Easternokie
I do not doubt that Sonar is deleted your programs. However, can you confirm that when you turn off Sonar Advanced Mode that the problem does not arise? Can you also please confirm that when you recover the file that is quarantined that Sonar does not attempt a 2nd or subsequent time to delete it, on the presumption that you take that option during recovery?
Lastly, although this exercise of recovery is annoying, do you agree that this is a workaround at this time?
thank you
Hi kalahari
Please clarify your experience with MSE for me... you wrote: When I installed MS Security Essentials today, it gave me a serious warning about AsteriskLogger --- it did not just delete it without giving me any choice in the matter. I chose not to install it.
Do you know at what stage of the potential download / install of AsteriskLogger that MSE offered you the serious warning. Did MSE permit the download and then from quarantine offer you the option not to install. Since you wrote "it did not just delete it [...]" ....that sounds like AsteriskLogger was resident on your System somewhere waiting for you to act on the warning. Maybe you feel SONAR is acting in haste or too aggressively. Maybe it is...but, the alternative to allow potential malware to download and be quarantined to be removed at your request is reasonable only if all malware could be easily / completely / cleaned / removed from quarantine. As you know not all malware goes quietly into the night. I respectfully offer this info Here
I do not disagree with your assessment of SONAR. I respectfully suggest Protecting the PC against Malware infection in the first place is always better than subsequently attempting to clean up the chaos created by an infection.
Regards
bjm_
bjm_
Sorry, don't remember the exact sequence and have been unable to recreate -- maybe the MS product is remembering my earlier selections somewhere so I can't get the errors for this particular app to pop up again. I think it quarantined AsteriskLogger and I could remove it from quarantine if I really wanted to.
AsteriskLogger (and all the rest of the NirSoft utilities) were in a single zip file that I had downloaded from NirSoft while NIS 2010 was installed and running. So NIS 2010 allowed the download of the zip file with all of these utilities. It subsequently declared them (after unzipping) to be Security Risks and then deleted them. (BTW, we are giving way too much attention to AsteriskLogger. That has the potential of mischief; I was concerned about others that were not for retrieving passwords but NIS said had "Hacktool".)
I think I should leave this thread for the original poster. It was not my intention to hijack it.
SONAR deletes it only every time it is recompiled. I have sent in a sample several months ago, never a reply from Norton.
Sonar is a big headache for those who are not tech savy and indeed I find the problem of deleting files that we hve asked to be restored reoccurring again and again ! Hope Norton/Symnatec can look into it!
Hi kalahari et al,
Thank you for your reply and additional comments. The time between posts and your reply has forced me to re-think my perceptions. I'm sure all user's desire a better mouse trap. A better mouse trap always breeds a smarter mouse. The focus to trap the smarter mouse has evolved out of necessity to a focus on blocking the smarter mouse from getting anywhere near the mouse trap. To that end... Norton built a mouse trap with Quorum ~ Download Insight ~ Intrusion Prevention System ~ Norton Safe Web and SONAR 2. Does this new & improved mouser need some tweaking. Yes! To that end...I have to believe the Norton's mouser will be tweak'd. Will the tweak'd Norton mouser meet user expectations. Time will tell. For now I offer this mouser guide for your viewing pleasure.
Regards to all,
bjm_
KLMystic,
You said "Sonar is a big headache for those that are not tech savvy..." I'm saying it's a problem for tech savvy people like me :) The deleting of files (or the quarantining of files) without the ability to override is a problem though.
bjm_,
Thanks for your response. I have done some more thinking today too. This morning, I uninstalled NIS 2010 and installed MS's product. I have now uninstalled MS's product and re-installed NIS 2010. If there is so much support for the NIS product on this forum, I think that it may make it worth working through my percieved "issues and problems" with it.
I will definitely take a look at the mouser guide that you provided a link too. Thanks
Hello kalahari
Wow! You had a busy day. Thought we lost ya....Happy to hear your back (for now). This Forum is really special ... you are a valued tech savvy member of the Community. Remember, it's not just a Security product... it's an adventure. 
The Forum has extended hours....we never close!
Thanks and regards
bjm_
bjm_ wrote:Hello kalahari
Wow! You had a busy day. Thought we lost ya....Happy to hear your back (for now). This Forum is really special ... you are a valued tech savvy member of the Community. Remember, it's not just a Security product... it's an adventure.
The Forum has extended hours....we never close!
Thanks and regards
bjm_
bjm_,
With a spiel like that, you ought to be getting paid!!
