I develop Windows EXE executable files and use Microsoft Visual Studio (in Admin mode) to debug them. Whenever I try to perform a file update, e.g. change the File Creation Date, the file process is constantly being intercepted by Data Protector. Sometimes Norton reports this, but often it does not. I am using Windows 11 Pro, Ver 23H2. (The Exclusion List used to work some months ago, but I don't know at what point it stopped working because I wasn't trying to do File operations until recently.)
Both the EXE and its containing folder have been added to the Exclusion List and, in Details.
I have also clicked the "Trust Now" link.
I have tried turning off "Automatic Protection".
For some reason Norton won't allow me to add one particular exe in Process Exclusions(?)
So, if I delete the exclusion history, add the exe and folder to the exclusion list, restart the PC, open Visual Studio as Administrator and then run the exe, it SOMETIMES runs ONCE. Clicking "Trust Now" seems to make no difference. It usually only displays the "Potential Threat Blocked" dialog once. No matter what, if I run the exe again, even a few seconds later, it just fails, without displaying any notification from Norton software. Sometimes the "Fail" message asks if I want to REMOVE the Exclusion and sometimes whether I want to ADD to the exclusion list
Norton doesn't actually stop the EXE files from running, it only interferes when I try to change file metadata mid way through the execution. (I can't reproduce this, but, strangely, in my many attempts to fix this, I've found that it does sometimes work okay!)
Category: Data Protector
Date & Time,Risk,Activity,Status,Recommended Action,Status - Details,Program Path,Program Name,Date & Time - Details,Action Observed,Target
21/07/2024 12:49:45,High,Data Protector blocked a suspicious action by AddLangToSnippets.exe,Excluded,No Action Required,Excluded,C:\Users\kingl\Documents\Visual Studio 2022\Projects\AddLangToSnippets\bin\Debug\AddLangToSnippets.exe,AddLangToSnippets.exe,21/07/2024 12:49:45,Suspicious process attempted to modify attributes of a file protected by Data Protector,C:\Users\kingl\Documents\Visual Studio 2022\Test Area\TEST.txt
`````````````````````````````````````````````````````````````````
Sorry, I was hoping there was a .tmp file (for example) or related anomaly annotated.
Sorry, hopefully Norton support can get you sorted.
I'm thinking Norton Data Protector is working, as designed.
Looking at the History, I realize that Norton is protecting these files because, of course, they are within the protected "Documents", "Pictures", etc., folders. I think it's not the EXE it's objecting to, it's the file actions that EXE is trying to undertake to files in protected folders. I had thought Data Protector should ignore all actions made by excluded EXEs, otherwise what is the point of the exclusion list.
Yeah, process exclusions should allow all related process activity.
Again, thanks for your help. I cleared the History, reproduced the problem, and attached the History file. To explain (#6), these EXE files are changing the attributes of windows files or folders, e.g. I may wish to change the Creation Date of a file to its LastWriteTime, if that date is earlier. (Real world example: If you copy a file from one folder to another, for some reason the copied file's creation date is set to "today" instead of retaining the (correct) original date.)
Looking at the History, I realise that Norton is protecting these files because, of course, they are within the protected "Documents", "Pictures", etc., folders. I think it's not the EXE it's objecting to, it's the file actions that EXE is trying to undertake to files in protected folders. I had thought Data Protector should ignore all actions made by excluded EXEs, otherwise what is the point of the exclusion list.
This also means that your idea of a "work product" folder would, in this instance, miss the point of the EXE because it is supposed to be used on "live" files and folders in the main data area.
maybe, Norton objects to unsigned .tmp files created by your program.
maybe, Norton objects because your program is not signed.
as noted earlier - I've needed to disable Data Protector temporarily to install known safe programs.
Just not worth trying to figure out what .exe is causal...since, it's those darn unsigned .tmp files created by installers.
and \Documents\ is a protected folder.
Um, can you move your "work product" folder" to C:\work_product
Caveat: I'm not exe developer nor use Microsoft Visual Studio
The thread replies are crossing. I'll simplify what I've done:-
Cleared all History
Scans & Risks - Exclusions / Low Risks
All EXE files currently required: Added
All folders containing EXEs: Added
Visual Studio IDE Folder (I'll try to remove this later): Added
Data Protector - Process Exclusions
All EXE files currently required: Added
Turning Data Protector OFF removes problem: Confirmed
Opening Visual Studio as Admin makes no difference: Confirmed
Norton will not allow Windows file info operations: Confirmed
The Security History displayed at the moment of failure time confirms the EXE is "Excluded": See Screenshot
~ regarding #2.
