getting a norton attack/threat message...

[2airishuman]

hi andyr, mods and others

i'm getting a norton security suite 'threat attack' signal...with a blocking of the site......

norton says this is "icc profile tagdata overflow" threat....something about the windows/color management module, and a high level threat coming from the airforums.com site.

this is apparently a known windows flaw with a security patch update....which is loaded on my machine...but norton is still picking up activity.....in no way am i suggesting a bug in the forums....but norton says there is 'no known false positive' for this issue....

does anyone have any info on this...

http://www.symantec.com/avcenter/att...gs/s21196.html

thanks
2air'

[Janet H]

News to me.. But I'll contact ANdy about it ASAP.

[Macozil]

As an owner of an IT company, let me inform you that Norton Internet Security Suite is a pain in the butt. I like other Norton Products but that one holds a special place in my heart. Lemme guess, it came with your Dell?

It was likely caused by an attempted auto update for a web accelerator used by the hosting company. Google uses one that kicks off this error also. This by the way IS a known false possitive.

[2airishuman]

thanks janet.......i'll look for any explaination....

hi macozil.......

i expected more of this sort of answer....along with the 'get a mac'....folks must be tired.

no dell....
not bundled......
and not sure either is an issue.....since this is an explorer issue......

so which other peter norton products do ya like....

the anti virus?, the firewall?, the anti spam?......

which are are all sold separately.....

clearly ghost doesn't apply......

never happened with any other app or site......and not with google?

and only in the last 3 days......

the link suggests.......'no known false positives'

but i don't dispute that it may be an accelerator....or aggitator....or vibrator

so what's your next best guess?

cheers
2air'

[overlander63]

Originally Posted by 2airishuman

but i don't dispute that it may be an accelerator....or aggitator....or vibrator

so what's your next best guess?

cheers
2air'

I use Macafee, with the antispam, and antifreeze (oops, wrong product), along with their privacy protection and antispam programs. No problems like you are describing. Maybe you could look into Macafee next time you are in the market for antivirus stuff.

[Jim Jarzabek]

Originally Posted by Macozil

As an owner of an IT company, let me inform you that Norton Internet Security Suite is a pain in the butt. I like other Norton Products but that one holds a special place in my heart. Lemme guess, it came with your Dell?

It was likely caused by an attempted auto update for a web accelerator used by the hosting company. Google uses one that kicks off this error also. This by the way IS a known false possitive.

Macozil, I gave you some karma.....
Thanks for posting & keep it up
Some of the most famous literary figures would have opted for the less popular choices..... MACbeth comes to mind as one
As an owner of a new eMac, I appreciate your attempt to assist!

[85MH325]

I am certainly no expert in virus/malware, but I've had some nasty first-hand experiences in the past year. I spent nine full days killing a malware program I managed to contract that there weren't any tools out for. I was using Norton Internet Security Suite 2003 for a couple of years, and it was fine, but it had no malware module. I have since dumped a later version of Norton off of a couple of friends' machines which were so bogged down you thought you were working on a 286 XT! They immediately sped up. I bought this new Gateway a couple of months ago, and it came with McAfee. Since I hadn't used it, I thought I'd try it. It was gone in a week for the same reason. I did research and found the Aluria Security Center. I read good things about it, and it had some really good reviews so I bought it. The interface is excellent. It runs quietly in the background. I couldn't get it's definitions to update, even with tech support (which was awful, I might add). I got a refund. They are ALL such resource hogs! I don't write code anymore, so I can only guess what they do... but I suspect they check every byte coming in for patterns...

I'm down to AVG anti-virus (which is excellent, BTW), and the old Giant, (now Microsoft malware beta), and the Windows firewall (but I'm behind a hardware firewall as well.) The machine stays fast, and the software seems to be doing its job. In addition, I occasionally run AdAware and the free malware tool from Trendmicro.com.

It's sorta like falling off a tall building... it's OK so far...

