Disable Auto-Protect Grayed Out

Archive
1

Norton 360 'Disable Auto-Protect' is grayed out. Not only can I not disable it via right-click notification icon, but per my attached screenshot, it's grayed out within the app itself.

Guess my question is... When it's grayed out, is that service inactive, or still active? If inactive, why is there not a notice of some sort that the function is not accessible? Either way, Norton needs to fix this!

I see this issue for several others, going back years. Why can't Norton come up with a relatively simple solution to this, other than restart PC every time?

What's interesting, 'Disable Smart Firewall' is NEVER grayed out.

2
rawintellect43952:

Yes. And after doing the steps I mentioned it is no longer greyed out. And yes this began with 22.24.5.6.

Ahh....began with 22.24.5.6 and normal Restart (not Shut down) did not clear greyed out?  
You needed your steps to clear greyed out.  I asked because I had a greyed out event with 22.24.5.6 that cleared with normal Restart. 

Thanks

3

Yes. And after doing the steps I mentioned it is no longer greyed out. And yes this began with 22.24.5.6.

4
rawintellect43952:

This is definitely a bug. To work around it open Norton 360. Open settings. 
(1) Click Antivirus.
(2) Click the "Boot time protection" drop down menu. Select off. Click apply. Click back.
(3) Click Administrative settings. Scroll down to "Product Security." Next to "Norton Tamper Protection" Turn it off. Click apply.
(4) Close the window. Do a manual product update and reboot.

The option should no longer be grayed out.

I realize this isn't a fix. But it's the best I could come up with until Norton fixes this issue.

and did you have Disable Auto Protect greyed out that would not clear ... with Restart (not Shut down) machine &or after 22.24.5.6 patch? 

5

This is definitely a bug. To work around it open Norton 360. Open settings. 
(1) Click Antivirus.
(2) Click the "Boot time protection" drop down menu. Select off. Click apply. Click back.
(3) Click Administrative settings. Scroll down to "Product Security." Next to "Norton Tamper Protection" Turn it off. Click apply.
(4) Close the window. Do a manual product update and reboot.

The option should no longer be grayed out.

I realize this isn't a fix. But it's the best I could come up with until Norton fixes this issue.

6

Re: Boot Time Protection
https://community.norton.com/en/comment/8034691 19-Nov-2018

7

Had another Auto-Protect gray'd.  I think gray'd was related to unsigned program update...where installer removed old version and installed new version. 

Boot Time Protection changed from Normal to Aggressive *  

Restart returned Boot Time Protection to Normal.  

8

raised9:
it was again red flagged, blocked, and quarantined again.

Report a suspected incorrect detection to Norton
https://support.norton.com/sp/en/us/home/current/solutions/v126152382

Submit a file or URL to Norton
https://support.norton.com/sp/en/us/home/current/solutions/kb20090602171902EN

Respond to incorrect Norton alerts that a file is infected or a program or website is suspicious
https://support.norton.com/sp/en/us/home/current/solutions/kb20100222230832EN

Please tell us what Norton is telling you regarding this event.
For information regarding this event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste here.

For second opinion choose File &/or Search hash at VirusTotal 

9

I think my issue was different. My program is used to automatically check daily for software updates for my music studio recording devices. My old Norton didn’t red flag it but when I upgraded to Norton 360, it was blocked and quarantined. This was done by Norton’s Behavioral Protection for "Suspicious Activity" so I excluded it and this was about 4 years ago. Now on May 21, 2024 it was again red flagged, blocked, and quarantined again.

 

IMHO this had to be some error I couldn’t find but so far, everything appears to be running well.  

10
SoulAsylum:

Wintoys installer ran. Flagged by download insight although, already downloaded months ago never installed. Boot-time settings did NOT change to aggressive.



I'm thinking "flagged by"....Attention required - Detected by: Download Insight = Show Report on Launch of Files > Always

fwiw ~ my BTP remained Normal.  Auto-Protect is not the engine. 
Attention required is not *pending protection analysis... Restart...event. 

