Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.
Well, yes and no.
I'm one of those people who turn my computer off when I don't use it. So Norton doesn't really find idle time to do its scans. And when it does do so, it's not always convenient or what I would describe as idle time.
Example: Last night I was bidding on an Ebay item and watching the clock tick down while reading a good book. I was going to jump in at the last minute (too late to set up Esnipe). So with about 30 seconds left, I noticed I could no longer refresh the screen, an activity I was engaged in about every 30 seconds or so.
I recognized this pattern of behavior. Auto AV was in operation. If I turned it off, I would get fast use of the computer, so I clicked on NIS2009 and -- OMG! -- system usage was so high, NIS2009 wouldn't load and wouldn't load. By the time it did load and I turned off auto AV (getting instance access to IE7) it was too late; I had lost the item I wanted.
The Idle Time detector did not detect my mouse behavior or my F5 key behavior. Or if it did detect, it ignored it.
Now, I've been down this road before. I will be asked what the TM showed, and I will say high svshost behavior but not high ccsvchst behavior; and then I will be informed that svshost is not Norton. So let me jump to the chase: Every single time, bar none, that my computer slows down with 100% CPU usage, the culprit always appears to be svchost, BUT if I shut off Auto AV, I immediately get back the CPU and everything is working at normal speed.
So it appears that when Norton (wrongly) detects idle time, it launches a scan thant invokes auto AV somehow, and I end up in immediate competition with Norton for my meager 2 gigs of CPU. Since I "win" everyone of these competitions by turning off Auto AV for 15 minutes, Norton doesn't get to complete its idle time scan.
The only thing that a full system scan will uncover are dormant threats.
AutoProtect will immediately protect you as soon as malware is accessed.
So you are really no more secure running full system scans than you are just keeping AP and other security features on.
A quick scan scans everything that is currently running, and everything that may run.
This means everything that is registered with Windows to execute at some point in time, e.g. drivers, services, winlogon DLLs, LSPs, run key, startup group, BHO's, etc.
A quick scan is scheduled to run at idle after every full def update (not after pulse updates).
After a pulse update AP rescans all open file handles, this special type of scan that is completely without IO and super fast.
Some AV product do not rescan files after def updates, we do.
There is no guarantee that a file may not already be executing on your system by the time a definition is released for that file, and not rescanning those files will leave the file undetected.
Remember NIS provides layered security:
How does the threat get on the system?
The firewall controls network access.
Network IDS protects against malicious network content.
Browser Defender protects against browser exploits.
The email and IM scanner scans emails and attachments.
What if the threat managed to persist on the system?
AP blocks file access.
What if the threat manages to execute?
SONAR protects against malicious applications.
If the engineering team had their way NIS would ship with the default scheduled full system scans turned off.
But, clearly it is taking some time for people to get used to the idea :)
Pieter
Hi PieterV.
Thank you for taking the time to explain how things work in NIS 2009. Very much appreciated.
Golfjunky wrote:I am so used to running weekly scheduled full scans, that I'm having a hard time believing I don't need to run them anymore. Does Norton's Idle Time Scan really make it unecessary to run weekly scheduled scans? I would like NIS/NAV 2009 user opinions on this subject.
Hi Golfjunky
I would like to refer you to these threads where idle time scans are more fully explained. Link and Link.
As far as full system idle time scans are concerned, NIS09 does perform a full system idle time scan automatically, every 7 days. If you wish to schedule full systems to run more or less frequently, you are also able to configure this in 'Manage Scans'.
Hello,
I just finished reading the NIS 2009 review in PC Magazine.
http://www.pcmag.com/article2/0,2817,2330026,00.asp
In the review he states that with Norton's Idle Time Scan, a scheduled full scan is not necessary....
Norton's antivirus scans files on access, on demand, and on schedule. However, the scheduled scan is turned off by default, because real-time protection and the automatic idle-time scan render it unnecessary. Those who wish can schedule full or custom scans to run on a daily, weekly, or monthly basis, or to run at start-up or log-on, but it really isn't necessary.
I am so used to running weekly scheduled full scans, that I'm having a hard time believing I don't need to run them anymore. Does Norton's Idle Time Scan really make it unecessary to run weekly scheduled scans? I would like NIS/NAV 2009 user opinions on this subject.
If you turn on Idle-Time Scan, then, a Full System Scan will run every time the system is idle; if it is off a Quick Scan will run when idle. I personally think that, if you turn off Idle-Time Scanning, then, no idle-time scan should run; if you turn it on you could set when a Quick Scan would and/or when a Full System Scan would run at idle. When a Idle Quick Scan starts and the system becomes un-idle again, the I.Q.S. will continute until it is finished; a Full System Scan will stop and then, once the system becomes idle again, will continute from where it left off.
You can change how often the Idle-Time Scan/Operations wait to run by changing the Idle Timeout until the system goes idle.
With regard to actaully running a manual Full System Scan, then, I would perhaphs do it weekly to get rid of all the Tracking Cookies and Internet stuff, although, you can also get rid of this via a Quick Scan becuse background scans still do not Detect and Remove Tracking Cookies when "remove low-risk items" is checked!
Hi johna,
After reading these posts by mijcar, and Stu, from the link you provided, I still have a question...........
http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=7156&view=by_date_ascending&page=1
I have cable HSI service. I leave my computer on all day. I turn it off at night. By my computer being on all day, and basically connected to internet, the Idle Time full scan won't happen even if I'm not using the computer?