Roger

[Macozil]

The Antivirus world is full of problems with resource hogs, honestly they all are. One of the best on most machines is actually E-trust. Although I have seen it cause a slowdown on some computers. There does not seem to be a rhyme or reason to which AV causes which system to slow down. But the Norton product above tends to eventually cause either a massive slowdown of the Internet, or sometimes wont let you surf at all until you either disable the firewall or uninstall the product. But then again the ultimate protection is abstinence right? (that’s what the Nuns said)

[2airishuman]

Originally Posted by Macozil

But then again the ultimate protection is abstinence right? (that’s what the Nuns said)

and that is why i seldom click on links....that are imbedded in messages or posts......

i had violated my own rule however by visiting the save wally site....just minutes before....this detection....real or not.....but it was id'd coming from the forums......

this thread wasn't meant to start a 'what protection package' to use exchange....

but i do appreciate the mcafee and aluria experience....

and jim j'....
i don't see any real help in post 3 except to suggest it is accelerator related.....
is the forum software using some accelerator software that could kick out this issue....just starting in the last 3 days?

i've not had any negative issues with norton a/v....just this one issue now...and just the last 3 days.

like others i do use a variety of spy sweepers/adware/malware products....that isn't the issue here....i don't think...

http://www.microsoft.com/technet/sec.../ms05-036.mspx

looks like it has also been an issue on the fashion forum......

http://www.thefashionspot.com/forums...t-11769-2.html

post 37 with the cute forum face.....

and not just a norton product issue....from the online reading bowl....

http://www.kb.cert.org/vuls/id/720742

whatever u.s. cert is......

so andyr/janet any ideas?

i'm not suggesting it isn't a false......but it would be my first......in 3-4 years.....and feel it warrants checking further......

cheers
2air'

[Jim Jarzabek]

Your comments....

"hi macozil.......

i expected more of this sort of answer....along with the 'get a mac'....folks must be tired."

Nothing directly in Macozils' post directly attacked your choice of computer...
Whatever you implied in the comments posted were your impression....

Macozoil has not posted much & I would like to see him continue, for one...

Every Forum member has something to contribute

[2airishuman]

Originally Posted by Jim Jarzabek

Whatever you implied in the comments posted were your impression....

well jim that pretty much sums ups every post....
from every one.....
mostly

my intent was to keep the "get a mac" help to a minimum.....and it's working....pretty well......

well, almost.

i would encourage everyone new/old or other wise......
to keep posting.....
useful or not.....

you are helping me keep this on todays page......so thanks for that....

while awaiting anything that cast light on my question...

cheers
2air'

[guy99]

I would suggest running "hijackthis" and taking a look at the log file it generates.

If you see anything fishy, there are a number of help sites which can assist in the interpretation (and correction if needed)

[Stefrobrts]

This thread is interesting to me. For the last few weeks I have been 'going commando' without any anti-virus protection because MacAfee was slowing my computer to a crawl and causing so many memory faults I had to remove it. I practice safe computing, and I do have firewalls, so I'm not too worried, but I would like to get good anti-virus protection again. I'm going to check out the stuff you guys recommended.

2Air, I think you did get an answer to your question - that norton detected a false positive on this issue. It would be unlikely that the forum servers would be infected with anything without someone else getting a warning as well, and I'm sure the servers themselves have protection. Think of it as double checking. It would be interesting to see if other Norton users popped up with the same issue.

[SafeHarbor]

Hi, 2Air,

I'm running Norton, too, and when it gives me one of these notices, I wonder why it bothers. I think Norton is ANNOYING. It does part of its job and then has to TELL ME about like a little child, "Look daddy, see what I did!"

If I didn't know better, I'd think they want their product to be annoying so we'll think it's doing its job.

I also dislike the way Norton knows better what I need than what I think I want. I need to send out big (15 to 80 MB) attachments in my work, so I try to turn off email scanning both in and out. According to the control center, it is. Norton bleats everytime I start the computer about two items I need to FIX. I ignore it, and it proceeds to scan my outgoing mail anyway. A big attachment that takes me three minutes to send may take STUPID Norton A/V ten minutes to scan.

I've used Norton A/V for years, but this renewal period I'm going to look around for something less childlike, idiotic, and bothersome.

As for your notice, unless it said that something on your PC was damaged, just ignore it. Well, my two cents.

Lamar

[guy99]

Stephanie,
You might want to look at this:
http://reviews.cnet.com/ZoneAlarm_In...4.html?tag=toc

[Stefrobrts]

Originally Posted by SafeHarbor

I've used Norton A/V for years, but this renewal period I'm going to look around for something less childlike, idiotic, and bothersome.

