Recurrance of Computer-crippling bug from last year

Norton Security | Norton Internet Security
1

I don't believe it. I. Just. Do. Not. Believe. It.

The glitch that came through in a Nortons update about a year ago that crippled many of my main programs (see: here, and here, and here, and here) seems to have been re-included in Nortons latest update.

Subsequent to this update, MS Word, Adobe Reader and Internet Explorer have all been crippled and refuse to run. Quite likely, other programs I haven't tried have also been affected.

Once again, I've had to uninstall the up-to-date Nortons and revert back to an old installer I had for version 21.6.0.32 to get my computer to function in a somewhat stable state once again.

If it weren't for the fact that there are viruses out there, I wouldn't have Nortons on my PC at all. Though I'm starting to wonder if maybe the viruses would do less damage to my PC.

What happened to you, Nortons? You used to be a brand name associated with quality.

2

CDM

Earlier you said

Nortons firewall might have a good reputation for keeping nasties out, but this is only part of a firewall's job. The other important part is giving users control over what has network access and precisely what the extent of that network access is for them. In this second regard, Nortons doesn't offer an efficient means of controlling network traffic.

As I mentioned earlier I am not an expert on networking, far from it, but I do have a long experience on the use of words and their meaning.

Then you later said

Your router can tell precisely which programs are behind it's network traffic? As far as I know this level of traffic recognition is beyond my router's capabilities - and also the previous router I owned (which was better quality).

For me what you describe is not  the control of attacks and of access permitted by the "User in charge" access but rather "monitoring of usage" and I would expect the software to be different.

If I want protection I want it done for me "behind my back" but under my overall control. I don't want something that continually asks me if I want to let this happen -- had enough of that from Microsoft in Windows VISTA UAC and onwards.

If I want to know exactly what's going on in my very simple network then I'll ask what's a good utility to monitor just that and let me control it as it happens and I'll install that confident that it's likely to be better at it than the one size fits all utilities that tend to get included in "Suites".

What happens if you disable the Norton Smart Firewall? Does Comodo do what you want? Then keep it. But if you have two different firewalls (or any other utility) trying to protect you against changing attacks and being updated on the latest and how best to deal with them by two different sources then I'd expect problems to arise since surely they are not independent of your operating system and are capable of giving conflicting instructions to the same element.

As someone trained in logic amongst other disciplines that's what I'd expect and as someone experienced in computers and Windows what I'd expect even more.

But if your mileage differs ......

3

@huwyngr

Your router can tell precisely which programs are behind it's network traffic? As far as I know this level of traffic recognition is beyond my router's capabilities - and also the previous router I owned (which was better quality).

Not to mention that I have to log on to my router's configuration page via internet explorer to adjust it's settings or monitor it's condition. It has no connection with my operating system that allows it to produce a popup alert when it has an issue or query. In other words, it could not ask me in real time how I want a particular instance of network traffic handled, which basically means I wouldn't be able to manage new programs' efforts to connect to my LAN or the internet, even if the router could determine which programs are responsible for which traffic.

4

Norton Internet Security 2013 (NIS 2013) sits midway up the scale and offers antivirus, anti-spyware, anti-spam, two-way firewall, browser protection, parental control and identity safeguards.

 

 

5
 

@peterweb

Yes, I still run Comodo Firewall as it offers important functionality that Nortons lacks. I was assured that these two software suites would be compatible by the software salesman at Dick Smith's. He seemed to know his stuff and for several years, what he said held true.

 

 With no disrespect to you or former Dick Smith staff, they were exactly as you said, salesman.  They were not computer technicians, although they might like you to believe they were.

I agree with others that recommend uninstalling Comodo, or installing NAV which does not have a firewall.

6

CDM

The other important part is giving users control over what has network access and precisely what the extent of that network access is for them. In this second regard, Nortons doesn't offer an efficient means of controlling network traffic.

Don't you have a router between your PC and the internet? I'm told by people who really do more than I do -- easy on networking -- that the firewall in the router is the best control of that. 

7

My computer is a six year old duo core 64 bit machine with 4 GB of ram.

It has no problem running Norton, and Win 10 plus all the other software  I have.

Me too ,,,

And since I'm behind a router it's got a good firewall, probably better than any software one I'm told, although as I see it what the router does is software/firmware determined?

8

Thanks, Imacri.

As it turns out, I was reminded of this solution shortly before reading your post. As I previously indicated, I've completely uninstalled Nortons 360/Internet Security and installed the standalone antivirus that F4E directed me to. But as soon as I did so, the problems began to reoccur! The presence of a non-firewalled version of Nortons antivirus would seem to me to suggest that the problem isn't a conflict between Nortons firewall and Comodo Firewall as others have suggested.

