Johkaz
May 18th, 2003, 11:44 AM
Hi to everyone,
Please don't have a go at me about this but, i am trying to solve a long standing problem that i have been having with Norton Internet Security 2002.
Below is a copy of an e-mail i have sent to Lavsoft, about this problem, and how maybe due to my stupidity. I made this happen?
Please let me know if anyone has any ideas about this?
Thanks in advance.
-------------------------------------------------------------------------------------------
Dear Sir/Madam,
I am wondering if you can help me please with a small problem I have been having regarding Norton Internet Security 2002, SpywareBlaster and Ad-Aware 6.0? Because when I ran Ad-Aware 6.0, it may have cleared up the problem I have been having with Norton.
But, I would like to ask for your advice on this matter please.
The problem I have been having is that for some months, I have been having some extra files getting added to the main Norton folder. And I can't work out how it is being done. I was running Ad-Aware 6.0 alongside of SpywareBlaster, to make sure that no spyware got into my computer, but somehow these files were still being made inside the Norton folder. I have attached a copy of one of them, along with the log file from Ad-Aware 6.0.
For it wasn't until today, that I decided to delete SpywareBlaster, and then run Ad-Aware 6.0 on it's own for a full scan of my computer.
It was after it had finished that it said that it had found something called a Data Miner?
This is why I have attached the logfile for you inspect please, because while I had SpywareBlaster on my system. This was never picked up by Ad-Aware. And I am wondering if the combination of these two programs running together, maybe disabled one another, and then allowed this Data Miner to do it's work. And allow information out of my computer, by making these files in the Norton folder?
Also bypassing my Norton firewall as well?
I have been in touch with a Norton adviser on this matter, and the impression I get is that they are maybe as stumped as I am about this matter.
In the latest e-mail that I received from them, they advised me to scan all files with NAV, the single folders with NAV, but still it came back with these 'added' files as ok, no viruses found. And if this didn't work un-install/re-install Norton Internet Security.
I have attached below my reply back to the Norton adviser from everything I have tried today.
And it was only that I didn't want to un-install Norton completely and then re-install it again, and go through about 3 hours of updates that I decided to try the spyware approach.
Maybe this will teach me not to mix software.
I thank you in advance for any help that you can offer to me in this matter.
Yours.
Gary Gailey
My computer is an Athlon XP2000+ chipset,
ASUS A7N266-C motherboard,
with a dual boot system of the main operating system of XP Home (SR1 installed),
and Windows 98SE (both with all of the latest updates installed)
-------------------------------------------------------------------------------------------
To Shubhadeepta Panda,
Thank you for the e-mail and the instructions on checking the files that I found in my main Norton Internet 2002 folder.
I have followed the instructions as follows, and the results are:
1. I ran LiveUpdate for both NIS and NAV until received the message that you said about no more updates.
2. I then ran a full system scan of my computer (all files, all folders and all drives)
3. I then ran a separate scan of both the main NIS folder, and the folder that I transferred all of the bogus files into.
The results that I got back after this was, that the full scan showed no viruses present on my computer. In any files, folders on any of my drives.
The results that I got back after doing the individual scans of the folders, also showed nothing was present. Even when I selected each of the bogus files in turn and I had each of them scanned with Norton Anti-Virus.
One thing that has me concerned is if you look at the screenshot I have sent to you of the 'Single bogus file scan'.
On the scan result screen it shows the following:
One bogus file Scanned - Files 1, Master Boot Record 2, Boot Record 8
Compared to the result that I got when I scanned the whole Norton folder on my C:\ drive.
Norton Folder Scanned - Files 77, Master Boot Record 2, Boot Record 8
I think that this bogus file has something to do with Norton itself, because of the results above with the Master Boot Record and the Master Boot.
Which also makes me think this as Norton Anti-Virus has found nothing wrong with the files, because it thinks that they are part of the program itself.
Also I think this because of the first few lines of the bogus file named 70_GsWUbiBhGcutqu8GWFG3aWZ9WH1rU.!!!.
