Strange problem

[stonemason]

Just recently every slideshow I download from an external source ie beechbrook, media fire etc. causes my firewall to pop up a warning part way through the show to say that slideshow.exe is attempting to access the internet. Can anyone throw any light on why this should happen and more importantly how to stop it. The firewall is pctools firewall plus and windows 7 ultimate operating system.

Thanks

Geoff

[Guest Yachtsman1]

Hi Geoff

You are not alone with this problem, there have been numerous reports of this happening. I.m not sure but I think either you or PTE has to inform your firewall adminstrator, somebody will either confirm or advise correctly I'm sure.

Regards Eric

Yachtsman1

[fh1805]

Geoff,

If you are getting this pop-up when you run the downloaded sequence, it suggests to me that one of several things is happening or has happened:

1. Your Anti-Vir/Firewall software is detecting "false positives"

2. Your PC has an infection of some sort on it

3. Bill's website has an infection of some sort on it

I propose the following line of investigation:

1. If you send me a PM or e-mail with the name of one of the sequences that exhibits this behaviour, I'll download it myself and take a look at it on my system. (Make it one of the smaller sequences, please!).

2. Upload your copy of the same sequence to a sharing site (e.g. MediaFire) where I can download it.

If 1. results in me seeing the problem, it's Bill's site that is shipping out damaged/infected sequences and he needs alerting ASAP.

If 1. is clean but 2. shows the problem, it's your machine that becomes suspect

If neither 1 nor 2 show the problem, it strongly suggests "false positive" and you can relax a little.

regards,

Peter

[stonemason]

Hi Peter thanks for the offer but I think we are at cross purposes, as far as I know there is no such thing as a "false positive" with a firewall either a programme is trying to connect to the internet or it's not. I would have thought that if there was a problem on my PC my own slideshow .exe files would demonstrate the same behaviour, which they don't. It would seem from Eric's reply that I am not alone in experiancing this, but I will carry out a full virus scan on my PC just to be on the safe side.

Regards

Geoff

[JRR]

Geoff:

I do get the same thing happening on my own PTE shows. It also happens sometimes with other programs.

It has been happening on a random basis ever since I got my present computer.

My techie has looked at it and said don't worry about it.

[fh1805]

Jim,

Are you running Win7 on that PC? Is the operating system the common denominator?

regards,

Peter

[JRR]

Jim,

Are you running Win7 on that PC? Is the operating system the common denominator?

regards,

Peter

Peter:

No this on my PC system. Windows XP. Sygate Firewall

Haven't had the issue on the new laptop with Win 7, or either of the other two laptops with WinXP (none of the laptops have a specific firewall installed)

[stonemason]

Hi Jim

The major problem this causes me is that it stops the slideshow in it's tracks, until I tell the firewall to block connection. It only happens once with each slideshow as on subsequent showings the firewall automatically blocks it and does not intervene. Is this the same for you?

Regards

Geoff

[nobeefstu]

Geoff,

Just recently every slideshow I download from an external source ie beechbrook, media fire etc. causes my firewall to pop up a warning part way through the show to say that slideshow.exe is attempting to access the internet. Can anyone throw any light on why this should happen and more importantly how to stop it. The firewall is pctools firewall plus and windows 7 ultimate operating system.

Thanks

Geoff

Since you say that your issue has happened just recently ... my best guess is that some Windows7/IE8 or PC Tools recent update is promoting the issue.

All slideshows on Beechbrook are zipped and not downloaded as exe files ... so I cant see downloading Beechbrook files promoting your issue. Media Fire files and external link Beechbrook files may be exe or zipped types.

To discount your issue is not coming from your PC Tools Firewall ... disable it and just enable/use Windows own internal firewall and test downloading. This might help to reveal the issue is from a Windows7/IE8 recent update.

As for these messages,false positives, etc ... its sometimes hard to tell how they may have been originally initiated because all these programs work so interactively together.

In most cases these issues soon disappear within a few newer updates afterwards. If its a Windows update thats promoting the issue ... it could take some time longer to get fixed or otherwise it may be some new user setting that your not aware about.

[JRR]

Hi Jim

The major problem this causes me is that it stops the slideshow in it's tracks, until I tell the firewall to block connection. It only happens once with each slideshow as on subsequent showings the firewall automatically blocks it and does not intervene. Is this the same for you?

Regards

Geoff

Geoff

Not in my case, I just get a dialogue box that comes up in the middle of the screen and I have to tell it to go away. The PTE show carries on throughout the "interruption".

If I can tell it to take the same action next time before closing the dialogue box, then I don't think it comes up again. But often my patience level is such that I opt for the one click to close the dialogue box rather than the two clicks.

As I say, mine tends to be random and does happen wth other softwares at times

[JRR]

I should mention that I do a virus check with every show I download from anywhere.