Since, you've either created a work projects folder and excluded same x 2 = Scan Exclusions & Real Time Exclusions. Or, you've excluded All related files/folders x 2 = Scan Exclusions & Real Time Exclusions & you've added all related Data Protector - Process Exclusions & you've confirmed Data Protector enabled remains causal.
~ still No joy....contact Norton support &or uninstall Norton.
~ see how you get on with Windows Security.
Note: from this distance - I've not seen your Data Protector history. I'm still unknowing what Norton objects to with your Scan Exclusions & Real Time Exclusions enabled & your Data Protector enabled/disabled.
Maybe, if/when Norton support is able to see your side...they'll sort your scenario.
Sorry, I'm Norton user. I'm not Norton.
~ regarding #6
Sorry, I'm not understanding #6?
Caveat: I do not develop executable files nor use Microsoft Visual Studio
If you've already created a works project folder and excluded same x 2 & you've temporarily disabled Data Protector and are still having whatever issue you're having....meaning, Norton still objects to whatever you're doing.
Please tell us what Norton is telling you regarding this event. For information regarding this event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste here.
~ still No joy....contact Norton support &or uninstall Norton.
~ see how you get on with Windows Security.
Note: from this distance - I've not seen your Data Protector history. I cannot see what Norton objects to with your works project folder excluded x 2 & Data Protector disabled.
Maybe, if/when Norton support is able to see your side...they'll sort your scenario.
Sorry, I'm Norton user. I'm not Norton.
Open Norton 360 Classic view => Settings => Antivirus
Sorry, don't know if "Items to Exclude from" x2 -> Configure [+]... will help your scenario.
Items to Exclude from Auto-Protect, ..... Configure [+]
Note: as a developer > can you create a work projects folder and Exclude same x 2
~ and if Data Protector objects > try adding Data Protector => Process Exclusions
Note: maybe, "above" will sort your scenario...maybe, not.
Did you temporarily disable Data Protector...as test?
Just to confirm your Windows EXE executable files and Microsoft Visual Studio to debug them...runs as expected?
I'm sorry, once again, I cannot find any mention of anything like "Scan Exclusions with Real Time Exclusions" in the menus, so I don't know what you mean. I'm finding that Norton's menu set-up is anything but helpful.
Note: as a developer > can you create a work projects folder and Exclude same x 2 https://community.norton.com/en/comment/8518250 20-Dec-2021
~ and if Data Protector objects > try adding Data Protector => Process Exclusions
Note: maybe, "above" will sort your scenario...maybe, not.
Did you temporarily disable Data Protector...as test?
I've stripped out other categories. BTW, I notice there are lots of identical entries in Category: Norton Product Tamper Protection where Norton seems to be blocking itself(?), e.g.
20/07/2024 11:51:14,Info,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,20/07/2024 11:51:14,C:\WINDOWS\SYSTEM32\TASKMGR.EXE,1128,C:\Program Files\Norton Security\Engine\22.24.5.6\NortonSecurity.exe,8856,Access Process Data,Unauthorized access blocked,1
We don't need Norton Community Watch, Norton Product Tamper Protector, et al.
I'd thought we'd view only > Category: Data Protector
for example: Security History -> Data Protector [here]
As soon as I replied, I found it! (Attached)
I've stripped out other categories. BTW, I notice there are lots of identical entries in Category: Norton Product Tamper Protection where Norton seems to be blocking itself(?), e.g.
20/07/2024 11:51:14,Info,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,20/07/2024 11:51:14,C:\WINDOWS\SYSTEM32\TASKMGR.EXE,1128,C:\Program Files\Norton Security\Engine\22.24.5.6\NortonSecurity.exe,8856,Access Process Data,Unauthorized access blocked,1
Thanks for the reply. I know I've definitely seen the screen to export security history before, but I cannot see how to actually get to it. I'm trying: N360 -> Settings -> Antivirus but none of the five menu items seems to have a "History" reference.