|Computer Gripes||documenting the down side of computer stuff|
|HomeSearchMerchandiseAboutMichael HorowitzMy Computerworld Blog|
|Index: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z ALL|
Norton AntiVirus 2004 Gripes
Norton Anti-Virus is the leading anti-virus program
Do you have gripes about Norton AntiVirus? If so, leave a comment. See also my Symantec gripes.
Norton Gets a Bit Less Secure by Sarah Lacy in Business Week magazine. December 1, 2005. Quoting: "Hackers, bored with attacking Microsoft, are going after Symantec, whose Norton products are the first line of defense on 50 million PCs worldwide ... hackers are bypassing or disabling Symantec software in their efforts to access personal information or spread viruses and worms." Printer Friendly version
September 2005. Consumer Reports rated Norton Anti-Virus below Trend Micro's PC-cillin and below the Kaspersky product.
July 9, 2005. A new Windows XP SP2 computer came with Norton AV pre-installed. The first run of Live Update required 8 MB of bug fixes (I opted not to download any new virus definitions). The next run of Live Update required a download of another 4MB of bug fixes. After another reboot, there were 7MB of outstanding virus definitions. How do dial-up users survive?
FYI: A couple times recently, on two different computers, Live Update failed with an error LU1814 -- Live Update could not retrieve the update list. In both cases it was a firewall issue. Let me suggest shutting down the firewall as a first guess of the problem.
April 16, 2005. Windows XP SP1 with all recent bug fixes. When running LiveUpdate manually, I got an error: "LU1861: LiveUpdate has detected a problem with the task scheduling service on this computer. This may prevent LiveUpdate from running." I was able to continue and run Live Update normally.
The problem started after renewing the NAV subscription and running Windows Update.
To solve the problem, the error message suggested downloading the latest version of Live Update and provided a URL. I did that, however, during the installation, Live Update detected that the latest version was already installed.
Searching Symantec's web site for LU1861, turned up Document
2005020116274413 (Last Modified:03/21/2005)
Error: "LU1861: LiveUpdate has detected a problem with the task scheduling service on this computer..."
As described there, the Symantec NetDetect scheduled task has an exit code of 80 in the Last Result column.
Symantec has another KB item that basically says the same thing as the one
above (Document ID: 2004070811115213, Last Modified: 4/15/2005):
Automatic LiveUpdate does not run on Windows XP, and the Symantec NetDetect task displays an exit code of 80
Symantec blames Windows for the problem. Quoting: "this is caused by a known Microsoft problem. To fix this, you must contact Microsoft Technical Support. For instructions, read the Microsoft Knowledge Base article 812400,"
Microsoft says: "To work around this problem, disable the Human Interface Device Access service (the HID Input service), and then restart the computer."
April 16, 2005. FYI: If you renew a NAV 2004 subscription with one month left on it for a year, the new subscription is for 13 months, not for 12 months. No need to wait to the last minute to renew the subscription.
April 8, 2005 Norton's Knockout Punch By Ed Foster in The Gripe Log. Problems with Activation and more.
March 30, 2005. Symantec Acknowledges Two Holes in Antivirus Products by IDG News Service. Flaws could be used by hackers to crash PCs running the software. Bugs in NAV 2005 and NAV 2004. From Symantec: Denial of Service in Symantec Norton AntiVirus AutoProtect. March 28, 2005.
Read my Norton Anti-virus 2003 gripes for a description of two instances where Trend Micro detected a virus that Norton did not. July 26, 2004.
Followup: The Rebate Debate January 18, 2005. From the WinXPnews newsletter by Sunbelt Software. An excellent article recounting rebate experiences, both good and bad from readers of the newsletter. There was little consensus regarding which stores or manufacturers come through with their rebates and which ones don't. But, the most complaints were about Symantec's rebates.
When I purchased NAV 2004 Professional, there were two rebates. One went well, it was paid very quickly. The other, an upgrade rebate, did not go well and is documented on my Rebates gripe page. Despite my complying with the rebate rules regarding proof of purchase for NAV 2003, which was pre-installed on a new computer, Symantec initially refused to pay the rebate. June 2004.
