A Nasty Little Email - Norton360 - Is it Crap?

Hey AO,

I posted this on another forum this morning, but I thought I'd get AO's take on it:

[from computerforum.com]
So evidently some guy read my "slow computer rant" in a thread I posted on here months ago (this one I think), and did not like the fact that I suggested that the OP uninstall Norton 360. He didn't like it so much, he decided he ought to send me an email about it. I replied, and then he got "a little hot". I thought I'd post them on here and get the opinion of the forum on the whole deal.

Quote:

---

Originally Posted by deanj20's Gmail Inbox

from james to jeremy 9:58PM 10/23/2010

Hey, I read your advice to a guy to lose norton. Now, I know it uses a lot of resources, but there are much better ways to speed up a laptop than shitcanning the best stealth software a consumer can buy. There's a good reason why is uses so many resources on a computer. First, it runs a backup drive that it compares to the original during idle time and boot up. It has a very good firewall that you can configure down to the smallest item if you want. If you download torrent files it provides great p2p protection as well as masking data usage from many ISP's. I don't even need protection myself as I clean my computer myself with knoppix and others, but I still use norton to save myself time. It is by far the best in the business. Creating a larger pagefile, using readyboost, cutting off windows update and checking manually every other Tuesday and cutting off crap like error reporting and many others will more than make up for anything norton will use. To lose the best software on the system doesn't make sense. When is the last time you used it? Everything else is a joke. You were right about ccleaner but failed to tell the guy the most important thing and that is to check all the boxes including "wipe free space" so the MFT gets wiped. Otherwise you just did nothing important except to your browser. Man, you should pay more attention to whats going on out there. These poor bastards will uninstall norton for no reason. Norton 360 is very good at what it does! James Dodson

---

To which I replied:

Quote:

---

Originally Posted by deanj20's Gmail Inbox

from jeremy to james 1:30AM 10/24/2010

Norton360 is crap. I can't even count the number of machines I've removed viruses from that were equipped with Norton360. It's overkill. AVG free or MS Security Essentials will do just as good a job of keeping a system protected.

I don't know if you work for Norton or what, or are just a "fanboi". If you like it, fine. But do not criticize my advice - getting rid of that bloatware will speed up a system faster than anything else.

As far as "running a backup drive" - that's absurd.

A firewall? Really? Hrmmm - so does Windows - has worked fine for me. "...that you can configure down to the smallest item if you want." Seriously? All I need a firewall to do is allow certain programs to connect on certain ports and block the rest.

Great P2P protection? First of all, you shouldn't be downloading illegal stuff. Second of all, all you have to do is configure µTorrent (or whatever you use) to go through a proxy, and you are anonymously downloading or sharing.

You "clean your computer using Knoppix and others" - wtf? Knoppix is a Live CD... Anyway, I don't need to clean my computer because I don't install viruses and malware on my system... =\

Creating a larger pagefile "shreds" the HDD, and is not a substitute for actual RAM. Readyboost? Never even heard of it, but it sounds like something else that would want to run on startup. You are right about turning off Automatic Updates. However, Error Reporting and "Many Others" actually have a purpose, and disabling them will cause an array of strange behavior from certain programs... go ahead, go in there and start disabling Microsoft Services and see what I mean...

I use CCleaner to clean the registry and delete junk files - that does little for the browser - from that comment, I'm not sure you even understand what CCleaner does...

Look buddy, I don't know you - but you come across as juvenile and inexperienced. If I hurt your feelings by insulting your favorite AV, well, sorry about that. But I'm entitled to my opinion, and anything I've said in my posts (not even sure which one you are referring to) will only improve system performance and protection. As I likely said in my post, it has been my experience that Norton/Symantec software slows the system up worse than the crap it's supposed to protect against.

Also, for future reference, if you have something you want to say to me regarding a post on Computer Forum, then you should post it on the forum. Do not email me again regarding a post. It will be flagged and ignored.

