• 所有社区 - 中文
    • 所有社区 - 中文
    • 论坛
    • 创意
    • 博客
高级

不是您要找的? 咨询专家!

此论坛帖文需要解决方案。
好评0

trojan:html/phish detected in Norton

Hello everyone.

I am not sure if this is the correct place to post this as I only joined the community today.

I have two PC's, both run NIS as well as MSE.

Yesterday MSE reported Trojan:html/phish on both PC's. I did not take notice of the location but removed the threat from both PC's.

Later that night MSE reported it again on one PC but not the other. This time I noted the location as being:

C:program files (x86)\Norton Internet Security\NortonData\22.5.24\Definitions\WebProtectionDefs\20180417.304\Identifiers.xml

ALSO. Norton history reports multiple (and on going) blocked attempts to access nortonsecurtiy.exe by msmpeng.exe

Is the reported Trojan likely to be a false positive and both issues just MSE being stupid? 

Help :-)

回复

好评0

Re: trojan:html/phish detected in Norton

Hello Uniquename

Welcome to the Norton Community Forum

It is not advisable to run 2 real time security programs at the same time on one computer. Doing so creates internal fights trying to do their work behind the scenes. Instead of greater protection, you end up less protection and incorrect results.

Have a Good Night and

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 282 I E 11 Chrome latest version.
好评0

Re: trojan:html/phish detected in Norton

If you are running two real time AV products that could be the problem. It is possible that one detects the definition files of the other as a threat. Running more that one at a time can actually reduce your protection.

Only run one AV at a time.

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: trojan:html/phish detected in Norton

I guess we think alike at times Peter

Have a Good Night and

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 282 I E 11 Chrome latest version.
好评0

Re: trojan:html/phish detected in Norton

I am having the same issue with MSE flagging my Norton Identity Safe as a Trojan:HTML/Phish attack and I only use MSE for Antivirus & Malware so it's not an issue of two conflicting programs.

Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
     Name: Trojan:HTML/Phish
     ID: 2147678587
     Severity: Severe
     Category: Trojan
     Path: file:_C:\Program Files (x86)\Norton Identity Safe\NortonData\2014.7.8.23\Definitions\WebProtectionDefs\20180416.304\Identifiers.xml
     Detection Origin: Local machine
     Detection Type: Concrete
     Detection Source: Real-Time Protection
     User: NT AUTHORITY\SYSTEM
     Process Name: C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\nst.exe
     Signature Version: AV: 1.265.768.0, AS: 1.265.768.0, NIS: 1.265.768.0
     Engine Version: AM: 1.1.14700.5, NIS: 1.1.14700.5

Additional Path Files for Norton Identity Safe triggering this are also:

C:\Program Files (x86)\Norton Identity Safe\NortonData\2014.7.8.23\Definitions\WebProtectionDefs\tmp11e.tmp\mdfe687e.tmp

C:\Program Files (x86)\Norton Identity Safe\NortonData\2014.7.8.23\Definitions\WebProtectionDefs\tmp7eb2.tmp\mdfbd0f1.tmp

C:\Program Files (x86)\Norton Identity Safe\NortonData\2014.7.8.23\Definitions\WebProtectionDefs\tmp7e51.tmp\mdf872db.tmp

C:\Program Files (x86)\Norton Identity Safe\NortonData\2014.7.8.23\Definitions\WebProtectionDefs\tmp73ba.tmp\mdf61d99.tmp

I did read several tweets to @NortonSupport on Twitter and it appears this is a common problem for many people that has just recently cropped up.

好评0

Re: trojan:html/phish detected in Norton

jboogieman

Are you also running another security product alongside your MSE? If so that can be causing these problems. And can you confirm, is it Microsoft Security Essentials, MSE, or Windows defender you are referring to?

I

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: trojan:html/phish detected in Norton

Hello

I don't know, but this path seems a little odd to me.

C:\Program Files (x86)\Norton Identity Safe\NortonData\2014.7.8.23\Definitions\WebProtectionDefs\tmp11e.tmp\mdfe687e.tmp

Norton Identity Safe is a Password Manager Why would it have definitions? This looks to me like it is a result of running more than 1 real time security program at a time. The description mentions Windows Defender as running.

Have a Good Night and

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 282 I E 11 Chrome latest version.
好评0

Re: trojan:html/phish detected in Norton

ID Safe does rely on some downloaded def files to help with logins for sites with non standard login details. So if the user has  installed the stand alone version of ID Safe, the path would be valid.

Uniquename seems to have Norton Internet Security and MSE installed and the Microsoft product seems to have developed a false positive for some Norton files.

jboogieman may in fact just have Windows Defender. No mention of Norton security. Again, as a Microsoft product it probably shares the same definitions as MSE, thus the same false postitive.