Full system scans are set to run via Idle scanner every 7 days. If at the scheduled time the system is not considered to meet idle requirements, the scan in question will run as soon as the system becomes idle. However, if a full system scan is running during idle and the system becomes active, the scan will be suspended until the system enters an idle state again at which time the scan will continue from where it left off. *
This should answer your question, or are you saying you have met these requirements and the scan still doesn't run? (By the way it doesn't matter how long or when your PC is turned off, the automatic full scan will kick in when you start your PC again and it becomes idle, if a scan is due or has become due at a time your PC was off).
*Link
johna wrote:Full system scans are set to run via Idle scanner every 7 days. If at the scheduled time the system is not considered to meet idle requirements, the scan in question will run as soon as the system becomes idle. However, if a full system scan is running during idle and the system becomes active, the scan will be suspended until the system enters an idle state again at which time the scan will continue from where it left off. *
This should answer your question, or are you saying you have met these requirements and the scan still doesn't run? (By the way it doesn't matter how long or when your PC is turned off, the automatic full scan will kick in when you start your PC again and it becomes idle, if a scan is due or has become due at a time your PC was off).
*Link
Message Edited by johna on 09-15-2008 06:02 PM
Basically what I said. ;)
johna wrote:Full system scans are set to run via Idle scanner every 7 days. If at the scheduled time the system is not considered to meet idle requirements, the scan in question will run as soon as the system becomes idle. However, if a full system scan is running during idle and the system becomes active, the scan will be suspended until the system enters an idle state again at which time the scan will continue from where it left off. *
This should answer your question, or are you saying you have met these requirements and the scan still doesn't run? (By the way it doesn't matter how long or when your PC is turned off, the automatic full scan will kick in when you start your PC again and it becomes idle, if a scan is due or has become due at a time your PC was off).
*Link
Message Edited by johna on 09-15-2008 06:02 PM
Yep, that answers my question. Thank you.
PieterV (or any other Norton staffer)
How on the Norton Security Home Panel, do I see if I have all these layers set as you describe? I use NAV2008 on a Vista OS with Vista Service Package 1
My Norton Protection Center panel shows the following are secure(Green):
Vrus Protection Protection Updates
Inbound Firewall Spyware Protection
Spyware Definitions Windows Automatic Update
Internet Explorer Settings Windows Account Control
Virus and Spyware Scan
Under the Norton Antivirus Tab it shows:
Settings
Basic Security
AutoProtect on
Protection Updates 10/29/08
Automatic Live Update on
WebBrowsing
Internet Worm Protection on
Spyware Protection on
Looks like I'm way secure, but just want confirmation
Hello NY1986,
You are protected with all the features of Norton AntiVirus 2008. For all the layers of protection that PieterV mentioned, you would want to use Norton Internet Security 2009, as that was the product that he was referring to.
The idle scan will scan your machine every time your machine is idle. So it really is scanned regularly
I get conflicting answers from many of the threads I searched so sorry for asking this question again: Is there a way to turn off the Idle Time Scans (both full and quick)? I have NIS Version 19.7.1.5.
Ed, thanks for the reply. I have my Idle full system scan already turned off the way you described it but every time I leave my laptap and come back I see ccsvchst.exe running on Task Manager with CPU above 50%. Since my idle full scan is turned off I'm assuming its the Quick Idle scan that is running. But what I don't understand is why is it taking forever to finish at which point I have no other recourse but to restart my computer. I've run quick scans myself often times and usually it only takes 2 to 3 minutes with CPU less than 5%. Is there a way to find out what Norton task is running during idle times?
Bolinger wrote:Ed, thanks for the reply. I have my Idle full system scan already turned off the way you described it but every time I leave my laptap and come back I see ccsvchst.exe running on Task Manager with CPU above 50%. Since my idle full scan is turned off I'm assuming its the Quick Idle scan that is running. But what I don't understand is why is it taking forever to finish at which point I have no other recourse but to restart my computer. I've run quick scans myself often times and usually it only takes 2 to 3 minutes with CPU less than 5%. Is there a way to find out what Norton task is running during idle times?
Hi Bolinger,
You are not alone on these issue's. Like you, my manual quick scans run without incident. I also have had trouble in the past and still do sometimes, with the idle quick scans. Things have got a little better though for me when I reduced the idle time out down to 2 minutes. Now these background tasks have a chance to run more often and more of a schedule. Since then, my idle time scans have improved, but I still have the occasional issue. All of my scans run high cpu, but when they're finished, the cpu goes back to normal. Also, I have an older aging machine. 2002 Dell Dimension 4550, Windows XP SP3. I do the best I can 
You can go into the Performance window of NIS and open Norton Task. The list of background tasks that ran during Idle Time will say 'Yes' in the 4th column.
Ed
Windows XP Home SP3 32bit * NIS 2012 (19.7.1.5) * Chrome 19.0.1084.56 IE8 * MBAM Free
How often does Norton Insight run?
Is there a way to configure Norton Insight not to run during Idle time?
Hi,
This might help you understand Norton Insight. - https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?actstat=activated&ct=us&entsrc=&ispid=&layout=Retail&lg=en&ncoap=1&partner=&product=Norton+Internet+Security&pvid=f-nis-cur&sitename=&substatus=current&version=current&docid=v15472458_NIS_Retail_2012_en_us
Dave.
Thanks for that link, Dave. Based on what I have gathered from that article, Norton Insight only runs during idle time. Ironically its
supposed to improve the performance of scans using a heuristic that allows the scanning of fewer files based on their confidence rating but unfortunately its also causing my laptop to freeze. To avoid this situation, I could probably turn off Norton Insight and change my scan performance profile to a full scan but I wonder how much performace am I sacrificing by doing it this way. Alternatively, what constitutes idle time for Norton? Does anyone know of a tecnique to trick Norton not to detect idle times?