11

Wintoys installer ran. Flagged by download insight although, already downloaded months ago never installed. Boot-time settings did NOT change to aggressive.

image_2024-06-02_161730995.png

SA

 

12

as test:  BTP = Aggressive to Normal - 28-May-2024

`````````````````````````````````````````````````````````````

01-Jun-2024 - Norton Data Protector objected to .tmp file created by KeePass 2.57 install. 

Category: Data Protector
Date & Time,Risk,Activity,Status,Recommended Action,Status - Details,Program Path,Program Name,Date & Time - Details,Action Observed,Target
6/1/2024 4:52:40 PM,High,Data Protector blocked a suspicious action by KeePass-2.57-Setup.tmp,Action Blocked,No Action Required,Action Blocked,C:\Users\bjm\AppData\Local\Temp\is-GNGSR.tmp\KeePass-2.57-Setup.tmp,KeePass-2.57-Setup.tmp,6/1/2024 4:52:40 PM,Suspicious process attempted to open a file protected by Data Protector,C:\Windows\Microsoft.NET\ngenserviceclientlock.dat

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Boot Time Protection changed from Normal to Aggressive *  
Auto-Protect gray'd On *
* These settings cannot be changed at this time due to pending protection analysis.  Restart your computer to resolve this issue.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Filename: KeePass-2.57-Setup.exe
Full Path: C:\Users\bjm\Desktop\KeePass-2.57-Setup.exe

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

Good
Norton has given this file a good rating.

Source File: 
KeePass-2.57-Setup.exe

File Thumbprint - SHA:
ea53f7f944fada950cd7bb154deb078123a357b7bc5e2484851762b3552eb48b
File Thumbprint - MD5:
4c1cafc2b3a380208548620a3d53dbba

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
with machine Restart

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Security History

13

"Off" is the default for Boot Time Protection.  There are two situations where Norton will automatically set BTP to "aggressive" when restarting: if it has notified you that a restart is required to remove a threat that Norton has detected, or if it has notified you of a suspicious file that needs to be scanned during the next boot.  Have you gotten any warnings from Norton about either of these situations?  Either way, I would shut down the machine and start it again to see if that clears whatever is prompting Norton to enable BTP.  Once Norton has dealt with the threat or suspicious file, it should automatically reset BTP to "off."  (credit: SendOfJive)

 

https://community.norton.com/en/comment/8507693#comment-8507693 04-Jul-2021

14

Norton kicked out a high-security alert that it had blocked a file and I was able to find and resolve quickly. As I stated before the status of the file had changed from excluded, to high-risk, and back to excluded again. The only thing I did was a manual scan on the file.

 

At this time I didn’t restart and it wasn’t until the next day that I even noticed the Disable Auto-Protect button was greyed out. Next I restarted my PC but the button remained non-clickable. This shows me there’s a glitch in some program. Could be Norton, could be Windows, could be anything. At least setting Norton Boot Time Protection to OFF and restarting, cleared it for me.

15

Early Launch, aka boot time scanning scans only the files the OS loads my side. Nothing is detected. No other entries are in history showing detections either so I am confused as to what is the actual cause. A simple software update should NEVER trigger boot time changes without a notification and user actions. Conversely I am watching Edge Webview, Edge and Opera GX updates as possibilities. The other software that updates itself is Adobe, I usually find its desktop icon moved with it has updated but have never correlated it with any settings within Norton changed when it updates.

boot time scan results.jpg

SA

16

My issue was a seldom used OLD program that Behavioral Protection started listing as “High Risk” and Norton would block it. I excluded it years ago and it only peeped up again 5/21/24. I manually scanned it and Norton verified it safe, and it also rated the status back to excluded once more. Go figure?

IDK just guessing but the OFF setting could be a reset inserted by developer(s) to clear pre-boot errors.

17

I'm giving my daily machine a bit more time to validate but as it appears currently, your suggestion sticks. 

SA

18

Well mine is still up and running with no asterisks or greyed-out buttons.

19

Yet another instance a single day later after the last: Zero software updates to any software installed on this system. Zero entries in Norton History suggesting updates that would change the install took place. Zero error reporting entries. I will try raised9 suggestion and see what my results are. 

Boot time is aggressive less than 24 hours from last time.jpg

SA

20

While attempting to set the Boot Time Protection to Normal for the millionth time I finally noticed some print at the bottom of the page. After finally scrolling down because you can’t see it when viewing the upper settings, it says…

*These settings cannot be changed at this time due to pending protection analysis.  Restart your computer to resolve the issue. (Notice it has an *) which is actually for the settings above with an *. After trying Aggressive & Normal all day I decided to try the Off setting. Why? The others revert back but Off stays on Off. It isn’t recommended and does not run @ boot, so there is some risk. Here’s more info…

Learn more about Boot Time Protection (norton.com)

I set the Boot Time Protection to “Off”, RESTARTED my PC, and the Norton Disable Auto-Protect button once again was clickable. Next I went to 360 and set it back to AGGRESSIVE. The message at the bottom of the page was also gone. Then I SHUTDOWN and booted up cold + restarted several times, and it still works for me. I hope this helps others and I think I know the source. I’ll check back in when I get some rest.