Which I have copied into this e-mail below:
ÿÿÿÿÿÿÿÿ— ÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ–’ T –ÁÞj¦ ÃAdministrator User-Agent: LiveUpdate Engine COM Module http://customer.symantec.com/mysite.txt ’ ® p ¶1o¦ ÃAdministrator User-Agent: Symantec LiveUpdate http://liveupdate.symantecliveupdate.com/liveupdate_1.80_english_livetri.zip ® – X ª‚o¦ ÃAdministrator User-Agent: Symantec
Also to make sure that there is no viruses involved in these files, I scanned the Bogus files and the folder with my AVG Anti-Virus program.
It found nothing in any of the files, but what also I have noticed is the following:
Norton Bogus file folder scan showed 28 files scanned in total.
AVG Bogus file folder scan showed 38 files scanned in total.
This really has me confused and worried, because of the difference in the amount of files in the scan total?
So I think that deleting the temp files on my C:\ drive will do no good in this matter.
Also deleting and re-installing the whole of Norton Internet Security and the Norton Anti-Virus, may have no effect either. Especially, if Norton itself is making these files up itself, and they are being stored in the actual C:\Windows\Program Files\Norton Internet Security folder.
I will wait for your reply to this e-mail, before I un-install NIS 2001/2002 and NAV 2001/2002.
I have tried to send a copy of some of the bogus files to the Symantec Security Response department, including the file named above for their inspection. But, after following the instructions in the link to the Scan and Deliver instructions, I tried to sent a copy of the files.
But I got the following screen information come up and I cannot send them for analysis:
"The file does not seem to be infected" (this came up after I selected the files, and pressed Next).
"None of the files you selected in this session qualified for submission to SARC" (this information came up on the next screen, from the screen above,
and I could only Finish or go Back on the Scan and Deliver program).
Can you please tell me if I need to submit these files please, as I have at the moment 22 files (total size zipped for the files 2,994KB)
The files I have in the NAV Quarantine folder is 6 files (zipped total size is 744KB)
Please don't have a go at me about this but, i am trying to solve a long standing problem that i have been having with Norton Internet Security 2002.
Below is a copy of an e-mail i have sent to Lavsoft, about this problem, and how maybe due to my stupidity. I made this happen?
Please let me know if anyone has any ideas about this?
Thanks in advance.
-------------------------------------------------------------------------------------------
Dear Sir/Madam,
I am wondering if you can help me please with a small problem I have been having regarding Norton Internet Security 2002, SpywareBlaster and Ad-Aware 6.0? Because when I ran Ad-Aware 6.0, it may have cleared up the problem I have been having with Norton.
But, I would like to ask for your advice on this matter please.
The problem I have been having is that for some months, I have been having some extra files getting added to the main Norton folder. And I can't work out how it is being done. I was running Ad-Aware 6.0 alongside of SpywareBlaster, to make sure that no spyware got into my computer, but somehow these files were still being made inside the Norton folder. I have attached a copy of one of them, along with the log file from Ad-Aware 6.0.
For it wasn't until today, that I decided to delete SpywareBlaster, and then run Ad-Aware 6.0 on it's own for a full scan of my computer.
It was after it had finished that it said that it had found something called a Data Miner?
This is why I have attached the logfile for you inspect please, because while I had SpywareBlaster on my system. This was never picked up by Ad-Aware. And I am wondering if the combination of these two programs running together, maybe disabled one another, and then allowed this Data Miner to do it's work. And allow information out of my computer, by making these files in the Norton folder?
Also bypassing my Norton firewall as well?
I have been in touch with a Norton adviser on this matter, and the impression I get is that they are maybe as stumped as I am about this matter.
In the latest e-mail that I received from them, they advised me to scan all files with NAV, the single folders with NAV, but still it came back with these 'added' files as ok, no viruses found. And if this didn't work un-install/re-install Norton Internet Security.
I have attached below my reply back to the Norton adviser from everything I have tried today.
