Here is something interesting which I just noticed.
Suppose I have XYZ.EXE which gets picked up by SONAR. Now, suppose I want to exclude it.
You can go to Quarantine and restore/exclude it. However, the file path and/or signature does not appear in the exclusion lists. Just simply SONAR excludes it in the future.
In other words, SONAR maintains its own separate exclusion list independent of disk scans or auto-protect. There is no way to view or futher edit SONAR’s exclusion list.
It seems to me that SONAR is not fully integrated into the rest of the NIS feature set. It behaves more like the SPAM filter which is apart from everything else. Futhermore, the full complement of features/options which need to be provided with SONAR have yet to be completely worked out.
Thanks.
Maestro wrote:I don't believe this thread should've gotten this far.
rft,
I understand your frustration over this matter, and I agree that you should switch to a different AV suite that would suite you more than Norton does...no pun intended.
cgoldman,
I believe that a forum Guru should not make posts like the one you posted. A person of your power on this forum should never be saying such things to posters who are having problems, but that is just my opinion.
Message Edited by Maestro on 10-14-2009 02:54 PM
I saw nothing unprofessional in goldman's post. It could have been miscontrued I suppose; but I think he was simply trying to get to the root of the communications problem. I must admit that I stayed off of this thread because of the difficulty I had understanding what was being said and intended by a number of posters.
I did have difficulty, too, understanding why Mr. Goldman's suggestions, which sounded useful to me, were ignored.
BruceA wrote:Gosh I love the way these posts bounce round and round getting foggier and foggier.
There is a whole lot of missdirection here and we will never get it fixed if we don't get the issue clear:
Sending a 'false positive file' is in some ways a red herring. The SONAR issue we are trying to discuss is that:
- A file appears on the PC that is both New and Not often/ever found. It can be saved to disk
- It does not have a virus signature match so it is not a false positive. It passes normal quick/ autoscans etc
- It does however do something 'bad' when run e.g Web browser that dares to contact the internet
- SONAR at least quarantines it without choice or discusssion - also reported to Delete if it is even 'badder'
- Restoring the file and using the UI proposal to not scan it again restores but does not stop SONAR quarantining again next time
The issue therefore is that SONAR is doing what it was designed to do. However its options to customise reactions or omit files in advance/subsequently are either absent or not currently working as expected. I can't send you a file for copyright reasons but just believe that it is possible to compile and save to disk a safe file that does not match a virus signature but when run does look new, rare and web active. The questions to Symantec :
1) how /are you going to allow people who make/use such files to create / use /work on them while enjoying NIS protection
2) how /are you going to allow other 'normal' people who want to receive / install /use such files to do so (manually or ideally as part of an installer script)
Hoping this is now clearer :-)
Very well stated, but missing the last question:
3) how are you going to protect normal people from accepting and launching software with the same behavior but which really is disguised malware?
Ah, there's the rub.
Mark_Kratzer wrote:I just want to add my two cents. I think the exclusion process is getting to complex with three different areas that one has to handle: scan exclusions, AP exclusions, and signature exclusion. One should not have to tweak a number of things to make an exclusion work.
As far as the original issue with SONAR, like everything Symantec's defaults should protect ignorant PC users, but the controls should be provided that the product may be configured in any manner the user desires if they are willing to accept the consequences.
I think this is one of the more valid points made yet.
NIS is distinguished from Norton 360 by its socalled "user-configurability" (to coin an expression). That is why I choose NIS over 360: I like to make my own decisions for how my computer is protected.
Unfortunately, despite its excellence in so many other areas, user friendliness is almost nil. The help screens do not correspond to actual behavior (this is a big issue with me and one that Symantec even refuses to answer). The ability to adjust (I won't even say "tweak" because these adjustments are bigger and more important than mere tweaks) is only halfway useful and hard to understand, as I am seeing on this thread.
The usual response from Symantec is that they want to keep us from hurting ourselves, but that is what 360 is for. NIS is for those of us who are willing to take various risks and who don't wish to be kept from hurting ourselves. What we need, though, are clear controls, clear explanations, clear help; so that if we do hurt ourselves it won't be because of anything Symantec misstated or misdesigned ... or refused to clarify.
Mark_Kratzer wrote:
Here is something interesting which I just noticed.
Suppose I have XYZ.EXE which gets picked up by SONAR. Now, suppose I want to exclude it.
You can go to Quarantine and restore/exclude it. However, the file path and/or signature does not appear in the exclusion lists. Just simply SONAR excludes it in the future.
In other words, SONAR maintains its own separate exclusion list independent of disk scans or auto-protect. There is no way to view or futher edit SONAR's exclusion list.
It seems to me that SONAR is not fully integrated into the rest of the NIS feature set. It behaves more like the SPAM filter which is apart from everything else. Futhermore, the full complement of features/options which need to be provided with SONAR have yet to be completely worked out.
Thanks.
LOL, same problem as me. As a developer I compilie new builds of programs several times a day and often rename them so I can keep multiple copies for comparitive reasons.
I must have at least 600 extinct exclusions entered into Sonar by now and have never been able to find a way to clean them out.
Guys,
I thought it was me.
Things started disapearing after the "Free" update to 2010 from Norton. This version of 'Sonar' should never have been included.
We are a developer and have many medical installations all over the place. I just found out that 'Sonar' is deleting my software and our average user is not computer savy and will blame me and possible sue me over bad software.