Thanks!
- Jeremy Dean

---

And James retorted:

Quote:

---

Originally Posted by deanj20's Gmail Inbox

from james to jeremy 2:47AM 10/24/2010

Well first I don't download illegal ****. Many things come in torrents. As far as knoppix,m it gives you complete access to your hard drive. Complete. An amateur like you would not know. Next, your Security Essentials is being phased out. Every program you mentioned is amateur stuff. I do this for a living and bill out at $275.00 hr. Anybody that recommends stupid little programs like hijack this malwarebytes is ridiculous. And if you think a pagefile could harm a computer, what do you think a virtual drive would do to it. Windows uses a pagefile by default dumbass. If you're going to mislead these people, I am going to make you a project. Even the dopes at cnet and such know 360 is the best for the average computer user. And I collect malware as a hobby. I have a honeypot and honeypot network to keep track of whats out there, and your little programs are NOT going to keep people off botnets or protect them from sophisticated malware. Get a job you're qualified for if there is one!

---

And me again:

Quote:

---

Originally Posted by deanj20's Gmail Inbox

from jeremy to james 5:50AM 10/24/2010

lol... ok... I'll play along...

"Well first I don't download illegal ****. Many things come in torrents."
Well, in your first message, you said "...provides great p2p protection as well as masking data usage from many ISP's" - Not sure why you would want to "mask data usage" if you're using p2p for legitimate purposes?

"knoppix,m it gives you complete access to your hard drive. Complete. An amateur like you would not know."
Yes, I am aware - that's one of the main reasons I use Knoppix - usually to manage files without having to worry about Windows permissions or restrictions... I still don't think it is all that handy for removing malware - especially for making registry edits. But, whatever you think.

"Next, your Security Essentials is being phased out. Every program you mentioned is amateur stuff."
Security Essentials is not being phased out. Where did you even come up with that? And I don't know about "amateur stuff" - the programs I suggested work, and work well, for the common user with common problems (sluggish computer, malware infections, etc.)

"I do this for a living and bill out at $275.00 hr. Anybody that recommends stupid little programs like hijack this malwarebytes is ridiculous."
Wow. That's way overpriced imho. Would you mind giving me a link to your website so that I may see you portfolio? Your qualifications? Mine is http://www.jeremydean.co.nr - nothing fancy, just my little hobby site, but it's how I make my extra money...

Malwarebyte's Antimalware is a tried and true, excellent little program for getting rid of the little nasties people commonly infect their computer with. HijackThis! is an excellent tool to see what people have installed in various parts of their system and remove BHOs, etc.. very handy, and free! Sure, there are scenarios in which neither tool would be of any use, but, again, solve many of the common problems common users will come across.

"And if you think a pagefile could harm a computer, what do you think a virtual drive would do to it. Windows uses a pagefile by default dumbass."
I realize Windows uses a pagefile by default. But by increasing the size of the pagefile, you increase the frequency of read-write access to the drive. Over time, it will wear the HDD out. And, again, virtual memory is not a good substitute for actual RAM.

"If you're going to mislead these people, I am going to make you a project."
Not sure what that even means? You're threatening me? I'm terrified, I assure you.

"Even the dopes at cnet and such know 360 is the best for the average computer user."
Well, I respectfully disagree. I think it's crap, and that has been my experience with it.

"And I collect malware as a hobby. I have a honeypot and honeypot network to keep track of whats out there, and your little programs are NOT going to keep people off botnets or protect them from sophisticated malware."
I don't doubt that there are many, many variants of malware that "my little programs" would be helpless against - and I know from experience that there are some out there that Norton 360 is useless against, too. The idea is not to get infected in the first place. After I get done working on someones computer, I give them a brief lesson in safe web-browsing practices, and teach them how to and stress the importance of keeping their software up-to-date. If users will not change their browsing habits, then they will inevitably become infected again - whether they are running a low-key, simple AV or a monstrous, resource-hungry and error-prone AV.

"Get a job you're qualified for if there is one!"
That's what I'm working on. You can see my resume on my website. In the meantime, I repair computers on the side, just as I have done for the last fifteen years.

I'm posting our thread of emails to Computer Forum, so that we may get the opinion of the community and maybe actually help someone out, rather than just having a private weiner-measuring contest. View it here: http://www.computerforum.com/184953-...ml#post1545396

If you have anything else you wish to add, please do so on the forum. Or, if you like, email me again, and I'll put it on the forum.

