Symantec Endpoint Protection Deleted Slideshows

[michohio]

I installed Symantec Endpoint Protection (Firewall and Virus components)on my computer at home.

During its first background scan (not a requested scan, but the background scan), it DELETED 7 of my Pictures to EXE slideshows (.EXE files)! It also Quarantined 12 others. The only files that were quarantined and deleted were Pictures to EXE files.

These slideshows were created with P2E from versions I got in 2003 through 2009.

A 'Backdoor Trojan' was the reason given.

I recovered some, but the deleted ones seem to be gone for good. Had them on the backup drive but it did the same to them there.

My Corporate Symantec seems to know that these are good files.....it does nothing to them.

I have since put the recovered ones in Zip files and into a 'non-scanned' directory.

This is the first time I have had this happen to my regular and backup files.....ugh!

[Ronniebootwest]

This does sound rather nasty. I do hope that you have recovered your lost files from the back up that you have.

I am not familiar with the Samantec product but I do remember ditching 'Norton Anti Virus' some years ago.

I shall watch this thread for any further comments, with interest.

Ron West

[Ken Cox]

just make a new exe

and report it to NORTON

ken

[fh1805]

I, too, am not familiar with the Symantec product that is mentioned above. However, just to give the opposite side of the coin to that implied by Ronnie's post, I've used Norton software (currently Internet Security 2009) on all my home PCs since 1995 and have had no problems such as this.

The only problem I had was when Norton gave a "false positive" to one of the PTE code routines during a PTE beta programme. That was very quickly eliminated by Igor and Symantec working together. I've never had a "false positive" on any of my slideshows.

regards,

Peter

[autre]

Hallo,

I am experiencing a very similar problem with Norton Internet Security 2010 - Sonnar. This has so far deleted three of my exe slide show files; two because it suspected there was a 'risk', the third because there was a Trojan.

I tried to sort this out with Norton Symantec technical advice and they implied my computer had become infected.

However, it seems from the Norton forum site that Sonnar is causing various problens.

It is alright to suggest creating a new exe file but NIS Sonnar will delete that also. Another problem is that some of my exe files were created years ago and I have unfortunately lost the project files over the years.

I suggest that WNSoft exxplore this problem and warn their customers of the danger that they could loose exe files by using

[misterk]

Hi Chrisp,

I had the same thing today with my Max Spyware Detector, wipe out 17 slide shows. I managed to recover them all.

[iceberg]

I found the same problem when I updated from Norton 09 to 10 and it's the Sonar module which thinks any file it does not recognize from its database is suspect. The first P2E exe I tried was quarantined and though I recovered it, as soon as I tried to run it again, it was re-quarantined. The only option is to disable Sonar when you want to work with P2E.

[Guest Yachtsman1]

Sounds like a commercial for AVG

Yachtsman1

[Ken Cox]

the one time avg quarantined a bunch of my exe's they were non recoverable from the vault - oh yeah they were put back to where they came from but were useless - it was a bad dat update from avg and i over reacted and forced a scan

-- whenever somebody on forum reports a problem with their anti virus and pte exe's, I would suggest stopping your anti virus scanning program from running background scans and/or do not force a scan -- you can still institute a single scan on a file to see how your scanner reacts.

In the past Igor has these false indicators resolved within a day or 2

ken

[jfa]

Two days ago I had a similar problem on one of my PCs running Norton Internet Security.

It detected during a background scan a number of PTE AV EXE files as containing a Backdoor.Trojan and quarantined them. Some of these EXEs I have had for 4-5 years, some were mine and some were in my "Excellent AVs by Others" folder. It found them on the PC HD and also on my external B/U drive. It was clearly a false positive as I have had Nortons on this PC, (in various versions), for many years and it has never detected a problem with these files until now.

Before contacting Symantec I ran the program update, (not the definitions update), and it said there were 4 updates outstanding so I loaded them and the problem stopped. I then sent Symantec an email outlining my experience.

The bottom line is I suspect there was a faulty definition update issued and automatically loaded that caused this problem which has now been corrected by Symantec, I HOPE.

EDIT I don't know Symantec Endpoint Protection.

[michohio]

Attached is the Symantec Endpoint Protection which 'deleted' my shows.

Link which explains the difference from the Standard or Corporate Edition is in this link: http://www.symantec.com/connect/articles/symantec-antivirus-corporate-edition-vs-symantec-endpoint-protection

No...I cannot recreate some of them since some were done in 2003 and 2004 and files are not accessible to recreate them.

I have since put them in a 'Do not Scan' folder, saved them in ZIP files and now have them stored in my fireproof safe.