Brubaker wrote:
bjm_ wrote:Hello kalahari
Wow! You had a busy day. Thought we lost ya....Happy to hear your back (for now). This Forum is really special ... you are a valued tech savvy member of the Community. Remember, it's not just a Security product... it's an adventure.
The Forum has extended hours....we never close!
Thanks and regards
bjm_
bjm_,
With a spiel like that, you ought to be getting paid!!
ROFL
Just out of curiousity, I tried MyD & Astlog on NIS09.
With NIS09 on default settings, I downloaded MyDefrag-v4.2.5.exe without problem, installed without problem, executed without problem.
With NIS09 on default, I managed to download astlog.zip. Upon unzipping, autoprotect removed the .exe (not recoverable from quarantine) and two other files, leaving an empty astlog folder. Upon scanning astlog.zip, the .exe was removed from the zip.
With NIS09 Sonar Advanced Protection off, autoprotect still removed the .exe from the zip file, and also removed everything from the extracted folder.
Only when I had added "AsteriskLogger" into Signature Exclusions, did NIS09 let me extract without removal, and scan without threat detected. The only thing I did not do is to try to execute the program.
Apparently, Symantec categorized this as "Potentially Unwanted App" here:
http://securityresponse.symantec.com/security_response/writeup.jsp?docid=2009-090120-4032-99
I think this is not a FP but a concern from a security point of view (that's why it is labelled "potentially unwanted"). If you let your friends use your computer, you can recover their passwords for whatsoever intentions you might have. Nirsoft and other program developers might have good intentions, but it is like a knife, you can use it for good, and you can use it for bad.
I'm sure I'd like Norton to ask me: "This is a Potentially Unwanted App. Do you want to continue...? Click here for more info..."
Seeing as how I had raised the issue around NIS 2010 deleting various NirSoft utilities, I had sent 7 of those (identified as risks) to Symantec for evaluation. I actually got responses today that they will remove "risk" detection for 5 of those (heapmemview, userassistview, sniffpass, vncpassview, pstpassword) but will continue to classify ProduKey and Asterisklogger as risks. They are also going to classify www.nirsoft.net (the NirSoft Utilities web site) as safe.
So I think that this is all good :) I have no problem with ProduKey and Asterisklogger remaining as "risks" as they can potentially be used for "mischief".
The emails that I got from Symantec said "The updated detection will be distributed in the next set of virus definitions, available daily, or weekly via LiveUpdate, depending on Symantec product version, or daily from our website at http://securityresponse.symantec.com/avcenter/defs.download.html "
So, for the OP, you may want to consider submitting (or re-submitting) your software details to Symantec. I was quite impressed with the turnaround on these utilities as I submitted them only two days ago.
I have not had a response on MyDefrag yet.
The new postings are all very interesting, but highlight the real problems:
We are a small company. That senior development staff have to spend hours dealing with problems created by SONAR is unforgivable on NORTON"s part. A product that does not work, i.e. SONAR, and costs money, i.e. considerable labor to work around is not a product worth using.
We have several systems running Windows-7. NIS2010 is the only version that runs on Windows-7.
Does NORTON understand that customers are unhappy and will have to seek alternative solutions?
Hi Brubaker
re >
With a spiel like that, you ought to be getting paid!!
bjm_
bjm_, I wholeheartedly agree.
Here is another thing ... if you exclude a quarantine item which is registry key, it just keeps picking it up on the next scan.
Exclusion on works for files, directory, and signatures, but not registry keys.
Sigh ...
KLMystic wrote:
Sonar is a big headache for those who are not tech savy and indeed I find the problem of deleting files that we hve asked to be restored reoccurring again and again ! Hope Norton/Symnatec can look into it!
Hi KLMystic,
This particular problem has been fixed a while ago. Did you try the hotfix http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=73076
With the hotfix installed, SONAR will not convict a file that has been restored from quarantine, unless the file changes.
Thanks,
Shane.
Good point, but I thought the first real patch to NIS10 is being deployed as I write this. So, I thought I would wait.
Although the patch seems to be stuck behind the same truck that is carrying my county's H1N1 vaccine! :)
Mark_kratzer
No, the hot fix is the fix.
Shane,
After installing NAV 2010, I noticed problems and found, I believe, Sonar is deleting our software.
Also, NAV also is doing background scans. It brings our computers to a crawl.
Granted, after reading your blog, I see where I can start turning things off but that's rediculous.
I have several hundred installations using our software and NAV is removing our software from their systems. These are medical clinics and they can not have our software deleted by NAV....
Can you just turn off this Sonar from all systems on this planet, please...
People use NAV for scanning their email not deleting their software. I will do my own scanning.
Frank