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: trojan:html/phish detected in Norton

peterweb

Sorry, yes it's Windows Defender not MSE and it's the only security program I have running on my PC. Having said all that the issue was occurring several nights in a row and then just suddenly stopped so sounds like either a bunch of false positives or all the reports of the issue to Norton Support's Twitter handle actually made a difference.

floplot

The Identity Safe does have a bunch of Web Protection Definition files downloaded. It's more than just a Password Manager as it has the ability to store payment information and allow for quicker checkouts online.

Thanks again and have a beautiful weekend!

好评0

Re: trojan:html/phish detected in Norton

Hi All,

Any resolution to this? My windows defender just reported the same problem (see attached screenshot). I don't have any other virus protection.

Thanks in advance

好评0

Re: trojan:html/phish detected in Norton

Hello,

I am sorry for the inconvenience you are experiencing.
I'm surprised too when you say, "I do not have any other virus protection".

When I look at your screenshot, the mentioned tree appears to match Norton Identity Safe Standalone.
I am wondering whether this product is installed on your computer or that files from an old installation have remained on your hard drive.
 
Norton Identity Safe Standalone had anti-phishing protection. These are the signatures that are currently detected by your antivirus.

Be careful though this product has been stopped and is no longer updated since mid-2017.
So I invite you to uninstall this program or delete the residual tree containing the signatures.

This should secure your computer and your data and at the same time resolve detection by Microsoft's antivirus.

Cordially

Guillaume1024

好评0

Re: trojan:html/phish detected in Norton

Cyberial Man

This issue seems to be a false positive detection in Windows Defender. This is not related to Norton. Be sure you run Windows update to get the latest Defender definition update. Others have reported this issue resolved itself.

Things happen. Export/Backup your Norton Password Manager data.
好评0

Re: trojan:html/phish detected in Norton

Guillaume

This is not really a solution. Yes removing MSE or Defender will resolve the issue since neither will be on anyones system for this report to appear in the first place.

I remember many years ago before running any Norton product I was using Avira and one day it just stopped and would not start. I tried downloading other virus programs and running those, all seemed good until I installed MSE and straight away it found a Trojan and killed it, next thing Avira started and went mental and found multiple issues which were removed.

This is why I run more than one AV program.

Point being not every security program/virus program will find and remove everything which is the primary reason I ran MSE in conjunction with NIS. Fact is both programs worked along side each other with NO issues until the day of my original post.

And naturally any company that makes an AV program is going to say use our product and ONLY ours so if it is not a good idea to run multiple virus products together then the question I have is: Why did it just suddenly start?

I was sent a PM asking to submit the file in question, unfortunately I cannot do that as the file location no longer exists and I removed MSE and ran a full system scan with NIS, naturally there was no issue found but see above.

I am of half a mind to reinstall MSE and see what happens and submit anything that my be found.

If it turns out to be a false positive AFTER the file is checked then that to me is a solution whereas removing the offending program could be nothing more than hiding an actual problem.

好评0

Re: trojan:html/phish detected in Norton

Hello

You could run a free security program to double check things. You can run the free version of Malwarebytes. This program will not interfere or conflict with Norton. The paid version would conflict with Norton.

Download the free version, install and update then run a FULL scan.


You can find Malwarebytes here
https://www.malwarebytes.org/dl-confirm/
Malwarebyttes 3 has been made to run along side Norton and other 3rd party security programs.

 https://forums.malwarebytes.com/topic/191650-malwarebytes-30-frequently-asked-questions

All you have to do is disable the trial in Settings>Account. That will disable the live time settings also. There is also another Setting to stop the program from starting with Windows. So only 2 settings to change to make the program be a on - demand scanner as previously in version 2.

Have a Nice Day and

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 282 I E 11 Chrome latest version.
好评0

Re: trojan:html/phish detected in Norton

@Uniquename,

As has already been mentioned in this thread and through the internet, you should not run two antiviruses on one machine.

That said, there is not usually any problem running a different type of security program to complement your AV, but research needs to be done to find what does and doesn't get along with your AV of choice.  As mentioned above, a safe choice would be Malwarebytes but there are other options you could consider.

FWIW, I disagree that the Premium version of Malwarebytes conflicts with Norton.  I (and many others) use both on two machines and do not have any problems.

A little bit of knowledge is... well a little bit of knowledge.
好评0

Re: trojan:html/phish detected in Norton

Update

Message via PM from Norton

This is apparently a false positive and will be addressed in an up coming MSE update

好评0

Re: trojan:html/phish detected in Norton

Uniquename

As I suspected. Thanks for the update.

Things happen. Export/Backup your Norton Password Manager data.

This thread is closed from further comment. Please visit the forum to start a new thread.