False positives Norton Power Eraser

I was running a terminal emulation application (TTY.exe) as I have done many times before, and there was a pop-up frm Norton advising me of a problem and directing me to download and run Norton Power Eraser.I did so, and rebooted as required, and after a scan it presented me with a list of 7 files it identified as "bad" and targeted for removal. and another file it flagged as "unknown". The files are listed at the end of this message (from the log).

 

Some of these are programs I have written and compiled myself, or for which I have Delphi source code (TTY.exe). Others are applications I have used, although rarely.

 

I used Norton Insight to scan TTY.exe and it showed clean.

 

This happened shortly after I did a restart because the system was running slow and I had a lot of things loaded. So it's possible that Norton also updated. I also noticed that, after the restart, some of the tracking cookies in IE9 seemed to have been purged, so I had to log on to some forums I frequent. But Firefox did not have a problem.

 

I think these are all false positives and I assume I can just "trust" them by using Norton Insight. But I wanted to confirm that this should be OK.

 

Paul

 

==============================================================================================

 

Analyze DateAndTime="Friday, 01 February 2013 Time: 19:56">-<Infections_Detected><DRIVERS Count="0"/><SERVICES Count="0"/><PROCESSES Count="0"/><LAYERED_SERVICE_PROVIDERS Count="0"/>-<DESKTOP_SHORTCUTS Count="5">-<Desktop_Shortcut ID="1">-<File_Information><Path>c:\program files (x86)\btsa3\btsa3.exe</Path><FileVersion>1.0.1.11</FileVersion><ProductVersion>1.0.0.0</ProductVersion><ProductName/><Company>P S Technology, Inc</Company><Copyrights/><MD5>CE0052EED0419FF811408F8632690AC1</MD5><SHA256>8DF4FF1E7518F48310C7CA90F5B20306D3A99418110E04A6339249081CE4FD15</SHA256><FileSize>626688</FileSize></File_Information>-<SideEffects Count="3"><File>C:\Users\Paul2010\Desktop\BTSA3.exe - Shortcut.lnk</File><File>C:\Program Files (x86)\BTSA3\BTSA3.exe</File><Directory>c:\program files (x86)\btsa3</Directory></SideEffects></Desktop_Shortcut>-<Desktop_Shortcut ID="2">-<File_Information><Path>c:\users\paul2010\documents\delphi\comdrv32\demos\tty\tty.exe</Path><FileVersion><></FileVersion><ProductVersion><></ProductVersion><ProductName><></ProductName><Company><></Company><Copyrights><></Copyrights><MD5>53F4F350BE94C0BF68157200C8F8B0BA</MD5><SHA256>5201863D0809B8AD16FE90FCB28176D4F824BCF344335D14D5C37B0DFFF2E8CF</SHA256><FileSize>531968</FileSize></File_Information>-<SideEffects Count="2"><File>C:\Users\Paul2010\Documents\Delphi\ComDrv32\Demos\TTY\TTY.exe</File><File>C:\Users\Paul2010\Desktop\TTY.exe - Shortcut.lnk</File></SideEffects></Desktop_Shortcut>-<Desktop_Shortcut ID="3">-<File_Information><Path>c:\users\paul2010\documents\delphi\serialng\serialngbasicdemo.exe</Path><FileVersion>1.0.0.0</FileVersion><ProductVersion>1.0.0.0</ProductVersion><ProductName/><Company>DomIS Internet Solutions</Company><Copyrights/><MD5>42C4AB73F9265469BA0074A44DA2FDFF</MD5><SHA256>7D061CF26C727207905D3DAD755D88C502153A4356582FD44AD54C42B4A9A681</SHA256><FileSize>351232</FileSize></File_Information>-<SideEffects Count="2"><File>C:\Users\Paul2010\Documents\Delphi\SerialNG\SerialNGBasicDemo.exe</File><File>C:\Users\Paul2010\Desktop\SerialNGBasicDemo.exe - Shortcut.lnk</File></SideEffects></Desktop_Shortcut>-<Desktop_Shortcut ID="4">-<File_Information><Path>c:\users\paul2010\downloads\gerb2pdf\gerb2pdf.exe</Path><FileVersion><></FileVersion><ProductVersion><></ProductVersion><ProductName><></ProductName><Company><></Company><Copyrights><></Copyrights><MD5>D39DEF597B502D3743FCFA93ABD090C4</MD5><SHA256>725904AA271E094EFEB29C4078ADE39199E46D06E4CBF0EE1452C9336A637849</SHA256><FileSize>1159168</FileSize></File_Information>-<SideEffects Count="2"><File>C:\Users\Paul2010\Downloads\Gerb2pdf\gerb2pdf.exe</File><File>C:\Users\Paul2010\Desktop\gerb2pdf.exe - Shortcut.lnk</File></SideEffects></Desktop_Shortcut>-<Desktop_Shortcut ID="5">-<File_Information><Path>c:\users\paul2010\downloads\tina