However, in attempting to self-diagnose this persistant issue, I discovered that disabling "Exploit Prevention", as you indicate, seems to eliminate the problems with IE, Word & Acrobat. Whatever's wrong with Nortons seems to be tied to the code behind that "Exploit Protection" function.

I am now growing more doubtful that my problem has to do with a conflict with Comodo, but I get the distinct impression that people here won't agree with me until I uninstall my firewall and test to see if the errors remain. That will take me some time to complete. I need to backup the currant config of my firewall and I need to track down the installer (which should be in my archives somewhere), so I can restore it after I've done the test. More to the point, I need a lean day when I have a few hours spare to do all this. Hopefully I'll be able to get to it over the weekend or Monday by the latest.

@F4E

Thanks for the link.

Nortons firewall might have a good reputation for keeping nasties out, but this is only part of a firewall's job. The other important part is giving users control over what has network access and precisely what the extent of that network access is for them. In this second regard, Nortons doesn't offer an efficient means of controlling network traffic.

As I've said, if I did decide to lean entirely on Nortons firewall, I'd spend half my day manually configuring it to suit my needs, when the same configurations can be applied in a split second on Comodo.

9
CamDaMan:

Yes, I've had to downgrade back to the obsolete version of Nortons so that I have at least some version of protection on my computer. The up-to-date version of Nortons makes my PC virtually useless, so I had no choice but to follow the reccomendations given to me last year and reinstall a working version of Nortons to replace the recent one that's caused me so many problems.

Hi CamDaMan:

Just a hint for future reference if you ever upgrade back to N360 v22.x that includes the Smart Firewall and still see this type of problem when you launch MS Word, IE9, Adobe Reader, etc.  Try temporarily disabling Proactive Exploit Protection (PEP) at Settings | Firewall | Intrusion and Browser Protection | Exploit Protection, which worked for Emile L, BigKahunah and others while they waited for Symantec to release an IPS definition update to fix a similar problem - see user comments from 2016 in the thread Microsoft Word VFPODBC Issue since recent Norton Update.  

The exploit protection of PEP is similar in function to Microsoft's EMET.  When you first encountered your problem with the v.22.5.4 update back in October 2015 when PEP was first introduced there was no configuration setting in Norton to disable this feature, but since 29-Feb-2016 all Norton v22.6.0 and newer products have had an On/Off switch for PEP.  I'm not certain, but the symptoms you describe sound like a conflict between Norton's PEP and some other software on your system that provides exploit protection and it's possible that temporarily disabling PEP might have saved you the effort of downgrading your N360 to v21.x.

That will be a moot point, of course, if you do decide to switch to the old NAV or Norton Security Basic (1 Windows PC per license), which both have no firewall. That's likely the better option for you if you're going to continue using your Comodo Firewall.
------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1

10

hello,

i agree with you.

 

 

11

http://norton.com/latestnav

This link will give you the latest AV, and you should be able to use the 360 key.

Uninstall your current version, reboot and then install NAV.

FWIW, many tech site reviewers say that Norton's firewall is one of the if not THE best, in keeping bad stuff off your computer.

I hope Comodo is up to the task. Good luck.

12

@SendOfJive

I'm not running Defense+ ATM. The enhanced degree of control it offered me was impressive, but the constant popups were just too much of a hassle.

@floplot, @F4E

I am not saying that everyone else is wrong, I am simply saying that Nortons makes a really crappy firewall and therefore I am really eager to retain my Comodo Firewall, which has proven itself to be a great utility for controlling my computer's access to the internet. Abandoning it would either mean giving all my programs free reign to perform whatever network activity they desire (something that I would not allow), or spend half my day manually configuring the Nortons firewall to work the way I need it to work - when the same configuration exercise can litteraly be done in a split second via Comodo.

If it comes down to choosing between Comodo or Nortons, I choose Comodo. However, Nortons has proven to be a decent antivirus thus far, so if I could retain it for this function, I would like to do so, rather then have to go hunting for a different antivirus.

Please tell me that my Norton 360 subscription allows me to downgrade the software on one of my computers to Norton Antivirus? If so, how do I go about downloading an installer for the most up-to-date version of Antivirus?

13

CamDaMan. Until I updated to WIN 10, I had much the same set up as you.

My computer is a six year old duo core 64 bit machine with 4 GB of ram.

It has no problem running Norton, and Win 10 plus all the other software  I have.

My 2 cents ? Dump Comodo, and update Norton to the latest edition.