I admit I have not done a spybot (or whatever it is called) search for a while on my computer, But I have done them since this issue started happening and nothing turned up.

[stonemason]

nobeefstu you may well be right as my laptop which doesn't go on the internet for automatic updates (same OS) has yet to encounter the problem I will keep an eye and come back if I find a solution. In the meantime I'll try your suggestion about the firewalls next time I run a show from an external source for the first time.

Geoff

[Ken Cox]

GEOFF

many moons ago [early win 95], an IT guy that i respected told me if i had a router i would not have to worry about a 3rd party firewall, i took his advice bought a router been happy ever since -- i also disabled the windows firewall

see

http://support.novell.com/techcenter/articles/ana19980304.html

my present IT man has checked my system settings and he is happy -- my wireless router looks after 3 systems

ken

[fh1805]

Ken,

I, too, was advised that a wireless router offered an additional layer of protection. But I was lead to believe that the router firewall was primarily a blocker of unsolicited in-bound activity; and that it would allow all out-bound activity. In otherwords, it might help stop malware getting in, but if the malware is already there doing tracking or key-logging or whatever, the router firewall will not stop the malware from "phoning home" with the results of its capture. When my router was installed I was told to keep the software firewall in order to be able to control the out-bound traffic.

I use Norton Internet Security for Anti-Virus and Firewall. When it installs it disables the Windows firewall in favour of itself. This eliminates the potential for the sort of "conflict problems" that Brian Kelly (Conflow) explained to us in one of his posts (a good while back in time, that was).

regards,

Peter

[Ken Cox]

Peter

yes i was aware of the possible outbound traffic problem but over the years of listening to people having firewall problems i made my choice and trust the NAT:)

thanks for bringing up the point tho' because quite a few people are not aware of these things.

ken

[Lin Evans]

Hi Peter,

Just an aside question. Are you, by any chance, using Norton Anti-Virus 2010 with SONAR? The reason is, I'm presently in contact with Symantec about the issue with the defective SONAR module erasing PTE executable files and finding them as "questionable." Perfectly good PTE exe files are being deleted by SONAR using the very latest iteration.

I have been in contact with the Symantec technical support, who have been less than helpful. They keep telling me that the "solution" is to put all PTE executables into a "folder" or "folders" and "exclude" these folders from the SONAR testing.

I have explained to both the first and second technical support level that this is absolutely "NOT" a solution. People who use PTE and purchase Norton Anti-Virus will summarily have their files deleted the first time they run the anti-virus. Users of PTE who send their slideshows to unknowing clients who are using NAV 2010 with SONAR will assume that the PTE files are infected.

I'm awaiting a call back which was promised yesterday. If I don't receive a call in the next few hours today, I will contact the Symantec headquarters in California and speak with their Chief Technical Officer Mark Bregman about this issue and totally bypass their inept technical support which is somewhere off-shore - probably in India.

Let me know if you are using NAV 2010. I have a very close friend who is very technically experienced who is using it and keeping me updated about the lack of progress in eliminating this issue. I send him files for testing every week since he downloads and installs their daily AV data updates.

Thanks,

Lin

Ken,

I, too, was advised that a wireless router offered an additional layer of protection. But I was lead to believe that the router firewall was primarily a blocker of unsolicited in-bound activity; and that it would allow all out-bound activity. In otherwords, it might help stop malware getting in, but if the malware is already there doing tracking or key-logging or whatever, the router firewall will not stop the malware from "phoning home" with the results of its capture. When my router was installed I was told to keep the software firewall in order to be able to control the out-bound traffic.

I use Norton Internet Security for Anti-Virus and Firewall. When it installs it disables the Windows firewall in favour of itself. This eliminates the potential for the sort of "conflict problems" that Brian Kelly (Conflow) explained to us in one of his posts (a good while back in time, that was).

regards,

Peter

[fh1805]

Lin,

No, I'm not using the 2010 version of Norton; I'm still using the 2009 version - after renewing the subscription to the database updates. Just before Christmas my Norton LiveUpdate software offered me a free upgrade to Norton Internet Security 2010 but, having seen the posts here on the forum about the problems with SONAR, I told LiveUpdate where it could stick the free upgrade!!!

My read off the Symantec site is that SONAR is part of the version of Norton that they market towards businesses and enterprises; and that it is not part of the version of Norton Internet Security that they market towards the home PC user. Am I wrong in this interpretation?

regards,

Peter

[Lin Evans]

Hi Peter,

I'm not certain about how they specifically market the product with the SONAR module. My friend is a U.S. Government employee and it's possible that his version of 2010 is one which was suggested or provided by the Government for his system. I'll have to check with him about whether it's the normal 2010 version, but I suspect it is.