December 3, 2004. A new Windows XP SP2 machine came with a three month trial version of NAV 2004. While I was doing some initial setup work on it, I had Live Update set for manual mode only. I ran Live Update a few times and was up to date on everything. The machine had a newly installed copy of ZoneAlarm and every time it booted, Live Update wanted to get out to the Internet. Beats me why. It seems that manual Live Update is somewhat automatic. :-( The program was LiveUpdate COM Module, LuComServer_2_5.exe. This is the same program that ZoneAlarm detects as going out to the Internet when you run Live Update manually.
May 17, 2004. I installed NAV 2004 Professional (from CD in a yellow shrink wrapped box) on top of NAV 2003. During the installation, there was a runtime error from the Microsoft Visual C++ Runtime Library. Program MsiExec.exe in the Windows\System32 directory suffered an abnormal program termination. The installation of NAV 2004 proceeded and it seems to be functional: Live update works, scanning the computer for viruses works.
I searched the NAV KB for the "msiexec.exe" but there was nothing about an abnormal program termination. I looked at the top Installation issues, but nothing about this. I will ask Symantec . . .
The computer was running Windows XP Home Edition with all patches applied.
May 21, 2004. Symantec replied "this issue could be caused due to a conflict with some other
program running in background and Norton AntiVirus (NAV) 2004 installation. In order to check whether NAV 2004 is working correctly, I suggest
that you run EICAR test."
About the log file that NAV creates during its installation:
May 26, 2004. I gave up waiting for Symantec and un-installed NAV 2004 and then re-installed it. No problems.
May 28, 2004. Got tired to waiting for a reply from Symantec (it has been over a week), so I emailed them again.
May 31, 2004. Symantec responded and asked for the log file. I gave up though as re-installing worked fine. However, their response generated another gripe. Symantec directed me to a Knowledge Base Article How to collect and send information and log files to Symantec Technical Support to help troubleshoot a software problem. This has nothing to do with my problem at all. It is about log files in the C:\Program Files folder only. Nothing is mentioned in this article about installation problems and nothing about logs in a temp folder. How typical.
There is an FYI at the bottom of this page on the EICAR test.
Related Symantec KB articles:
When un-installing Norton AntiVirus under Windows XP be aware that C:\Program Files\Symantec has shared files you should remove or rename. So too does C:\Program Files\Common Files\Symantec Shared.
May 17, 2004. Installing NAV 2004 caused a new program to try and set itself up as a server. I saw this on two Windows XP machines, one with the Professional edition of NAV, the other using the regular edition. Each machine was running ZoneAlarm which warned that Generic Host Process for Win32 Services wanted server rights. The program was svchost.exe version 5.1.2600.0 and it wanted to listen on port 5000 which is the Universal Plug and Play port.
In addition, installing NAV also caused one of the "Messenger" programs (XP has three programs that all go by the name "messenger") to run during the first re-boot after installing NAV. Again, this happened on both Windows XP machines. I know it is the first time that this "messenger" ran because ZoneAlarm asked about allowing the Messenger program to access the Internet. I assume that messenger got kick started thanks to the default configuration of NAV 2004 which includes running shotgun over the MSN Messenger IM software. I guess to run shotgun over it, it must first start it up. Thanks for nothing NAV.
April 22, 2004. More critical flaws found in Symantec products By Sam Varghese. TheAge.com. Security firm eEye Digital Security has discovered four critical vulnerabilities in Norton Internet Security 2004, Norton Internet Security 2004 Professional, and Norton Personal Firewall 2004. They bugs could result in the execution of remote code. There are no fixes.
More holes found in Symantec security software By INQUIRER staff. April 22, 2004. Bugs scuttle from under the patched rug.
April 26, 2004. Microsoft Patch Fixes Norton AntiVirus by Scot Finnie in his newsletter. For about two years Mr. Finnie struggled with an intermittent problem with Norton AntiVirus that has, at times, driven him to try competing products. The problem was that Automatic Live Updates would stop working. Symantec managed to fix this in Norton AntiVirus 2003 for a time, but the problem returned and persisted in Norton AntiVirus 2004.
