Norton still falsely detects some Firefox files as risks

Discuss Avant Browser. Do not post support requests, bug reports, suggestions for new or improved features, etc. here. Put those in the Help, Bug Reports, and Requests forums, respectively.

Norton still falsely detects some Firefox files as risks

Postby mbrazil » Wed May 23, 2012 1:21 am

I just installed Avant Ultimate build 171 on top of build 169, and Norton Internet Security flagged mozalloc.dll and freebl3.dll as risks and quarantined them, as it usually does. It also flagged and quarantined mozglue.dll this time.

This is still mostly a Symantec problem, since they detect files with the same name but a new creation timestamp as unknown files and consider them a risk because they're not in their known-good database with that timestamp. They also don't don't provide any way to "permanently" exclude files based solely on their filenames. However, this is also a problem for Avant, since anyone who runs Norton Internet Security (and probably Norton 360) and is not aware of this situation will probably think there's something wrong with Avant when they get quarantine notices from Norton about these files and error messages regarding the missing files the first time they try to run Avant Ultimate after a new installation or an update. (This might also occur with other security software, but I'm not personally aware of it happening with any security software other than Norton Internet Security 2012.) This is particularly disconcerting on an update if you choose to reopen tabs that were open using the Firefox engine when you closed your previous Avant session. In this situation, you'll get multiple errors for each tab that Avant tries to reopen with the Firefox engine, so there will be lots of error messages.

I haven't been able to come up with a workaround for this other than to uncheck the option to run Avant in the last window displayed by the installer and restore and to exclude these files in Norton prior to starting Avant. I think it would be a good idea to change the default for the Run Avant Browser option in the installer to unchecked (or remove it entirely) and to display a notice something like this:

"Some security software may falsely detect some of the newly installed Avant Browser Ultimate Version files as risks. If this happens, it can cause errors when you try to start Avant, because some of the necessary files have been quarantined and are unavailable. To avoid this, do not check the Run Avant Browser option in the installer, set your security software to restore the Avant files from quarantine (and exclude them from scans), and then start Avant."

It might be a good idea to include the filenames in the notice, but since these might change from build to build, the notice would have to be updated whenever the files do change, so I didn't include them.
mbrazil
User avatar
Offline
AvantGuard
AvantGuard
Avantic Elite
 
Posts: 1965
Joined: Tue Jul 26, 2005 10:04 pm
Location: Grass Valley, CA
Windows Version: XP Pro SP3 x86 + all updates
Avant Version: 2013 Ultimate Build 23 & Build 115 (USB)
Default engine: Gecko (Firefox)
IE Version: IE8 + all patches and updates
Skin: Monai XP
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #1 by xiaobing » Wed May 23, 2012 2:32 am

Thanks for you information and suggeation,mike, we will consider it.
xiaobing
User avatar
Offline
Support Staff
Support Staff
Avant Guru
 
Posts: 3703
Joined: Wed Apr 22, 2009 1:52 am
Windows Version: xp/win7 64/win8
Avant Version: latest version
Default engine: firefox/chrome/IE
IE Version: 8/9/10
Skin: aero glass/opal glas
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #2 by Tinman57 » Wed May 23, 2012 11:35 pm

A lot of folks have problems with Norton false positives, it's not just AB. That's one of the reasons I dumped Norton years ago. I installed Avast! free and it plays quite well with AB. First time you run it you can tell Avast! to treat it as a web browser when the warning box pops up, or you can add programs manually before starting. On a clean system you can also put it in the training mode and let it add all your programs to the safe list. It's highly configurable, and don't hog memory/resources.....

Of course anti-virus programs are kind of like opinions, everyone has one and they vary. :)
((((TINMAN))))
----------------------------------------------------------
(Duck! It's another MicroSoft Patch!)
Tinman57
User avatar
Offline
Avantic
Avantic
 
Posts: 834
Joined: Tue Oct 13, 2009 2:26 am
Location: TEXAS
Windows Version: Linux Ubuntu 13.10
Avant Version: Linux Firefox
Default engine: Linux Firefox
IE Version: N/A
Skin: N/A
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #3 by mbrazil » Mon Jul 02, 2012 7:06 pm

Norton quarantined freebl3.dll again during installation of build 175. I guess this is progress of a sort, since it's the only file it objected to this time. Somebody needs to whack those Symantec people on the head with a 2x4 a few times to wake them up.
mbrazil
User avatar
Offline
AvantGuard
AvantGuard
Avantic Elite
 
Posts: 1965
Joined: Tue Jul 26, 2005 10:04 pm
Location: Grass Valley, CA
Windows Version: XP Pro SP3 x86 + all updates
Avant Version: 2013 Ultimate Build 23 & Build 115 (USB)
Default engine: Gecko (Firefox)
IE Version: IE8 + all patches and updates
Skin: Monai XP
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #4 by mbrazil » Tue Jul 03, 2012 12:20 am

I posted too soon -- the next time I started Avant, Norton flagged mozalloc.dll. Those jerks at Symantec just don't get it.
mbrazil
User avatar
Offline
AvantGuard
AvantGuard
Avantic Elite
 