Have a wonderful day!
-Jeremy

---

So what do you guys think? Am I out of line to suggest people ditch anything with the Norton stamp? Or is this guy just a hyper-sensitive fanboi? Of course, I guess making that $275/hr, he can afford the "latest and greatest" in AV software...

Thoughts?

Hmmm,

Quote:

---

Anybody that recommends stupid little programs like hijack this malwarebytes is ridiculous.

---

Somehow the phrase "ignorant moron" doesn't quite seem adequate. :rolleyes:

He obviously doesn't know what other specialist anti-malware products do?

All HJT does is tell you what is running or likely to run on your machine. It is not an AV/AM product as such. It is up to you to interpret the results. Sure, there are other ways, but they are all long-winded compared to HJT.

Norton 360 is not the best, it isn't even second best.............just look at independent tests of security packages to see this. It is competent, but certainly not stellar.

I would not install it even if it were free. For a long time I have not been a fan of Symantec's home security products. Sure they are bloated and take a lot of resource, but my main beef is that they are inordinately prone to conflict with other applications, and that is what slows the system down. Their enterprise products are quite a different kettle of fish, which has always puzzled me.

Unless you are at 100% CPU and RAM usage, it isn't Norton's resource demands that are causing the problem.

Having said that, I got a new laptop in June..........it had a Norton Trial pre-installed............it didn't for long.:lildevil:

$275/hr ???????????? Nobody, anywhere, pays that sort of money for PC support or even consultancy............that comes in at nearly $7,000 a week!!! Total bullshit............I think he got the decimal in the wrong place and meant $2.75, which would be reasonable given his apparent knowledge level and seemingly boundless arrogance?

To put it in perspective just look at the price of a new laptop............would you spend $275 an hour to get one fixed, when your only apparent "solution" is to install Norton 360? Nah! dump it on e-bay and buy a new one! :cool:

As the saying goes "If your only tool is a hammer, you tend to see every problem as being a nail" :D

At the end of the day all interactive security products will slow you down to some extent as they are scanning files in realtime. You really need to look at what they do and tune them to your personal needs.For example I never let them scan a file on closing. If they haven't detected anything on my system and didn't detect anything on opening the file then it is a total waste of time, as it won't detect the malware on closing either.

If I am not connected to the internet then I shut them down as they are serving no purpose.

Personally I wouldn't bother arguing with the guy as he is not "arguing" in the true sense of the word; he is just reshuffling his prejudices ;)

EDIT:

I missed this priceless gem:

"And if you think a pagefile could harm a computer, what do you think a virtual drive would do to it. Windows uses a pagefile by default dumbass."
I realize Windows uses a pagefile by default. But by increasing the size of the pagefile, you increase the frequency of read-write access to the drive. Over time, it will wear the HDD out. And, again, virtual memory is not a good substitute for actual RAM.

Errrrr, it is a very simple Windows tweak to get it to overwrite the pagefile on shutdown. And some of his "stupid little programs" will set a job to run at next bootup, before Windows loads. Nothing that actually runs from within Windows will do a completely reliable job.

If you are running a 32 bit OS and have 4GB of RAM, Windows is only capable of addressing around 3.1GB of it, so you setup the remaining 900MB as a physical ramdrive.................that certainly speeds things up!

Thanks nihlil.

Quote:

---

Originally Posted by nihil

I would not install it even if it were free. For a long time I have not been a fan of Symantec's home security products. Sure they are bloated and take a lot of resource, but my main beef is that they are inordinately prone to conflict with other applications, and that is what slows the system down. Their enterprise products are quite a different kettle of fish, which has always puzzled me.

Unless you are at 100% CPU and RAM usage, it isn't Norton's resource demands that are causing the problem.