Symantec slams the door on LiveUpdate flaw January 13, 2004, CNET News.com. Symantec, fixed a problem in LiveUpdate
- a vulnerability that could allow malicious users to gain unauthorized administrator access rights to an affected PC.
A new version (2.0) of LiveUpdate is now available for download. It is
After January 7, 2004, your computer slows down and Microsoft Word and Excel will not start Symantec Document ID: 2004010810205113
When Live Update is running in the background, the main NAV window does not indicate this. You only find out by clicking on the Live Update button and getting an error that it can't be run manually while it also running on its own in the background. August 10, 2004.
A couple people have told me about CPU spikes with NAV 2004 when "Auto
Protect" mode is enabled (which it normally would be). The problem seems to
be related to running both NAV and Spy Sweeper from Webroot. Spy Sweeper has a
memory shield that causes 100% cpu spikes that last for a couple seconds and
happen every 90 seconds or so. If you turn disable Auto Protect mode in NAV, the
cpu spikes go away. I don't use Spy Sweeper and can' t confirm this. August 6,
Update. September 23, 2004. Another reader confirmed this and said that replacing Spysweeper with Spybot fixed the problem.
Perhaps the biggest gripe is that to get bug fixes (patches) for NAV you have to run Live Update manually. In addition, there is no way to even know when there are outstanding bug fixes that you need (think Windows Update). The automatic Live Update feature only brings in new virus definitions, not patches to NAV itself. They do mention this is the manual that comes with the product, but it is buried. When you configure the Automatic Live Update feature, there is an option called "Notify me when updates are available". This only applies to virus definitions.
Friday night scans: After installing NAV 2004 on a Windows XP Pro computer and getting all the updates, I reviewed all the configuration options I could find. Nowhere did NAV say anything about a full scan of the computer on Friday night. By accident, I stumbled across the Windows task scheduler and found that indeed, it had scheduled a full scan for Friday night. I disabled it in the Windows scheduler. June 2004.
Email scanning: NAV 2004 can scan email messages for viruses, but it does not support the IMAP email protocol, AOL email, POP3 email when using SSL, Hotmail, Yahoo or any other web-based email system and Lotus Notes.
Full system scans: Despite the full system scan never having been scheduled, NAV 2004 runs it once a week. On a computer with the auto-protect option enabled, this is overkill. There is no way to tell NAV not to ever run a full system scan. Instead you have to schedule it to run once and make that date way in the future. In contrast, NAV 2003 does not run a full system scan unless it is explicitly scheduled or manually requested. May 14, 2004.
Full system scans: It is not obvious from the NAV 2004 user interface whether the "scan my computer" function scans just the C disk or also scans the D, E, F, etc. disks too. When, from the main NAV window, you click on full system scan to start one running, it says nothing about which disks it will scan. While the scan is in-flight you are shown the name of the current file being scanned and the scan always starts with the C disk. There is no indication if it is also going to scan the other disks.
Wiping: Page 104 of the NAV 2004 Professional manual describes how to wipe a file or folder in Windows 2000 or XP. It is 12 steps. That's too much. All you should have to do is right click on a file and select an option to delete it and wipe it. Also, the ability to wipe existing free space is not available in Windows 2000 or XP, only in Windows 98/Me.
Who is the Biggest Turkey? By Ed Foster, November 26, 2003. An updated Hall of Shame has Symantec listed fifth.
Symantec's DRM of Choice By Ed Foster, October 2, 2003. About product activation in Norton Antivirus 2004.
Symantec adds product activation CNET News.com August 26, 2003 Norton Antivirus 2004 will use product activation, a technique to tie a copy of an application to a particular PC. Symantec plans to add activation to the rest of its consumer software line over the next year.
On a Windows 2000 SP4 computer, the main window for NAV 2004 would not indicate the date of the virus definitions. Instead it said "Updating..." and stayed that way. Rebooting did not help. The computer was off-line and auto-updates were enabled. Going online and running Live Update manually refreshed the display. July 20, 2004.
