Norton still falsely detects some Firefox files as risks

[mbrazil]

I just installed Avant Ultimate build 171 on top of build 169, and Norton Internet Security flagged mozalloc.dll and freebl3.dll as risks and quarantined them, as it usually does. It also flagged and quarantined mozglue.dll this time.

This is still mostly a Symantec problem, since they detect files with the same name but a new creation timestamp as unknown files and consider them a risk because they're not in their known-good database with that timestamp. They also don't don't provide any way to "permanently" exclude files based solely on their filenames. However, this is also a problem for Avant, since anyone who runs Norton Internet Security (and probably Norton 360) and is not aware of this situation will probably think there's something wrong with Avant when they get quarantine notices from Norton about these files and error messages regarding the missing files the first time they try to run Avant Ultimate after a new installation or an update. (This might also occur with other security software, but I'm not personally aware of it happening with any security software other than Norton Internet Security 2012.) This is particularly disconcerting on an update if you choose to reopen tabs that were open using the Firefox engine when you closed your previous Avant session. In this situation, you'll get multiple errors for each tab that Avant tries to reopen with the Firefox engine, so there will be lots of error messages.

I haven't been able to come up with a workaround for this other than to uncheck the option to run Avant in the last window displayed by the installer and restore and to exclude these files in Norton prior to starting Avant. I think it would be a good idea to change the default for the Run Avant Browser option in the installer to unchecked (or remove it entirely) and to display a notice something like this:

"Some security software may falsely detect some of the newly installed Avant Browser Ultimate Version files as risks. If this happens, it can cause errors when you try to start Avant, because some of the necessary files have been quarantined and are unavailable. To avoid this, do not check the Run Avant Browser option in the installer, set your security software to restore the Avant files from quarantine (and exclude them from scans), and then start Avant."

It might be a good idea to include the filenames in the notice, but since these might change from build to build, the notice would have to be updated whenever the files do change, so I didn't include them.

[xiaobing]

Thanks for you information and suggeation,mike, we will consider it.

[Tinman57]

A lot of folks have problems with Norton false positives, it's not just AB. That's one of the reasons I dumped Norton years ago. I installed Avast! free and it plays quite well with AB. First time you run it you can tell Avast! to treat it as a web browser when the warning box pops up, or you can add programs manually before starting. On a clean system you can also put it in the training mode and let it add all your programs to the safe list. It's highly configurable, and don't hog memory/resources.....

Of course anti-virus programs are kind of like opinions, everyone has one and they vary.

[mbrazil]

Norton quarantined freebl3.dll again during installation of build 175. I guess this is progress of a sort, since it's the only file it objected to this time. Somebody needs to whack those Symantec people on the head with a 2x4 a few times to wake them up.

[mbrazil]

I posted too soon -- the next time I started Avant, Norton flagged mozalloc.dll. Those jerks at Symantec just don't get it.

[Tinman57]

Norton quarantined freebl3.dll again during installation of build 175. I guess this is progress of a sort, since it's the only file it objected to this time. Somebody needs to whack those Symantec people on the head with a 2x4 a few times to wake them up.

Hmmm, methinks hitting them on the noggin with a 2X4 will only put them in a deeper sleep than they already are. But it would still be fun anyhow

[xiaobing]

Maybe they actually didn't deal with the problem?
I submitted this problem to them many times, and each time they answered the following as the end

We are writing in relation to your submission through Symantec's on-line Security Risk / False Positive Dispute Submission form for your software being detected by Symantec Software. In light of further investigation and analysis Symantec is happy to remove this detection from within its products.

[mbrazil]

The problem is that they consider each new version of the files in question to initially be "unknown" so every time there's an update, their system sees it as a new file again even though it has the same name. The only way to fix this "permanently" is for them to somehow make their system aware that these files will be replaced with newer versions periodically. It's not a problem for the full version of Firefox, because so many users update Firefox right after a new version is released that the Norton system quickly decides that the file is OK because so many people use it without problems.

[AXEMAN]

Hey mbrazil remember what i said about norton and avant i had to dump it to for peace of mind

[mbrazil]

Hey mbrazil remember what i said about norton and avant i had to dump it to for peace of mind

The point is that many people use Norton, and most of them won't understand what's happening when they try to install Avant and Norton quarantines some of the files Avant installs. Most users aren't knowledgeable enough to figure out what happened, and they won't know how to resolve it. They'll assume that Norton actually detected a virus or that Avant is broken and cannot be installed properly.

The intent of this thread is to work out some way to permanently resolve the problem so that Symantec's problem does not negatively affect Avant's reputation.

It's not a problem for me at all. I simply have Norton remove the files from quarantine, which takes only a few seconds, and then everything is fine.

Incidentally, I don't get a lot of false positives from Norton anymore. I always get a couple when I install an upgrade to Avant Ultimate, and I get one or two others occasionally when installing other apps. Norton is a lot better than it used to be, but it's still somewhat of a PITA. I'm going to replace it soon with Webroot SecureAnywhere Complete 2012, which shares a top rating with a couple of others for 2012.