---

I don't know exactly how much Norton eats up - all I know is that every machine I work on that has Norton installed runs sluggish. As a matter of fact, I'm working on a computer for a woman this very moment - A Dell w/ a 2.8GHz single-core and 1GB RAM, running XP and Norton 2011. In System Information, it showed 1,024MB Physical RAM installed, 248MB Available - WTF? I uninstalled Norton and disabled everything under startup in msconfig, and all non-MS services. On reboot, I have 778MB available (Still needs some work, but much better). Admittedly, there were other processes starting up (like iTunes, Adobe - some of my other resource-hogs I love to hate), but the difference is clear.

Anyway, after I clean the registry up and defrag the thing, uninstall all of the unneeded programs, I'm slapping AVG Free on it. Runs great after the optimization scan in my experience.

Quote:

---

Originally Posted by nihil

$275/hr ???????????? Nobody, anywhere, pays that sort of money for PC support or even consultancy............that comes in at nearly $7,000 a week!!! Total bullshit............I think he got the decimal in the wrong place and meant $2.75, which would be reasonable given his apparent knowledge level and seemingly boundless arrogance?

---

I know... that's when the jig was up... I was reading through the email thinking "well, maybe this guy knows something I don't..." - then I read how much he claims he charges an hour... :rofl::fu:

Quote:

---

Originally Posted by nihil

Personally I wouldn't bother arguing with the guy as he is not "arguing" in the true sense of the word; he is just reshuffling his prejudices

---

I know... I should have just clicked "Delete" and been done with it... but what can i say, I guess some part of me likes to argue with ignorant bullheaded people... :D

I've removed Norton from every machine I've ever owned.

Quote:

---

Originally Posted by JPnyc

I've removed Norton from every machine I've ever owned.

---

I routinely pull their consumer line from any computer I work on, not only because of resource issues, but most users simply let their 3-month trial expire w/o renewing it, and thus have no protection.

Norton/Symantec's enterprise products are heads over the consumer stuff (like 360), but malware and viruses are such that sometimes little or nothing stops them, much less any AV app.

Quote:

---

I routinely pull their consumer line from any computer I work on, not only because of resource issues, but most users simply let their 3-month trial expire w/o renewing it, and thus have no protection

---

Same here for pretty much the same reasons :)

Quote:

---

Norton/Symantec's enterprise products are heads over the consumer stuff (like 360)

---

They sort of remind me of Microsoft back in the day when they had a team for 9x and another one for NT. Symantec look like they might have a similar setup?

I find it odd, as Norton have been selling into the consumer market for a very long time. Somewhere I have a 5.25" floppy with v1.0 on it. It says it will clean "all 760 known viruses" :D I guess the deterioration started when Symantec took them over, albeit that was 20 years ago?

I don't know of any other vendor that has such a difference between their consumer and enterprise versions. They mostly seem to be network and remote administration features with the basic product being identical?

Quote:

---

Originally Posted by nihil

I don't know of any other vendor that has such a difference between their consumer and enterprise versions. They mostly seem to be network and remote administration features with the basic product being identical?

---

Pretty similar for us ranging from our consutmer based products to cloud to enterprise. All similar features.

Norton is still giving us a go though, people are like chickens, they will never leave the freaking egg that they have been sitting on for 20 years. Shame really.

My personal Opinion:

All of Norton/Symantec's products SUCK THE SWEAT OFF OF DONKEY BALLS!

That's right I said it! And any product that Symantec purchases in the future will SUCK BALLS on the first dot upgrade. (Backup Exec anyone?)

I'm sure there is a more professional way to put that but I only make $37.something an hour - so what do I know?

Norton Rules. You are a moron.




Kidding of course. :D I generally tend to rely on the free AVs, and tell the customers to run MBAM every week or two. I have never seen anyone so adamantly defend a Norton product. I wasn't aware they had such a strong following. I have seen less emotion from Mac fanboys! :)

Oh and $275 an hour?!? HAHA! Sure buddy, I charge $10,000 an hour... I just don't have any customers. -- I can build a pretty decent computer for $300 - $400... Why would anyone pay $275 to have one repaired?

Well, I'm glad that folks that actually know computer security feel the same way I do about Norton as a home AV.

When I give computer advice, I try to go off of my own experience and let the customer know that. Glad to see that you all have had about the same experience as I have with the monstrosity that is Norton Antivirus.