Unless some other program or Windows Updates have caused these issues, then do what I do and leave Norton's firewall to make the decisions for you. It's not called the smart firewall for nothing.

14

Have you tried disabling Defense+?  That component of the Comodo Firewall monitors the startup of executables, so you potentially have not just two firewalls in conflict, but you also have Norton AV and Comodo Defense+ both trying to simultaneously examine every program as you launch them.

Just about everyone has Office Word, Adobe Reader and IE installed.  If a defect in Norton was preventing them from running, we'd all be in the same boat.  You are definitely running at least two programs with the real potential to interfere with one another, and system instability is exactly what you would expect to see if this were happening.

15

Hello CamDaMan

You are running an old version of your Norton product. 3 reputable companies have said that you should not run more than 1 software firewall. You can not properly test the effectiveness of any firewall by just disabling one of them at a time. You have to completely remove one of the firewalls  Disabling them does not remove the hardware inside the guts of your computer. 3 companies tell you not to do something, but you say that they are all wrong and you have to run both of them. It really is no wonder that you are having issues running your programs and you say that you are being well protected.

I will suggest that you try to get in touch with Tech Support and see if t hey can help you.    www.norton.com/chat. Sorry if I am sounding blunt.

Thanks.

16
CamDaMan:

So, are you saying that the most recent Windows updates actually corrects the problems that were caused by a previous update? I thought a previous post indicated that it was the most recent Windows updates that were the problematic ones. But if the recent ones were the ones that fixed the problems, then I'll download them.

Hi CamDaMan:

The point I was trying to make is that some of the August 2016 Patch Tuesday updates that you currently have on your system, including  KB3167679 (MS16-101: Description of the security update for Windows authentication methods: August 9, 2016) have known issues of their own.  KB3175024 (MS16-111: Description of the security update for Windows Kernel: September 13, 2016) might have fixed the password management problems in KB3167679 but it also created a new set of problems for Win7 SP1 users with EMET (a workaround to disable the EAF mitigation in EMET is provided in the KB3175024 bulletin).

I don't know how Symantec (or anyone else trying to help you in this thread) will be able to diagnose and troubleshoot your problem until you update to the latest v22.7.1.32 and are able to reproduce the error, so your only other option is to monitor this community and see if any other users report that they are unable to run MS Word, Adobe Reader, etc. when Norton v22.7.1.32 is installed.  That's fine as long as you're aware of the risks running your system in its current state.
------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1

17

@Imacri

Yes, I've had to downgrade back to the obsolete version of Nortons so that I have at least some version of protection on my computer. The up-to-date version of Nortons makes my PC virtually useless, so I had no choice but to follow the reccomendations given to me last year and reinstall a working version of Nortons to replace the recent one that's caused me so many problems.

So, are you saying that the most recent Windows updates actually corrects the problems that were caused by a previous update? I thought a previous post indicated that it was the most recent Windows updates that were the problematic ones. But if the recent ones were the ones that fixed the problems, then I'll download them.

Comodo Firewall queries me every time a new program tries to perform network activity and allows me to nominate whether the program has no network access, whether it has LAN access, or whether it has LAN and Internet access, immediately from the popup menu. While Nortons firewall seems to offer similar control, it seems to require users to delve into its settings to specifically configure the details for each program individually. In Comodo, I can define my own custom "program rule sets" and quickly and easily nominate one of these rule sets for a program as soon as it wants to access the network.

Nortons seems to be considerably clunkier in this regard.

I have a feeling that I did try to disable the Nortons Firewall when I had these issues last year, and it didn't correct them. I also tried disabling Comodo and there was likewise no improvement, which lead me to believe that the suggestions someone had made that Comodo might be the cause of my problems were unlikely to be true.

18
CamDaMan:

The Nortons version is a bit trickier as to get this, you are essentially asking me to once again upgrade to the latest version, which presumably will lock up my computer again, then go back through the routine of having to uninstall it then reinstall the obsolete ver 21.6.0.32 so that I at least have basic protection once more. At the moment I'm also dealing with horrible ADSL line quality, so the 400+ MB download that 21.6.0.32 needs to bring itself up-to-date kills my internet for a couple hours....

.... Yes, I still run Comodo Firewall as it offers important functionality that Nortons lacks. I was assured that these two software suites would be compatible by the software salesman at Dick Smith's....

... My last WIndows update took place on 25 August this year, so I could not be effected by any issues with the September updates as I haven't downloaded them yet and, as I've previously explained, I doubt I will download them until I have a better idea what's going on with Nortons.