pro\tina.exe</Path><FileVersion><></FileVersion><ProductVersion><></ProductVersion><ProductName><></ProductName><Company><></Company><Copyrights><></Copyrights><MD5>B05769332609A58B2818DAD350DF4D51</MD5><SHA256>434CE97A17F449F49BC0EA7193D4DA18631B3CB30D850739015462590D57E008</SHA256><FileSize>1875456</FileSize></File_Information>-<SideEffects Count="2"><File>C:\Users\Paul2010\Downloads\Tina Pro\TINA.EXE</File><File>C:\Users\Paul2010\Desktop\TINA.EXE - Shortcut.lnk</File></SideEffects></Desktop_Shortcut></DESKTOP_SHORTCUTS><AUTORUN_FILES Count="0"/>-<STARTUP_ITEMS Count="2">-<Startup_Item ID="1">-<File_Information><Path>c:\program files (x86)\html-kit\tools\bin\hktools.exe</Path><FileVersion/><ProductVersion/><ProductName/><Company/><Copyrights/><MD5>BE874E4C5744CB6118139CD7079635C2</MD5><SHA256>265E68B0A10512473794E21C001F6FB697CF12D3DF45C2B02F28779161012A5D</SHA256><FileSize>6302208</FileSize></File_Information>-<SideEffects Count="4"><File>c:\program files (x86)\html-kit\tools\bin\hktools.exe</File><Directory>c:\program files (x86)\html-kit\tools\bin</Directory><RegistryValue>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HKTools.exe\""</RegistryValue><RegistryKey>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HKTools.exe</RegistryKey></SideEffects></Startup_Item>-<Startup_Item ID="2">-<File_Information><Path>c:\program files (x86)\sc4dliteapp\sc4dliteapp.exe</Path><FileVersion>1.00</FileVersion><ProductVersion>1.00</ProductVersion><ProductName>SC4DliteApp</ProductName><Company>Silicon Craft</Company><Copyrights/><MD5>EF9569D3CB7E127B6686E44F55C89CC5</MD5><SHA256>E73712A5B19CE07C062DF6FCB0331CE7806F4F7992C9A8D87C5A60B5CDBD8959</SHA256><FileSize>81920</FileSize></File_Information>-<SideEffects Count="5"><File>c:\program files (x86)\sc4dliteapp\sc4dliteapp.exe</File><Directory>c:\users\paul2010\appdata\roaming\microsoft\windows\start menu\programs\sc4dliteapp</Directory><Directory>c:\program files (x86)\sc4dliteapp</Directory><RegistryValue>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SC4DliteApp.EXE\""</RegistryValue><RegistryKey>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SC4DliteApp.EXE</RegistryKey></SideEffects></Startup_Item></STARTUP_ITEMS><BROWSER_HELPER_OBJECTS Count="0"/><BROWSER_TOOLBARS Count="0"/><BROWSER_PLUGINS Count="0"/><SHELL_EXTENSIONS Count="0"/><EXPLORER_PLUGINS Count="0"/><DIRECTORIES Count="0"/><FILES Count="0"/><SYSTEM_SETTINGS Count="0"/></Infections_Detected>-<Suspicious_Items><DRIVERS Count="0"/><SERVICES Count="0"/><PROCESSES Count="0"/><LAYERED_SERVICE_PROVIDERS Count="0"/>-<DESKTOP_SHORTCUTS Count="1">-<Desktop_Shortcut ID="1">-<File_Information><Path>c:\program files (x86)\ortmaster\ortmaster.exe</Path><FileVersion>1.7.1.12</FileVersion><ProductVersion>1.0.0.0</ProductVersion><ProductName>Ortmaster</ProductName><Company>P S Technology, Inc.</Company><Copyrights/><MD5>2A18B9634F013BB9DF361CE3C451BB9B</MD5><SHA256>0AF54EFDD04F4643B2B109A94D90ABDC65D9178377B93FFAC609FE5722F46E58</SHA256><FileSize>1500160</FileSize></File_Information>-<SideEffects Count="3"><File>C:\Users\Public\Desktop\Ortmaster.lnk</File><File>C:\Program Files (x86)\Ortmaster\Ortmaster.exe</File><Directory>c:\program files (x86)\ortmaster</Directory></SideEffects></Desktop_Shortcut></DESKTOP_SHORTCUTS><AUTORUN_FILES Count="0"/><STARTUP_ITEMS Count="0"/><BROWSER_HELPER_OBJECTS Count="0"/><BROWSER_TOOLBARS Count="0"/><BROWSER_PLUGINS Count="0"/><SHELL_EXTENSIONS Count="0"/><EXPLORER_PLUGINS Count="0"/><DIRECTORIES Count="0"/><FILES Count="0"/><SYSTEM_SETTINGS Count="0"/></Suspicious_Items></Analyze> 

Norton Power Eraser is a very powerful tool and should only be used by those who know what is on their system.

 

False positives can be reported and if you are not aware of what the files are, you can mess up your system.

 

You say you know the files that were reported, so you should be OK. Just be sure to scan them individually, as you have done.

 

 

 

Hi PStechPaul,

 

Norton Power Eraser differs from the basic Norton AV products in having a lower threshold for determining if a file is possibly malicious.  Because NPE is more aggressive and less discriminating, it is prone to false positives, and it is very likely to flag files that it has never seen before as being potential malware.  You do need to review its findings and exclude those files from deletion that you know to be legitimate.