As for the "guru" that sent my this email, I haven't heard anything else from him, and his account was banned over at Computer Forum for making a "threat" - I told them I didn't care, but "thems the rules" so meh. He wasn't helping anyone anyway. ;)

Hey dino,

Quote:

---

but I only make $37.something an hour - so what do I know?

---

A fair bit about software and (surprisingly) donkey anatomy it would seem?

:p:D:lildevil::shocked:

that guy probly works for geek squad. can you believe best buys prices?

I dont know about this guy, but I like to research all my av/am/ any program before I install it on my, let alone a clients machine. I think, at the least, that would qualify some one to service a computer.

Hey but at least I've caught wind of his game. Prescribe norton for all their av needs, have them come back in a week complaining about slowdownds and charge for a tune up. That way he can not only make money off the initial av job, but now a tune up.

Happy birthday chaosclown! ::birthday::birthday::birthday:drink:

I think that you may be onto something there,:D but he wouldn't get away with it for long. Some people would certainly notice that the slowdown coincided with him installing

Quote:

---

the best stealth software a consumer can buy.

---

(WTF? it's a security suite for heaven's sake:rolleyes:) and others will know people who are reasonably knowledgeable and will tell them that Norton is the likely culprit.

Personally I use Avira, as it has a good detection rate and seems to be the most configurable of the free versions (Avast! being the least). It also has quite a small footprint...... at the moment it appears to be using 18.5 MB of RAM on this box, which I can easily afford from a performance viewpoint.

Quote:

---

Personally I use Avira, as it has a good detection rate and seems to be the most configurable of the free versions (Avast! being the least). It also has quite a small footprint...... at the moment it appears to be using 18.5 MB of RAM on this box, which I can easily afford from a performance viewpoint.

---

Hmm... good to know. I have been using Avast! as of late. Can you give some examples of the configurations that one would benefit from? I have been pretty happy with Avast!, but I am always willing to try something new.

Well westin, what are you looking for?

Retail, cloud or traditional enterprise?

EDIT: well lets do this. I will setup a trial for Panda for you and yo guys can give your honest opinions. Its very hard not to bring it up so dont think im advertising here :) , reply here or PM me if you want a trial.

Quote:

---

Originally Posted by Cider

I will setup a trial for Panda for you and yo guys can give your honest opinions. Its very hard not to bring it up so dont think im advertising here , reply here or PM me if you want a trial.

---

Well, I don't use an AV personally, but I wouldn't mind installing it just to see how it does on resources... however, I always recommend free stuff - if it's out there and it protects just as well as something you have to pay for, I just don't see the point... but yeah - bring on the trial!

Quote:

---

Originally Posted by nihil

Happy birthday chaosclown! ::birthday::birthday::birthday:drink:

---

Thanks nihil!! :D. Not quite that age to drink yet, but im gettin there!!!

I use avast too, and so far its kept me happy and clean. I'm also willing to try new things. Lol free is about all i can afford right now:eek:

Sometimes I get $275 an hour. Show up for one hour and bill for four! ;^)

www.cloudantivirus.com if you are looking for freebies otherwise let me know if you want a 3 month retail trial or whatever.

Quote:

---

Originally Posted by brokencrow

Sometimes I get $275 an hour. Show up for one hour and bill for four! ;^)

---

That's a practice known in the Texas oilfield as "dickin' the dog"!!! ;)

[edit]evidently, in many other places too - just did a quick Google search... I thought I was the only one that ever said that... XD[/edit]

Quote:

---

Originally Posted by wiskic10_4

That's a practice known in the Texas oilfield as "dickin' the dog"!!! ;)

[edit]evidently, in many other places too - just did a quick Google search... I thought I was the only one that ever said that... XD[/edit]

---

Erm... I shudder to think of what kind of results you got with that search query. You are a brave man. [Or sick... :)]

Can't say I'm much on "dickin' the dog". That chit comes back to haunt you.

I will admit I'm a sucker for "Chicago rate" though. ;^)

Best I ever did was £3,000 for two days. I only spent 2 hours actually at work but I was on call for 48 hours................no-one phoned :D

"God bless the millennium bug, and all who profit by her!"