And it was only that I didn't want to un-install Norton completely and then re-install it again, and go through about 3 hours of updates that I decided to try the spyware approach.
Maybe this will teach me not to mix software.
I thank you in advance for any help that you can offer to me in this matter.
Yours.
Gary Gailey
My computer is an Athlon XP2000+ chipset,
ASUS A7N266-C motherboard,
with a dual boot system of the main operating system of XP Home (SR1 installed),
and Windows 98SE (both with all of the latest updates installed)
-------------------------------------------------------------------------------------------
To Shubhadeepta Panda,
Thank you for the e-mail and the instructions on checking the files that I found in my main Norton Internet 2002 folder.
I have followed the instructions as follows, and the results are:
1. I ran LiveUpdate for both NIS and NAV until received the message that you said about no more updates.
2. I then ran a full system scan of my computer (all files, all folders and all drives)
3. I then ran a separate scan of both the main NIS folder, and the folder that I transferred all of the bogus files into.
The results that I got back after this was, that the full scan showed no viruses present on my computer. In any files, folders on any of my drives.
The results that I got back after doing the individual scans of the folders, also showed nothing was present. Even when I selected each of the bogus files in turn and I had each of them scanned with Norton Anti-Virus.
One thing that has me concerned is if you look at the screenshot I have sent to you of the 'Single bogus file scan'.
On the scan result screen it shows the following:
One bogus file Scanned - Files 1, Master Boot Record 2, Boot Record 8
Compared to the result that I got when I scanned the whole Norton folder on my C:\ drive.
Norton Folder Scanned - Files 77, Master Boot Record 2, Boot Record 8
I think that this bogus file has something to do with Norton itself, because of the results above with the Master Boot Record and the Master Boot.
Which also makes me think this as Norton Anti-Virus has found nothing wrong with the files, because it thinks that they are part of the program itself.
Also I think this because of the first few lines of the bogus file named 70_GsWUbiBhGcutqu8GWFG3aWZ9WH1rU.!!!.
Which I have copied into this e-mail below:
ÿÿÿÿÿÿÿÿ— ÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ–’ T –ÁÞj¦ ÃAdministrator User-Agent: LiveUpdate Engine COM Module http://customer.symantec.com/mysite.txt ’ ® p ¶1o¦ ÃAdministrator User-Agent: Symantec LiveUpdate http://liveupdate.symantecliveupdate.com/liveupdate_1.80_english_livetri.zip ® – X ª‚o¦ ÃAdministrator User-Agent: Symantec
Also to make sure that there is no viruses involved in these files, I scanned the Bogus files and the folder with my AVG Anti-Virus program.
It found nothing in any of the files, but what also I have noticed is the following:
Norton Bogus file folder scan showed 28 files scanned in total.
AVG Bogus file folder scan showed 38 files scanned in total.
This really has me confused and worried, because of the difference in the amount of files in the scan total?
So I think that deleting the temp files on my C:\ drive will do no good in this matter.
Also deleting and re-installing the whole of Norton Internet Security and the Norton Anti-Virus, may have no effect either. Especially, if Norton itself is making these files up itself, and they are being stored in the actual C:\Windows\Program Files\Norton Internet Security folder.
I will wait for your reply to this e-mail, before I un-install NIS 2001/2002 and NAV 2001/2002.
I have tried to send a copy of some of the bogus files to the Symantec Security Response department, including the file named above for their inspection. But, after following the instructions in the link to the Scan and Deliver instructions, I tried to sent a copy of the files.
But I got the following screen information come up and I cannot send them for analysis:
"The file does not seem to be infected" (this came up after I selected the files, and pressed Next).
"None of the files you selected in this session qualified for submission to SARC" (this information came up on the next screen, from the screen above,
and I could only Finish or go Back on the Scan and Deliver program).
Can you please tell me if I need to submit these files please, as I have at the moment 22 files (total size zipped for the files 2,994KB)
The files I have in the NAV Quarantine folder is 6 files (zipped total size is 744KB)