Data Protector Stopping Program installation - Suspicious Process

[Meatball]

Product & version number: N360 22.24.8.36
OS details: Win10 22H2

I attempted to install a program which is a music hardware editor. Norton data protector stopped the installation saying: "

“Suspicious process attempted to modify attributes of a file protected by data protector”

I would like to know which file this program attempted to modify. In the Advanced Details window, there is a box titled “Target”. Is this the file that the program attempted to modify?

On my system, Data Protector is on but I have not configured any specific files or folders to be protected, I have just left the defaults. The default folders are only in the "C:\Users" folder.

Here is the dump of the error:

Date & Time,Risk,Activity,Status,Recommended Action,Status,Program Path,Program Name,Date & Time,Action Observed,Target
10/28/2024 12:12:20 AM,High,Data Protector blocked a suspicious action by FIEditor.exe,Action Blocked,No Action Required,Action Blocked,C:\Program Files\panda-Audio\FIEditor4\FIEditor.exe,FIEditor.exe,10/28/2024 12:12:20 AM,Suspicious process attempted to modify attributes of a file protected by Data Protector,“C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FIEditor.exe_937a6e6f495e5ad223d18bf7fa7d5f86f08d48_c4afc5aa_e9a6f545-7c66-43cc-882e-a2a9d221b861\Report.wer”

It appears that the target was a file named Report.wer in the folder:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive.

This doesn’t make much sense. This folder is not a protected folder and why would a program attempt to modify a Windows Error Reporting file?

Can anyone offer any insight into what is going on here?

[bjm]

@Meatball

I attempted to install a program which is a music hardware editor. Norton data protector stopped the installation saying:

“Suspicious process attempted to modify attributes of a file protected by data protector”

panda-Audio\FIEditor4\FIEditor.exe

Is this clean install or update over install?
I’m wondering if the installer crashed & Windows Error Reporting is noting the crash…Or, if Data Protector objected and Windows Error Reporting noted the app crash.

Is this your file?
https://www.pandamidi.com/support

File: FIEditor412Setup.exe
File size: 415 KB (424,960 bytes)
MD5 checksum: 929E61324F868045B490EA2C96B2F799
SHA256 checksum: 6805FB3F16F309D8D29542CAB2D9C911998E174666C15C2C444BCC1A2C36365A
Date/Time: 10/28/2024

are you installing for Everyone or Just you?

Note: file is not signed

Note: I’ve needed to disable Data Protector to install known safe. Just me.
I’m v24 now…so, I’m not seeing Data Protector object.
Caveat: I’ve no experience with FIEditor412Setup.exe

[bjm]

[bjm]

[Meatball]

BJM,

Thank you for such a thorough reply!

This is an update over a previous installation, which was version 4.03. In my case, the installation completed successfully. Data Protector objects when I try to run the program.

Yes, you have the correct file.

I installed for Just Me, which is the default selection.

Did the Data Protector object to your installation before you disabled it, it sounds like it did.

I don’t understand what you mean by “v24 now”. Can you explain that?

The screenshots show that the installation was interrupted. Was that a crash?

My browser warned me that gg.index.hu was not secure, but Norton didn’t. I wonder why.

Thanks again

[bjm]

@Meatball

I installed for Just Me, which is the default selection.
Did the Data Protector object to your installation before you disabled it, it sounds like it did.

I don’t understand what you mean by “v24 now”. Can you explain that?

Data Protector feature/engine is with Norton Security/360 v22
I’m Norton Security/360 v24
v24 does not have v22 Data Protector feature/engine.

Note: I ran installer again for Everyone

[bjm]

Introducing Norton Security v.24!

[bjm]

@Meatball

My browser warned me that gg.index.hu was not secure, but Norton didn’t. I wonder why.

Norton v24 Browser Protection feature/engine warned me when I clicked on download link.

Microsoft Defender SmartScreen warned me about download.

Norton Safe Web reports Safe
https://safeweb.norton.com/report?url=https://gg.index.hu

[Meatball]

BJM,

You have been very helpful. Do you think the source of my problem is simply the v22 Data Protector?

Even though the server is not secure, I think the creator of the software is very trustworthy.

Do you see any reason not to make an exception within the Data Protector so that I can use the program?

It may be a while before v24 is rolled out.

Would you recommend doing a clean install and installing for Everyone?

[bjm]

@Meatball

Would you recommend doing a clean install and installing for Everyone?

I’d feel better with clean install vs update over install.
I can’t say one way or the other re Everyone.
I’d never touched FIEditor412Setup.exe until just now.

@Meatball

Do you see any reason not to make an exception within the Data Protector so that I can use the program?

all I can say is…for known safe installers. I’ve needed to temporarily turn off Data Protector.

@Meatball

This is an update over a previous installation, which was version 4.03. In my case, the installation completed successfully. Data Protector objects when I try to run the program.

Hmm…then I’m thinking maybe Data Protector objected to files moving around…4.03 to 4.12
&or maybe update flow was a tad stubborn.

If I trusted 4.12. I want a clean install now.

[Meatball]

BJM,

I think I may have found the problem. I went to uninstall the program and discovered that every previous version of the program was still listed in the Program Manager. I uninstalled all of them, restarted, clean installed 4.12 for Everyone and now it works. I should have noticed this sooner.

I can’t thank you enough. You have been very helpful. Thank you again.

[bjm]

@Meatball

I think I may have found the problem. I went to uninstall the program and discovered that every previous version of the program was still listed in the Program Manager. I uninstalled all of them, restarted, clean installed 4.12 for Everyone and now it works. I should have noticed this sooner.

Yes…see my Hmm comment here

[Meatball]

Yes, right on. You win the internet today! Lol

Thanks

[Meatball]

FYI, my Norton just updated itself to v24! What timing!

[bjm]

@Meatball

It may be a while before v24 is rolled out.

When v24 comes your way.
v24 Ransomware Protection is akin to v22 Data Protection.

Protect your data from Ransomware threats [here]

[Meatball]

You were reading my mind! I was just looking for Data Protector in v24.

Thanks

[bjm]

pandamidi.com offers downloads on gg.index.hu

https://www.pandamidi.com/support

FI Editor v4.12 Windows 64 bit
http://gg.index.hu/pandamidi/FI411/FIEditor%20v4.12%20Windows%2064bit.zip

[bjm]

@Meatball

FYI, my Norton just updated itself to v24! What timing!

Learn more about Real-Time Protection [here ]

Learn more about Antivirus settings [here ]

Learn more about Quarantine [here]

Learn about the Advanced Security settings [here]

Learn more about Intrusion Prevention [here]

Learn more about Browser Protection [here]

Learn more about Smart Firewall [here]

Learn more about Exploit Prevention [here]

Learn more about Sandbox [here]

Learn more about Norton browser extensions [here ]

Protect your data from Ransomware threats [here]

Keep your Norton device security up to date [here]

Update your programs with Norton Software Updater [here]

Configure access settings for your webcam with SafeCam [here]

Optimize and defragment your computer with Optimize Disk [here]

Respond to the man-in-the-middle attack alert [here]

Learn more about Email Protection [here]