Hi CamDaMan:

Am I correct that you're still using an obsolete v21.6.0.32 version of your Norton product?  That also means that you are not patched for the critical security vulnerabilities listed in the 28-Jun-2016 security advisory SYM16-010, since v22.7.0 and higher are the only patched versions. From the blog of Tavis Ormandy at Google's Project Zero,  who discovered these vulnerabilities:

"These vulnerabilities are as bad as it gets. They don’t require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible. In certain cases on Windows, vulnerable code is even loaded into the kernel, resulting in remote kernel memory corruption."

The KB3175024 (MS16-111: Description of the security update for Windows Kernel: September 13, 2016) I mentioned in my previous post replaces KB3167679 (MS16-101: Description of the security update for Windows authentication methods: August 9, 2016), which has its own list of five known issues.

And further to F4E's post <here>, here is bleepingcomputer forum moderator quietman7's warning about running two firewalls simultaneously in his thread Answers to Common Security Questions - Best Practices:

"IMPORTANT NOTE: Using more than one software firewall on a single computer is not advisable. Why? Using two firewalls could cause issues with connectivity to the Internet or other unexpected behavior. Further, running multiple software firewalls can cause conflicts that are hard to identify and troubleshoot. Only one of the firewalls can receive the packets over the network and process them. Sometimes you may even have a conflict that causes neither firewall to protect your connection."

The workaround you've implemented to use a vulnerable version of Norton on a Win 7 computer missing critical security updates while running two firewalls simultaneously is extremely dangerous.  If you still believe that Norton is the root cause of your problems, you should to contact Norton Customer Support via Live Chat ASAP and open a support ticket if a Symantec employee doesn't respond in this thread, although I doubt that they will be able to diagnose your problem if you insist on leaving your system in it's current state.

EDIT:

I'm not sure what functionality your Comodo Firewall gives you that the Norton Smart Firewall lacks, but you should have the option of disabling Norton's two-way Smart Firewall (at Settings | Firewall | Smart Firewall in v22.x) and using Comodo as your primary firewall, assuming that Comodo is able to detect and automatically disable your built-in Win 7 firewall.
------------
32-bit Vista Home Premium SP2 * Firefox v49.0 * NIS v22.7.1.32 * MBAM Premium v2.2.1

19

@Imacri

My problem (last year) was somewhat solved by a subsequent Nortons update, though I couldn't tell you which one precisely. At some point several weeks after the initial discovery of the problems, I decided to take a chance that Nortons had corrected the problem and aloud my obsolete version of my security suite to update itself to the then-currant version.

I found that MS Word, Adobe Reader, ect. functioned without any noticeable problems. IE ran smoother then it had during the worst of the problems, but it was still prone to glitching out on me. For example it had a habit of locking up for about 5 seconds sometimes when I tried to open a new tab, then when it eventually started running again, the page I wanted opened in a new tab instead opened in a new window. But generally speaking, IE was now usable, which was a vast improvement from where it was when the problems were at their worst.

My last WIndows update took place on 25 August this year, so I could not be effected by any issues with the September updates as I haven't downloaded them yet and, as I've previously explained, I doubt I will download them until I have a better idea what's going on with Nortons. Besides, if there are bugs in the updates as you indicate, it might be worth my while waiting a few weeks for Microsoft to correct whatever's wrong with them.

20
CamDaMan:

The glitch that came through in a Nortons update about a year ago that crippled many of my main programs (see: here, and here, and here, and here) seems to have been re-included in Nortons latest update.

Subsequent to this update, MS Word, Adobe Reader and Internet Explorer have all been crippled and refuse to run. Quite likely, other programs I haven't tried have also been affected.

Hi CamDaMan:

Are you still affected by this problem? Most of the users who were unable to run MS Word, Adobe Reader, etc. back in October 2015 were affected by a conflict between Norton's Intrusion Prevention System (IPS)  and Microsoft's Enhanced Mitigation Experience Toolkit (EMET).  That issue was eventually fixed by an update to the IP engine/definitions per Symantec employee miket's post <here>.  In your October 2015 thread Nortons 360 is killing Microsoft Word, Adobe Reader, IE you posted that you didn't think you had EMET installed on your system but never posted back to tell us what eventually solved your problem.

I don't know if there's a connection, but there is a known issue with KB3175024 (MS16-111: Description of the security update for Windows Kernel: September 13, 2016) released for the September 2016 Patch Tuesday updates that causes a conflict with EMET on Win 7 SP1.  Based on the date of your original post, it could be KB3175024, and not Norton, that's the cause of your problems.
------------
32-bit Vista Home Premium SP2 * Firefox v48.0.2 * NIS v22.7.1.32 * MBAM Premium v2.2.1