Well, I'll warn you right now, McAfee does the exact same things. One of the final straws for me was mcafee constantly warning me about finding viruses in my temp file directory, because I get emails with viruses - doesn't everybody? I know not to open them, so they sit in the temp directory until it gets cleaned out. So every day, every email I received with a virus, it would warn me again and pressure me to do a scan. Now that seems like something they should understand happens, and NOT annoy me by warning me 50 times a day. And as for turning off that warning - good luck.

So much for eTrust, I went there and the webpage crashed because I don't use IE. I'll keep looking.

[azflycaster]

We run Symantec AntiVirus Corperate Edition at work and one of my jobs is to keep our 500+ workstations free of viruses. I recently upgraded everyone to version 10 which does spyware and adware protection as well as antivirus. I like the product and it is very easy to manage. The virus definitions are updated daily and every machine does a full scan every night. The new feature for spyware works great. In the two weeks it has been running it has blocked or removed over 15k items from the workstations.

2air,
I have not seen the error you are seeing and I connect to the forum with various versions of Symantec (8, 9 & 10) Corporate Edition. The message you see points to a Microsoft security patch (MS05-036). Have you applied the patch that matches your operating system? That would be my first step. You can also go to the symantec website and see if they have any patches for the version of AV you are running.

[squrlgurl]

I have been using NOD32 by Eset software with fantastic results. It's simply the best AV out there and is not a resource hog or bloatware like McAfee and Norton. I install it on all my clients' systems and it runs so unobtrusively that I trust it on the PC's of even novice users. It is also very robust and full-featured so I use it on my small network setups too. Leo Laporte loves it and so do I.
www.eset.com


-Tracey
PC Geek with a taste for Airstreams

[2airishuman]

hi stef', azfly', safeharbor, guy99 and others


thanks for the dialog.....

now this is useful....

part of the reason i didn't just pm a mod or andyr on this....
was to check with others using a/v, firewalls or symantec....

guy99....
'hijackthis' looks interesting....i'll read a bit on the product...the reviews on cnet suggest lots of false positive...but it looks very popular.

stef'.....
no dissrespect, but i'd like an answer from someone working with the server.....the symantec web site says 'there is no known false positive' for this issue....i wouldn't expect the forum server to be bugged either or have any issues.....but no server is fool proof.....i was the 2nd person to sign up for the 'enhanched accounts' and send money.....the reward was having my ip address added to the "blocked list".....andy was sure this couldn't happen, but after a week of gyrations on both ends.....turned out, that is exactly what happened....as a result of an "issue" on the server. it is helpful to read (so far) no one else has had this issue....but no one else had the enhanced account issue......because my canary died first.....

safeharbor......
i've not had any issues using symantec since, well, trying to use their shell for win3.1....maybe i don't do much adventuresome surfing...and do have a physical firewall as well as s/w...i do see the 'pop up window' telling me when issues are detected....but i've never noticed any performance issues....as az' has offered...daily definition updates and the new spyware easy setting to tweak....i like norton....maybe you have settings that need to be reviewed/revised? their email scan is quick and easy...from my usage anyway....i've used symatec....like az reports...and from my university server days...that is what the techs used....on 5000 users...or so...

azflycaster.....
it's reasuring to note you've not seen this message....yes i've got the ms patch...since i do automatic updates....and this issue became known last fall....so while the patch is in place....symatec still detects the threat and takes action...right?

just to be clear...this 'detection' happened while on the forum....but after i clicked on links in posts to other sites.....specifically the save wally dot org link...and the decals/pdf document there....so while norton reported it coming from the forums....it was while connected to another site through the forums...is that any clearer? what norton does in in that situation....is lock out the site/ip address for a defined time...in this case 30 minutes....

az'.....have you visited the save wally site and opened anything ?

as i understand this color buffer issue....it has to do with potential bugs imbedded in images/photos and the like...

stef......
bareback?......i don't know......so much to catch these days....and speaking of trojans........ the t/horses are becoming a huge issue....not as many as viruses and popups...but way harder to clean up...

again.....

thank you kindly for this last wave of posts....i'm not having any problems today....but i am not going back to the site in question either....

cheers
2air'

[ArtStream]

Hi,
I confused, I can understand being threatened by Ralph and even Alice or Trixy, but Norton always seemed kind of harmless.



And as to taking Norton's advice, I don't think so.


Maybe it's just me.


Michael