The ironic issue is that part of the medical field is required to use ProComm which is an old Symantic product and 'Sonar' a Symantic product automatically deletes ProComm, a Symantic product.
I contacted the Symanticsupport staff and they escalated it to the top. They were so amazed that this was happening that they forwarded it to the Symantic programming staff as a major programming bug.
Symantic should automatically remove this function from all installations immediately.
Frank
He he he Procomm … I remember that one. A very useful terminal emulator in its day.
From what I have been able observe, any EXE is considered a threat if SONAR hasn’t seen it in the cloud already. In other words, writing the classic C program that spits out “Hello World” to stdout would be considered a threat and get deleted.
Besides software developers … Insight must be wrecking havoc with students and computer science instruction. However, it is likely that a large number of those who would be affected have yet to upgrade to NIS10. Once again, this makes the general utility of trade press reviews (which were absolutely glowing) suspect. You would expect them to catch something like this or, at least, report it after the fact.
It would seem that Symantec has finally closed the Window on Zero Day, Zero Hour, and Zero Minute. As the initial infection will not be able to take hold on a NIS10 platform, since it has yet to be seen in the cloud. And since it has yet to be seen, subsequent infections by definition also become impossible. The only way new software can get cloud approval after the birth of the cloud is by receiving a manual override and addition to the database by Symantec.
Symantec with Insight and the Cloud has finally arrived at Police State Computing. You will be protected from threats whether you like it or not, and Symantec will be the sole and final arbitrator of what is a threat.
—
Dear Symantec Staff, please note that I am not trying to be hostile, but I think you have a serious problem here. Thanks.
Mark,
Love you. Keep pressing...
Frank
Mark,
Since you are our leader, can I add more issues to your NAV2010 problem.
I use NAV to scan my email and periodically I will scan my computer. That's all I want. That's all anyone should want, I think.
My issues are:
1. If I turn off 'Sonar' I get this big warning saying my computer is at risk. On a Vista machine you get a red alert button above the clock saying At Risk, like maybe you have a virus. Now if you click the At Risk button, it turns 'Sonar' back on. Now your at risk to lose your software.
2. This background scanning, I believe is slowing my machines down. Sometimes the system hangs and it seems frozen. I want this background scanning turned off. I will do my own scanning. According to the Symantic support staff, if you turn off 'Sonar' it turns off the background scanning. It seems to work on XP but not on Vista machines. How does one turn that off?
Why doesn't Norton just KISS (Keep It Simple Stupid).
Keep pressing...
F.
Frank,
I am not sure that “Say ‘NO’ to SONAR is a movement”.
In either case, I am not a leader or spokesperson. I am simply a NIS10 customer that wants the most effective, seamless, and configurable protection I can get from NIS.
Towards that end I follow this forum and occassionally post here. It is encouraging that Symantec employees actually do read the forum beyond providing the forum simply as a facility for customer self help. Hopefully, threads such as these will lead to improvements in NIS.
I wish you luck with your client base.
—
BTW, there is a right menu Explorer context item for Norton File Insight. It displays a pop-up. One of the options is “Trust Now”. I am not sure if this would resolve the deleting problems or not. Assuming, your application is a single executable as opposed to a large collection of executables. Then, maybe you can include this in your release notes and issue an urgent advisory to your customers. This would still seem preferable to fishing things out of Quarantine which is awash in email spam attachments.
I thought I saw somewhere a place to submit a file to Symantec’s cloud for vetting. However, I cannot locate it at the moment. Perhaps, that might provide a better work around assuming that I really did see the option somewhere.
All,
Those of developers who are having issues with SONAR deleting files you compile yourself, please reply with the compiler as well as a link to the download/purchase.
So far I have:
Visual Studio 6
Intel Visual Fortran
SONAR blocked a very simple program written and compiled with Dev C++.
Tim,
So far, I noticed it removed an exe compiled with VS8 and an exe that was created with WinZip self extractor that contain a bat, a was and a wax file.
F.
Yes, I think that’s it.
Hi,
I was wondering whether a Symantec representative could help me?
We produce a software package for which part of the installer is being reported by SONAR as potentially malicious.
If someone could respond here as to how we go about getting this whitelisted, I would very much appreciate it.
Thanks in advance,
Paul Andrews
Hi paul1andrews:
Welcome to the Norton Support Forums!
Your concern is quite understandable, there are many mixed feelings on SONAR.
Please click on this link and read through the entire thread. You can post there as well, noting your Norton product.
I will also ask a Moderator to move this thread under it.
Hope this helps.
I just realized this may not be all bad.
If I was back in school as a Computer Science student, I could use the excuse that NIS10 ate my homework. I guess one person’s lost livelihood is another’s opportunity to have the weekend to finish the assignment. So, you could really say that Quarantine is half full instead of half empty.
Mark_Kratzer wrote:
I just realized this may not be all bad.
If I was back in school as a Computer Science student, I could use the excuse that NIS10 ate my homework. I guess one person's lost livelihood is another's opportunity to have the weekend to finish the assignment. So, you could really say that Quarantine is half full instead of half empty.
That's the spirit!! 
Mark_Kratzer wrote:
I just realized this may not be all bad.
If I was back in school as a Computer Science student, I could use the excuse that NIS10 ate my homework. I guess one person's lost livelihood is another's opportunity to have the weekend to finish the assignment. So, you could really say that Quarantine is half full instead of half empty.
BTW, if you want to date me (don't take that the wrong way), you have only to know that one of the programming languages I learned back in CompSci was Balgol. Do you even know what that was?