I am disappointed at the skeptics who just will not accept the fact that these executables have characteristics which even the best anti-virus companies cause false positives.

Maybe WNSoft could consider something like 'certification' with these companies.

That is....maybe prevention, rather than discover-and-fix might be beneficial to all. When we find this type of problem where I work...the 'quality' process initiates a proposed process change to see if a new process can prevent it from happening again. If it doesn't, then the process is modified until it is.

Suggestion: What I am proposing is that 'both sides' see if they can find a joint process which, if implemented by both 'sides', will prevent the problems from getting to the field.....especially since this (based upon reviewing the posts back to 2004 or 2005) seems to come up and has to be re-resolved repeatedly....after people lose files.

[goddi]

Chrisp...

Back in August, I had a similar problem. I had over 100 files that were quarantined and they had to be deleted. Most of them were PTE exe files. It took me weeks of work to remove the problem and get the PC back to normal (...thanks to Brian 'Conflow' of this Forum for his help). I think I had the 'Packed Win32.Krap.Gen' Trojan that infected my PC. The virus wouldn't even let me re-install the PTE program. I subsequently dumped my third-party firewall protection and its virus protection program (SystemSuite). I am now using the Windows firewall and BitDefender Antivirus, which seems to be much more of an 'active' protection. I feel your pain...

Gary

===============================

I installed Symantec Endpoint Protection (Firewall and Virus components)on my computer at home.

During its first background scan (not a requested scan, but the background scan), it DELETED 7 of my Pictures to EXE slideshows (.EXE files)! It also Quarantined 12 others. The only files that were quarantined and deleted were Pictures to EXE files.

These slideshows were created with P2E from versions I got in 2003 through 2009.

A 'Backdoor Trojan' was the reason given.

I recovered some, but the deleted ones seem to be gone for good. Had them on the backup drive but it did the same to them there.

My Corporate Symantec seems to know that these are good files.....it does nothing to them.

I have since put the recovered ones in Zip files and into a 'non-scanned' directory.

This is the first time I have had this happen to my regular and backup files.....ugh!

[Ken Cox]

Attached is the Symantec Endpoint Protection which 'deleted' my shows.

Link which explains the difference from the Standard or Corporate Edition is in this link: http://www.symantec....oint-protection

No...I cannot recreate some of them since some were done in 2003 and 2004 and files are not accessible to recreate them.

I have since put them in a 'Do not Scan' folder, saved them in ZIP files and now have them stored in my fireproof safe.

I am disappointed at the skeptics who just will not accept the fact that these executables have characteristics which even the best anti-virus companies cause false positives.

Maybe WNSoft could consider something like 'certification' with these companies.

That is....maybe prevention, rather than discover-and-fix might be beneficial to all. When we find this type of problem where I work...the 'quality' process initiates a proposed process change to see if a new process can prevent it from happening again. If it doesn't, then the process is modified until it is.

Suggestion: What I am proposing is that 'both sides' see if they can find a joint process which, if implemented by both 'sides', will prevent the problems from getting to the field.....especially since this (based upon reviewing the posts back to 2004 or 2005) seems to come up and has to be re-resolved repeatedly....after people lose files.

WNSOFT are not the only ones having problems - see

http://www.google.ca/search?source=ig&hl=en&rlz=&q=anti+virus+false+positive&meta=lr%3D&aq=0&oq=ANTI+VIRUS+FALSE

so it is ongoing

Instead of blaming anybody, one thing you might do is practice regular backups

remember the old axiom

"JESUS SAVES"

we all take false positves seriously

ken

[michohio]

I have submitted all of this info to Symantec. I also offered them some of the shows that had been deleted by Endpoint and they took those so they can do more testing.

Here is a link to the information about Symantec Endpoint that deleted my shows.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007071909500548

Will let you know how they reply.

[cjdnzl]

You guys all seem to take this unwarranted invasion of your files by aggressive anti-malware programs with some equanimity. Me, I would be spitting tacks if it happened to any irreplaceable files of mine - in fact I would threaten to sue the program makers. It is just not good enough to presume that if they think a file is infected that they simply delete it. That is way overstepping the bounds, to delete MY property because THEY think it is infected. This is why I do not run any of their anti-malware crap programs. They actualy cause more grief and anguish than getting an actual virus. A bit like the joke about a chap smacking his friend on the head and knocking him over. The friend picked himself up and said "why did you do that?", to which the first guy said "there was a mosquito on your head.", to which the friend said "well, next time, leave the mosquito, it's less of a problem than you smacking me on the head". I trhink we get smacked around the head by these anti-v programs, almost entirely for no good reason.

But then, I'm a bit of a maverick in my views.