As we had around 1500 PCs on site we got in outside contractors to test them (our staff were too busy checking applications, network stuff etc.) I saw this Compaq 486 with a red "fail" sticker on it, so I commandeered it. "OK for playing DOS games on; PCs didn't have clocks back then" says I, innocently :lildevil:

One 2032 battery later and I had a perfectly good computer with monitor, keyboard and mouse! :D

Welp.

I'd love to meet this guy.


Heh... and his honeypot.

Quote:

---

I'd love to meet this guy.
Heh... and his honeypot.

---

I would love to meet the guy who deals for him.............it is obviously top quality stuff?

:eek::D:lildevil:

The truth of the matter is all AV products are useless these days. The better question is, which one eats the least amount of resoruces while being useless, so that you can "stop stupid". Really, that's all that it does anymore.

Norton is on top of the list for worst offender of eating resources while doing less than nothing.

Quote:

---

Originally Posted by chaosclown

that guy probly works for geek squad. can you believe best buys prices?

I dont know about this guy, but I like to research all my av/am/ any program before I install it on my, let alone a clients machine. I think, at the least, that would qualify some one to service a computer.

Hey but at least I've caught wind of his game. Prescribe norton for all their av needs, have them come back in a week complaining about slowdownds and charge for a tune up. That way he can not only make money off the initial av job, but now a tune up.

---

i got my hands on the geek squad repair manual half way down the first page i was shaking my head and laughing ,its laughable , they pay these guys minimum wage so they don't have to hire competent computer techs at 20 dollars an hour ,i cant count the times ive had to undo mistakes there techs have done ,

So what if Norton uses up system resources. Stop being a bunch pf pansies.

Here's what I did.

Added 100 module slots,
Installed 800GB of RAM,
And bolted a 250cc, 600MPH leaf blower to the motherboard to keep it cool. Done.

Handcuff yourself to the desk so you don't get launched out the living room window when it first boots and you're good to go. :eek:

i'd like to report something to your attention guys:
at work, we have 2 AV: symantec and kaspesky: (both entreprise edition)

few weeks ago, there is a worm spreading on the network, it just puts a (.BMP) everywhere. it just keeps copying.
well let me tell you what did kaspersky and symantec

symantec:ended by getting disabled and the process is even killed after windows strats
kaspersky: keeps running but doesn't say that the file is actually a worm and file keeps getting copied
i had to kill and delete most the copies by hand on many machines (maybe if it comes again i'll make a .bat or an AutoIt script to delete it)

my point here is that symantec got disabled while kaspesky kept working.

PS:the fact that symantec eats up ressources is well known but the computer of the company are not recent so i can't tell about slowing performance or not. but from my personal exprience: symantec is really heavy on loading and working.
regards ^^

Hi neozoon,

Sorry to have to say this but:

Quote:

---

symantec:ended by getting disabled and the process is even killed after windows strats
kaspersky: keeps running but doesn't say that the file is actually a worm and file keeps getting copied
i had to kill and delete most the copies by hand on many machines

---

I am afraid that all that tells me is that NEITHER product did their job, which is to protect you? You ended up doing it manually?

To be perfectly honest, I doubt if any of the other products on the market would have fared much better. Research indicates that the best of them will only detect about 40% of new or well obfuscated malware :(

As for Norton/Symantec, I have their free security assessment tool running alongside McAfee's equivalent. McAfee detects no problems.........but Norton says that a 10+ year old space shooter game is a security risk and that I should buy Norton 360 or somesuch. It is a single user desktop game, and will only run if I deliberately launch it.............Norton does not recognise it, so it must be bad? That is tantamount to scareware to me!!!:mad:

Incidentally, were you warned that Norton had ceased to function? Didn't Windows squeal that your AV wasn't working? In a way that might not be too bad if you were warned........at least that tells you something is going on.

Quote:

---

Originally Posted by nihil

Hi neozoon,
I am afraid that all that tells me is that NEITHER product did their job, which is to protect you? You ended up doing it manually?