A reader of this
web site was the victim of this problem and brought it to my attention. The
cause is unknown as of November 20, 2003.
Internet browsing slows down after installing Norton AntiVirus 2004 Document ID:2003091216122306
Situation: After installing Norton AntiVirus 2004 (NAV), when you browse the Internet, the display of Web pages slows down noticeably.
December 17, 2003. I heard this bug has been fixed and the fix should install itself when you run Live Update.
January 7, 2004: A reader of this web site said that the slow browsing patch only works for some people, not for all. I can't verify this.
Norton Antivirus: Activation is Seriously Broken By Loyd Case on ExtremeTech November 24, 2003. A once loyal customer of Norton Antivirus has switched to a competitor because their activation scheme breaks too frequently. The article describes this problem documented on the Symantec web site: Norton AntiVirus 2004 prompts to activate whenever the computer restarts A fix came out at the end of November 2003. See Symantec Acknowledges Activation Bug, Posts Fix from ExtremeTech or Symantec fixes product activation glitch from CNET News.com. The problem is:
You install Norton AntiVirus 2004 (NAV) and activate the program successfully. However, whenever you restart the computer you are prompted to activate the program again. If you enter the activation code each time, then after a number of restarts you see the message "The trial period has expired. This product has been disabled because you have not activated it."
Great Expectations By Ed Foster November 6th, 2003. Symantec has acknowledged that bugs in its product activation for Norton AntiVirus 2004 is forcing some customers to re-activate whenever they re-boot their computer. This is the same story as below.
Symantec Acknowledges NAV 2004 Product Activation Bugs By Ed Foster October 31, 2003. Symantec has acknowledged in a support document that at least some users are having problems with the DRM in Norton AntiVirus 2004. The bug forces customers to reactivate the software each time they restart the computer, eventually resulting in the message: "The trial period has expired. This product has been disabled because you have not activated it."
The document referred to above is Norton AntiVirus 2004 prompts to activate whenever the computer restarts It is Document ID:2003093015493306 and as of November 6, 2003 was Last Modified October 31, 2003.
On December 9, 2003, NAV was upgraded from version 10.0 to 10.0.1. To see the list of bugs fixed by this update read Program changes made through LiveUpdate to Norton AntiVirus 2004
May 15, 2004. Months after creating this page, I finally purchased a copy of NAV 2004 for myself and Read The Fine Manual. It's not so fine. In fact it is miserably written providing very little useful information and making simple things confusing. That perhaps the most popular product for Windows based computers comes with such a disgraceful manual, says volumes about the state of the industry.
Specific gripes on the manual for NAV 2004 Professional. The documentation is version 10.0.10.
How to remove Norton Anti-virus by Jay Lee October 18, 2005 of the Houston Chronicle
your Norton program using SymNRT SymNRT is a program that can remove
some Norton software from your computer. SymNRT runs on Windows 98, Windows Me,
Windows 2000, and Windows XP. SymNRT will remove these Norton programs:
Norton AntiVirus 2004/2005, Norton AntiVirus Professional 2004, , Norton
AntiVirus 3, 5 and 10 User Pack 2004/2005, Norton SystemWorks 2004/2004
Professional Edition, Norton SystemWorks 2005/2005 Premier edition, Norton
Password Manager 2004, Norton Internet Security 2004/2005, Norton Internet
Security 5 and 10 User Pack 2004/2005, Norton Personal Firewall 2004/2005,
Norton AntiSpam 2004/2005, Ghost 2003 and Ghost Version 9.0. Document
ID:2005033108162039. Last Modified: September 6, 2005.
ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/SymNRT.exe Added September 20, 2005.
Norton's Knockout Punch By Ed Foster April 8, 2005. About activation problems with NAV 2004 and NAV 2005.
Stupid PC Error Messages: Fatal! by Stephen Manes PC World magazine December 22, 2004. Quoting: "Norton AntiVirus, which is supposed to update itself automatically. I've repeatedly run into situations when the updater tells me that it has aborted--and, afterward, that my virus definitions are up-to-date. Which is correct? Who knows?"
