field_file_attachment/und/form-EZGuV6mhJXmSynO2JEAZqb1HKTbZjtOhtOVR84MNY3E
StatusText: first byte timeout
ResponseText:
503 first byte timeout
Error 503 first byte timeout
first byte timeout
Error 54113
Details: cache-fra-eddf8230126-FRA 1678822840 1069446883
Varnish cache server

2

Test

3

I am sorry, but the bugs in this forum really makes it hard to achieve what a user wants. Now I unintentionally created the same thread twice (this one and https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list-0) where both threads surprisingly have the .zip attached as .pdf even though an "AJAX HTTP error occurred".

Note that this thread has the Application Blocking, Windows 10 labels whereas https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list-0 misses them.

Please mark one of the two threads as duplicate, as well as the original https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list.

4

I am sorry, but the bugs in this forum really makes it hard to achieve what a user wants. Now I unintentionally created the same thread twice (this one and https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list-1) where both threads surprisingly have the .zip attached as .pdf even though an "AJAX HTTP error occurred".

Note that this thread misses the Application Blocking, Windows 10 labels whereas https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list-1 has them.

Please mark one of the two threads as duplicate, as well as the original https://community.norton.com/en/forums/data-protector-keeps-blocking-executable-even-though-it-listed-exclusion-list.

5

Hi Gayathri, just did as requested.

Looking forward to hear whether you find the root cause of the issue and provide a fixed version or workaround.

Best regards,
Matthias

6

Hi,

Thank you for your post. I have sent you a private message requesting additional information. Could you please check your inbox when you get a chance? Thanks.