I'm as we speak on hold waiting to speak with a Symantec Norton AV engineer which I will do before contacting their CTO. I'm willing to give them an opportunity to correct this before jumping the "chain of command" but I've been dealing with large companies like Symantec for many years on technical issues and past experience has shown me that usually it's the "squeaky wheel" which gets the grease, and that "top down" often works better than going through the ranks to get resolution.

The fact that Igor was able to get a quick resolution from AVG and other anti-threat software companies means that at least some of them are willing to cooperate. Symantec is very difficult to deal with because their top executives are, as is common with large companies, isolated from contact with the public. Fortunately, I have lots of experience in getting through the "corporate firewall" to the right person so I expect to have some success shortly for this issue.

It's apparent from the fact that Symantec has provided an "exclusion" feature that they have had problems with other perfectly good software being tagged as problematic. Further, the fact that there is already a "patch" for the exclusion means that it's an ongoing issue and even the "exclusion" is apparently not working properly. Of course a file and "folder" exclusion is not a satisfactory "solution" for PTE. It would be a huge imposition for PTE users to try to gather all their PTE executables into a folder and sub-folders to prevent the SONAR module from affecting them. In addition, this would be an unworkable solution for the thousands of "potential" users who might buy PTE and already be running NAV 2010 with SONAR who would have instant "issues." In addition, anyone sending their slideshows in zipped executable format to friends or clients would have to warn them that if they use NAV 2010 they would have to create "special folders" for just their PTE files and exclude these folders from NAV 1010.

In short, the "exclusion" work-around works for "application software executables," but not for software which creates "data" executable files.

Symantec must "fix" this problem or face potential litigation from those loosing data. Software simply can't delete good data in the interest of "protecting" the user from viruses, trojans or other perceived threats. The proper solution is for Symantec to fix the module. The alternative solution is for NAV 2010 to be blacklisted, for the problem to be made widely public on the internet and for litigation to be initiated against the company preferably as a "class action" lawsuit.

Best regards,

Lin

Followup:

2:23 pm MST

I had no real resolution with the technical support people who simply have no power to resolve issues where the NAV software needs revision.

I called and left a message for Mark Bregman, Chief Technical Officer of Symantec and hope to get a callback soon - if not, I'll keep calling him until I do.

Symantec has a "form" which can be filled out by the developer to challenge "false positives," but the form is designed for false positives on application executables and not for data executable output from the program. Imagine what would happen if NAV 2010 were to flag each and every PowerPoint show as a threat - think there might be a speedy "resolution? LOL...

We'll give Mark a chance to answer and try to get a resolution to this problem.....

Lin

Lin,

No, I'm not using the 2010 version of Norton; I'm still using the 2009 version - after renewing the subscription to the database updates. Just before Christmas my Norton LiveUpdate software offered me a free upgrade to Norton Internet Security 2010 but, having seen the posts here on the forum about the problems with SONAR, I told LiveUpdate where it could stick the free upgrade!!!

My read off the Symantec site is that SONAR is part of the version of Norton that they market towards businesses and enterprises; and that it is not part of the version of Norton Internet Security that they market towards the home PC user. Am I wrong in this interpretation?

regards,

Peter

[Conflow]

Just recently every slideshow I download from an external source ie beechbrook, media fire etc. causes my firewall to pop up a warning part way through the show to say that slideshow.exe is attempting to access the internet. Can anyone throw any light on why this should happen and more importantly how to stop it. The firewall is pctools firewall plus and windows 7 ultimate operating system.

Thanks

Geoff

Geoff,

This must be the 6th or 7th time I have posted concerning 'Firewalls'. Most PC Engineers would never recommend using 2 Firewalls on

the same PC. Now Xp-Sp2 has its own Firewall and it's quite good and XP-Sp3 has its own excellent Firewall. Vista has a superb Firewall

and believe me Windows-7 has the best Firewall ever....So why do you need a 3rd partly Firewall,viz:- PC Tools Firewall ???

"PC Tools Anti-Virus & Firewall" has given nothing but trouble over the past 18 months and that has been well documented here on the

Forum again and again ~ if you don't believe me just Google..."Problems with PC Tools Anti-Virus & Firewall" see for yourself.

Every time PC-Tools has an 'auto-update' it kicks for touch and misleads the PC user into thinking that XX-Program is trying to access

the Internet. This is a downright falsehood because its a 'cop-out' where PC-Tool simply does not recognise certain Exe's and rather than

loose face it pretends that the XX-Program is doing the call-out where in fact its a dodgy Firewall instigating the call-out.

Its the oldest trick in the Book !!!

By the way don't ever attempt to remove "PC Tools Firewall" with Windows7 Uninstaller ~it wont work properly~ you need a special removal

utility for that job (just shows what crap it is) it does not come with an Uninstaller such as good Programmers provide. For example Norton

and Kaspersky and others provide proper downloadable Uninstallers but PC.Tools is a real problem.

(Excuse the above adjective - see the attached)

Brian (Conflow)