[Barry Beckham]

Does anyone ever wonder if the the risk of a virus is hyped up far greater than it ever really is. It seems that the programs designed to help us cause more problems than the viruses they are supposed to protect us from.

I have to say that it is daft to leave loads of valuable files on your PC, back them up to external drives and DVD's

The cost and time in doing so is minimal

All the virus programs have identified early PTE shows as containing a virus at some stage. Norton, AVG, Avast and others.

[Ed Overstreet]

I agree with others that it is outrageous for an anti-virus program to delete files on your system without first asking you.

However, first check the options on your anti-virus program. Many of them let you set the software to alert you of a potential problem and to ASK you what you want done about it, rather than automatically deleting the "threat." That isn't usually the installation-default setting, but you should be able to over-ride the default. Also, some anti-virus software lets you exclude certain folders on your system from being scanned for viruses. If you store all your PTE creations in a folder (or a folder hierarchy), ideally on an external hard drive, and then list that folder/hierarchy as an exclusion, you should be OK. Just don't put other folks' AV shows in that structure, only your own that you know were created on your system while your anti-virus and firewall programs were functioning. And, of course, back up your work, off-line either to a detachable hard drive or to CDs/DVDs.

Ideally anti-virus software shouldn't be creating these problems, but the problem with any security features (not just on computers) is they sometimes create more disturbance, complications and problems than arguably they're worth. The trick is to be sensible in using security features.

If you keep your anti-virus software current and your firewall up whenever you're connected to the internet, and don't open dodgy emails or load anything on your system from someone else's portable media without first scanning it, arguably there is no need to scan your hard drive, certainly not an external drive. I only scan my C drive two or three times a year; I have my anti-virus software defintions updated automatically, I keep my firewall up at all times that my computer is connected to the internet, I'm very careful about emails and email attachments from people I don't personally know or from whom I haven't asked for emails and attachments, and I've never had a virus infection or anything else bad happen to my system. I have had Norton Anti-virus kill some of my PTE-created EXE and SCR files when running a system scan, but I keep backups, I've since excluded my AV archive folders from scanning, and I don't scan the system very often ...

[Barry Beckham]

Some time ago I used virus software that scans the computer daily, weekly etc. While the scan is in progress the computer is always affected in some way and it does become a pain in the but. Then the virus software I was using picked up slide shows made with early versions of PTE as containing a virus.

At that stage I switched to Avast, which can be obtained free like AVG. Avast only scans your PC once, when you first install the software (it does take a while) and then it protects your computer from threats coming in.

Here is a question, what is the point of virus software scanning the PC daily or weekly?

If the virus protection has already allowed a virus in under it's radar, a scan is hardly likely to find it tomorrow and even if it did, it's too late because the damage is then done.

Its just a thought that I prefer a scan when I install Avast and then I just allow it to watch what comes in from there. I just think it is safer and less hassle than regular scans.

As far as I am aware, I have never had any issues with a virus, but I have had lots of false warnings.

[Ed Overstreet]

Here is a question, what is the point of virus software scanning the PC daily or weekly?

If the virus protection has already allowed a virus in under it's radar, a scan is hardly likely to find it tomorrow and even if it did, it's too late because the damage is then done.

Its just a thought that I prefer a scan when I install Avast and then I just allow it to watch what comes in from there. I just think it is safer and less hassle than regular scans.

As far as I am aware, I have never had any issues with a virus, but I have had lots of false warnings.

I am coming around to your viewpoint on this. I used to scan my system weekly, but the scans never picked up anything, until about a year ago Norton started clobbering innocent PTE productions that clearly can't have been infected by anything, since I'd always had NAV active in memory, the productions were all created while NAV was in memory, and presumably anything that a scan would pick up (that is a legitimate threat) would have been caught earlier by my memory-resident NAV when it arrived, presumably by email or through a website (I almost never download files from others onto my system using removable media, only via email or the internet).

Norton gives a nasty "alert" warning now that it's been about four months since I last scanned the system, and I'm still looking for a way to turn off that alert.

And I've never had any virus or other malware problems affecting any PC I've owned since 1988 ... I think the anti-virus software companies have crossed a dangerous line between protecting us from legitimate threats and hyping non-existent threats to sell upgrades to their software. It's a bit of crying "wolf" too often -- if they keep doing this, they're going to annoy users so much that people may start ignoring legit threats.

I haven't upgraded my Norton since I got 2005 in October 2004, and I won't upgrade until I have to (likely whenever I get my next computer). They've lost sales from me because of this nonsense, and I hope they continue to lose sales. Virus definition updates, yes I'll renew that subscription, but more expensive software upgrades, no way