---

yes, neither detects it as a virus, luckily i found it quickly and could stop it from reaching servers, it was a real pain to find which pcs caught but cleaning was easy:
kill+find+delete

the source was a usb disk, an employee keeps working late at his home he brings his files in the usb disk which was infected (so was his home pc of course ^^) but i reported the file to kaspesky

about the system indicating a problem, the symantec process was there but with few megabytes, i guess it patched it or something to stop it from running

back to the usb disk, i was going to make a thread and ask if someone had the same issue as me, cause GPO active directory has ways to block usb disk which i tried but unseccessfully. the reading writing authorisations are not spread on the network. but i'll read through out the forum before making the thread ^^
ps:it's nice to be back to the forums, i was member as student now that i finished, i have time to read and get informed and share knowledge of course ^^

Hi neozoon,

I don't know anything about the size or distribution of your organisation but have you considered what we call a "sheep dip". These are usually older computers that are re-deployed purely as security tools. [The name comes from the troughs of chemicals that farmers use to rid their animals of parasites :D]

I would load one (or more if you need) with Avira AV, Online Armor by Tall Emu, AdAware (interactive scanning set to "on"), WinPatrol from BillP Studios, and Malwarebytes (and anything else you like) The user account should be least empowerment.

With any luck those will spot any attempts to mess with the system.

The sheep dips are stand alone, and all media brought from outside the organisation has to be scanned. I would just let Avira scan with the deepest level of scanning and scan compressed files. That process should kick off any malware that one of the products will hopefully detect.

Disabling Norton without alerting Windows is an interesting touch........this looks rather like a trial run for something more sinister, so you can expect other AV products to be included at a later date. I wonder if it turns off the AV to hide what activity is planned for the future?

You really should have autorun disabled on your machines, as this is a common way to launch this sort of malware.

The alternative is not to allow any external media or devices, which may well be counterproductive?

Given that you don't need that many "sheep dips" the licencing should be reasonable as well.

:)

only symantec had the issue, kaspersky works fine!
as for "sheep dip", i have some here, but didn't know the name :p thanks for the tip ^^

Quote:

---

Originally Posted by neozoon

back to the usb disk, i was going to make a thread and ask if someone had the same issue as me, cause GPO active directory has ways to block usb disk which i tried but unseccessfully. the reading writing authorisations are not spread on the network. but i'll read through out the forum before making the thread ^^

---

i'm new in the company, and like i said, their server have trouble spreading the authorisations, if i can solve that, it would be very nice because i wanna tighten the access as much i can on everyone (users have many rights they don't need like installing softs)
the company leader wants me to solve many issues(that's why he hired an engineer ;) )
it's problematic and the network is spread on many buildings and cities and many OS(xp,vista,7, and macs), it's really complicated
for now i handle backing up data, i'm done with it, i'll care about policies next and see what i can improve, i guess it's time to take a day off and then dive into the depths of the forums to try to solve this issue :p
sorry for my bad english :D

Hi neozoon,

I was afraid that you would have a multiple site, multiple software environment.

Quote:

---

(users have many rights they don't need like installing softs)

---

That means that they have at least local admin rights. I would imagine that they logon as such all the time? :shocked: I would suggest that if you have trusted users in remote locations who you need to be able to take local administrative action, you give them a separate admin ID, and tell them that its use is monitored ;) Otherwise, is remote installation & update possible for you?

Quote:

---

the network is spread on many buildings and cities and many OS(xp,vista,7, and macs), it's really complicated

---

Just as I feared! I would guess that this is made worse by all sorts of different applications, and the same applications at different versions?:eek:

If you still have a copy of the malware please send it to Symantec...........I would be interested to know what their response is.

"Toka Koka"...............we have something similar: "No gain without pain"...........fortunately, it is not mandatory to listen to users screaming :lildevil:

your fears are confirmed again dear nihil : same applications at different versions since the licences don't have the same price ! :(

my main fear is that the domain servers were wrongly setup! it would be realy problematic to restart from the begining. working with the current setup won't give results(which happened already when trying to lock usb, it worked on 4/12)

but i didn't really concentrate on that before so after i finish my reports, i'll dive into that shitty 2003server lol ^^