Quoting Ed Foster: "The last few months has seen the biggest wave of Symantec gripes since I started the Gripe Line. And that's saying something, because customers of Norton anti virus products have long been a particularly rich source of gripe fodder. But what is it exactly that has so many readers sick of Symantec at the moment? That's not going to be an easy diagnosis to make, because the symptoms are many." December 6, 2004.
Dealing With Symantec By Ed Foster August 17th, 2004
Windows XP SP2 and Symantec FAQ for Consumers says "The Windows Security Center will be aware that you have Norton AntiVirus installed, but it will not be able to determine its working status due to Symantec's tamper-protection technology"
Windows XP SP2 and Symantec FAQ for Enterprise users
Why won't Norton AntiVirus turn on? from pcuser.com August 24, 2004
Why is NAV slow to come up? From pcuser.com July 20, 2004
The main tech support page for Norton AntiVirus is www.symantec.com/techsupp/nav/ from which you have to select a particular version of NAV.
The main technical support page for all Symantec consumer products is www.symantec.com/techsupp/consumer_cs.html. Here you have to select both the product and the version on this page.
The main tech support page for NAV 2004 is www.symantec.com/techsupp/nav/nav_2004_tasks.html
The main tech support page for NAV 2004 Professional edition is www.symantec.com/techsupp/nav/nav2004_pro_tasks.html
Obtaining free technical support is not obvious. From either of the above pages click on anything in the section "top support issues and contact". You will want the "Contact". For example, click on either "Error message issues" or "Installation issues". On the next page, click on the yellow Contact tab. In the next page click on "Free online support". As of June 2004, this took you to https://support.ece.com/forms/symantec/contactsymantec.asp where a request can be entered for free technical support.
Yet another starting point for Symantec support is www.symantec.com/techsupp/support_options.html
Symantec also provides an online knowledge base for current products and one for old products.
Live Update requires the use of an Administrator account under Windows NT/2000/XP When you install or run Live Update on a computer running Windows NT/2000/XP, you must be logged in using an Administrator account. This also applies to older versions of Norton Anti-Virus. There is more on this in my NAV 2003 gripes page (see below).
After installing NAV it adds itself to Windows Explorer. You can remove this with View -> Toolbars -> Norton AntiVirus.
You have to activate NAV 2004. In addition you might want to register it. These are apples and oranges.
There is a Professional version of NAV 2004 that can un-delete previously deleted files, securely delete files so they can not be un-deleted, can be installed on two computers and scans zip files in Windows 98 and Me.
NAV 2004 is not supported on Windows 95, Windows NT4 and server versions of Windows.
Automatic Live Update checks for an internet connection every five minutes until one is found. Then, it checks for new virus definitions every four hours. There is no way to know this from using the product (it is in the manual on page 74).
The NAV 2004 Professional manual warns that if you can't read or send email,
you should shut down its email scanning. Nice to know that under some
circumstances NAV can interfere with email. Not to fear however, even if NAV is
not scanning your email, you are protected as long as auto-protect is on.
Update: I did have a case where NAV 2003 interfered with all email on a computer. See my NAV 2003 gripes dated December 12, 2004.
You can install NAV 2004 on top of NAV 2003 or NAV 2002. If you have an older version of NAV, you are supposed to uninstall it before installing NAV 2004.
If you want help from Symantec in removing a virus, they charge $40 to $70 per incident and are available business hours Monday thru Friday
Activating your product a Symantec KB article
PC Fear Factor: Symantec Links has links to some useful Symantec KB items
How to use the EICAR test string to test Norton
AntiVirus Symantec told me about this in reply to a problem described above.
It applies to NAV 2004. The EICAR test file helps you answer these questions:
1. Is your AntiVirus program installed correctly?
2. Does it intercept and detect viruses as it is supposed to?
3. What happens when the AntiVirus program finds a virus?
4. Which messages does it display?
5. What about custom warnings, batch files, or administrators network notifications?
Norton AntiVirus 2004 reviewed by PC Magazine November 11, 2003
Read my gripes about
|Page created: November 6, 2003||Page last updated: December 21, 2005|