There have been posts/threads where many instances of Norton detections are being a wee bit too touchy. False positives, firewall and the AV itself putting files into quarantine where they cannot be removed, the list is long and varied. Like older 22.xx versions where we were seeing two specific files, I am back to them once again, with suspicions about maybe. These should be the main focus of what all the extra high detections are all about. Below, is a screenshot of where the two files are located and their names. In the older versions removing these files actually corrected some of the issues being seen but with each new patch release they were again reinstalled.
And opening the properties for the 64 bit version I am presented with the following. These files are OPSWAT MDES SDK V4. Both the 32 and 64 bit versions.
So then, lets have a look at what OPSWAT is and its enterprise uses. Critical environment Cybersecurity.
And then we ask, is Norton partnered with or customer of OPSWAT? The answer is most certainly YES! Other A/V vendors are as well.
https://www.opswat.com/partners/norton
https://www.opswat.com/docs/manac/nac-v8.0.7/knowledge-base/supported-anti-virus-products
The next question coming to mind is just what is MDES or MetaDefender Endpoint. It looks like a ton of Norton scans and other feature sets are being created using these services built-in. Patch management, etc.
In conclusion, my boilerplate is that these services are directly connected to at least some of the over reactive issues being seen in our installs. One has to wonder why corrective actions take so long to create and deploy, these on my side appear to be a part of that answer. Feedback is a MUST.
SA