Posts: 1965
Joined: Tue Jul 26, 2005 10:04 pm
Location: Grass Valley, CA
Windows Version: XP Pro SP3 x86 + all updates
Avant Version: 2013 Ultimate Build 23 & Build 115 (USB)
Default engine: Gecko (Firefox)
IE Version: IE8 + all patches and updates
Skin: Monai XP
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #5 by Tinman57 » Tue Jul 03, 2012 1:15 am

mbrazil wrote:Norton quarantined freebl3.dll again during installation of build 175. I guess this is progress of a sort, since it's the only file it objected to this time. Somebody needs to whack those Symantec people on the head with a 2x4 a few times to wake them up.

Hmmm, methinks hitting them on the noggin with a 2X4 will only put them in a deeper sleep than they already are. But it would still be fun anyhow :wink:
((((TINMAN))))
----------------------------------------------------------
(Duck! It's another MicroSoft Patch!)
Tinman57
User avatar
Offline
Avantic
Avantic
 
Posts: 834
Joined: Tue Oct 13, 2009 2:26 am
Location: TEXAS
Windows Version: Linux Ubuntu 13.10
Avant Version: Linux Firefox
Default engine: Linux Firefox
IE Version: N/A
Skin: N/A
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #6 by xiaobing » Tue Jul 03, 2012 4:00 am

Maybe they actually didn't deal with the problem?
I submitted this problem to them many times, and each time they answered the following as the end
We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software. In light of further investigation and analysis Symantec is happy to remove this detection from within its products.
xiaobing
User avatar
Offline
Support Staff
Support Staff
Avant Guru
 
Posts: 3703
Joined: Wed Apr 22, 2009 1:52 am
Windows Version: xp/win7 64/win8
Avant Version: latest version
Default engine: firefox/chrome/IE
IE Version: 8/9/10
Skin: aero glass/opal glas
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #7 by mbrazil » Tue Jul 03, 2012 5:39 am

The problem is that they consider each new version of the files in question to initially be "unknown" so every time there's an update, their system sees it as a new file again even though it has the same name. The only way to fix this "permanently" is for them to somehow make their system aware that these files will be replaced with newer versions periodically. It's not a problem for the full version of Firefox, because so many users update Firefox right after a new version is released that the Norton system quickly decides that the file is OK because so many people use it without problems.
mbrazil
User avatar
Offline
AvantGuard
AvantGuard
Avantic Elite
 
Posts: 1965
Joined: Tue Jul 26, 2005 10:04 pm
Location: Grass Valley, CA
Windows Version: XP Pro SP3 x86 + all updates
Avant Version: 2013 Ultimate Build 23 & Build 115 (USB)
Default engine: Gecko (Firefox)
IE Version: IE8 + all patches and updates
Skin: Monai XP
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #8 by AXEMAN » Tue Jul 03, 2012 7:14 am

Hey mbrazil remember what i said about norton and avant i had to dump it to for peace of mind :)
AXEMAN
User avatar
Offline
Avantic Elite
Avantic Elite
 
Posts: 1606
Joined: Thu Jan 24, 2008 12:55 am
Windows Version: WIN 7 64 BIT
Avant Version: THE LATEST
IE Version: 9
Top

Re: Norton still falsely detects some Firefox files as risks

Post Reply #9 by mbrazil » Tue Jul 03, 2012 8:27 pm

AXEMAN wrote:Hey mbrazil remember what i said about norton and avant i had to dump it to for peace of mind :)

The point is that many people use Norton, and most of them won't understand what's happening when they try to install Avant and Norton quarantines some of the files Avant installs. Most users aren't knowledgeable enough to figure out what happened, and they won't know how to resolve it. They'll assume that Norton actually detected a virus or that Avant is broken and cannot be installed properly.

The intent of this thread is to work out some way to permanently resolve the problem so that Symantec's problem does not negatively affect Avant's reputation.

It's not a problem for me at all. I simply have Norton remove the files from quarantine, which takes only a few seconds, and then everything is fine.

Incidentally, I don't get a lot of false positives from Norton anymore. I always get a couple when I install an upgrade to Avant Ultimate, and I get one or two others occasionally when installing other apps. Norton is a lot better than it used to be, but it's still somewhat of a PITA. I'm going to replace it soon with Webroot SecureAnywhere Complete 2012, which shares a top rating with a couple of others for 2012.
mbrazil
User avatar
Offline
AvantGuard
AvantGuard
Avantic Elite
 
Posts: 1965
Joined: Tue Jul 26, 2005 10:04 pm
Location: Grass Valley, CA
Windows Version: XP Pro SP3 x86 + all updates
Avant Version: 2013 Ultimate Build 23 & Build 115 (USB)
Default engine: Gecko (Firefox)
IE Version: IE8 + all patches and updates
Skin: Monai XP
Top


Return to Avant Browser Discussion



Who is online

Users browsing this forum: No registered users

ABPro style designed by Statm1