Norton Security Suite and Boot.bootblock.b

Archive
1

I have been seeing similar symptoms, however not on apparently the same frequency. By clicking on the boot.boolock.b link in the notification, I was able to find that my Norton Security Suite was indicating that a volume shadow copy was apparently infected, but whenever I clicked ReScan, the issue would go away. I use Mozy remote backup. It was kicking off a volume shadow copy, even though there were no files to back up. Normally, Volume Shadow Copy is used to allow backup of open files. There is a setting in the Mozy software that enables backup of open files. With that setting checked, if I kicked off a manual Mozy backup, I would see the Boot.Bootlock.B alert from NSS. If I switched off the ability for Mozy to back up open files, and started a manual backup, I did NOT get the Boot.Bootlock.B alert from NSS...unfortunately the volume shadow copy created by Mozy is very short-lived, so I have not been able to see what is in it, but it appears that NSS is detecting something in the VSC that it recognizes as Boot.Bootlock.B.

 

 

[edit: Clarified subject.]

2

Hello kevan_i

 

Welcome to the Norton Community Forum

 

I believe you are using Comcast Norton Security Suite, so I have requested the Mods to move your post over to Other Products. You will be able to follow the link left behind to find your own thread. Thanks.

3

Yes, I am using the Comcast branded version of NSS, but the original post was made here by an a user who is apparently not...so the issue appears to cross the products, and become a general detection issue. If I found a potential reason for it, moving my post to a different discussion would break the thread, and make the discussion irrelevant in the other board, as it is a reply that would have no original post, and would have no frame of reference. Just because I use the Comcast version doesn't mean that there can't be common problems between the two versions.

 

just my $.02, but it's your call....

4

Just to further clarify the situation, the original post in the’ non Comcast’ thread was related to NSS popping up detection notification of the boot.bootlock.b trojan. My PC showed no other symptoms, and Power Eraser and the Norton Bootable Recovery disk could not find the infection…

5

Hi kevan_j ,

 

There are times one can not argue with city hall - I have gone around with the admins here before in regards to the location of Norton Security Suite posts and also the splitting out of those posts from threads of a certain Norton product (especially N360 which NSS is based on) when the function being asked about operates the same way - be it in NSS, N360, or NIS that is installed.  That said, I understand your point, but have over the last year or so learned to live with Norton's wishes and reasoning.

 

Now,  I am not a Mozy user, nor do I know anything about the functioning of Mozy and Volume Shadow Copy/Volume Shadow Service, however Mozy does have a support function here: 

 

http://support.mozy.com/support

Which offers the following areas which may provide some assistance:

Community
Interact with other customers to get quick answers to your questions.
 

Documentation
Access user guides, white papers, and other technical documentation.
 

Knowledge Base
Search online articles to solve your problems fast.
 

Tutorials
Watch step-by-step videos to better understand the Mozy service.
 

A quick search of Mozy site provided the following info (which probably deos not apply to your situation)

 

http://support.mozy.com/support/mozyKnowledgeBase?DocId=11741

Possible software conflicts with Mozy

 

•If Norton Ghost is installed as a backup solution, it can create issues with the Volume Shadow Copy Services (VSS) that Mozy relies on for backup. Because Norton installs their own VSS writer and provider, you may need to uninstall Norton Ghost for Mozy to backup regularly.

 

If I had to guess, I would think that since you do not have any of the "normal symptoms associated with boot.bootlock.b trojan that something within Norton may be causing the "false detection".  My best guess would be something in the Norton Self-Protect area - is detecting a part of VSS/VSC from trying to change something in Norton so that Mosy can backup an open file.  Norton is very picky in what it lets happen to itself (via Self-Protect).

 

Perhaps, if you go to Settings >Administratvie Settings > scroll about half way down the page and under the Product Security Heading > turn off  Norton Product Tamper Protection, click apply and select a time frame.  You can then try your little test with the detection of the trojan that you described in your original post.

 

The Tamper  Protection will turn back on after that time frame or you can go back and turn it on and Apply at any time.  Be sure to turn Norton Protection back on.

 

Please post back with your results.

6

This is a follow-up to my earlier comment.  NSS pops up and tells me it can't remove boot.bootlock.b or that it did.  Still get messages.  Tried to have NSS skip what might be the problem, but can't find it.  I've attached the screen from NSS below.  only difference in messages is whether the "....ShadowCopy1" is a 2 or 16 or 17.  Is this real, or a result of Norton SS not liking valid programs that have a shadow function?  I don't care.  I just would like some help to fix it. 

 

Here is NSS report: 

____________________________

Full Path: Not Available

____________________________

____________________________

On computers as of:

Not Available

Last Used:

10/1/2011 at 3:14:34 PM

Startup Item:

No

Launched:

No

____________________________

____________________________

Unknown

Number of users in the Norton Community that have used this file: Unknown

____________________________

High

This file risk is high.

____________________________

Threat Details

Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.

____________________________

Origin

Downloaded from  URL Not Available

 

____________________________

Suspicious Actions

Boot record infection: Drive \Device\HarddiskVolumeShadowCopy1

Remove Failed

____________________________

File Thumbprint - SHA:

Not Available

____________________________

File Thumbprint - MD5:

Not Available

 

7

This post and some of the ones following may be helpful.

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/Windows-7-Update-BootlockB-Problem/m-p/550550/message-uid/550550/highlight/true#U550550