Norton Antivirus Exclusions

I use Norton Antivirus 2001. In options | system | exclusions are listed the following:

*.dbx
*.nch
*.VI?
Excel.EXE
MSACCESS.EXE
POWERPNT.EXE
WINWORD.EXE

These must have been default settings, as I don't recall putting anything in exclusions.

Can anyone explain the rationale of having these things listed in exclusions? I'd think one would want to have everything scanned.

What really confuses me is that .dbx is the extension for Outlook Express files, and you can hardly find anything more susceptible to infection than that. So why would those be excluded? Is it only that if email scanning is enabled, it shouldn't be necessary? (But what if email scanning is not enabled?) Or is there something about the way .dbx files are stored that would make a manual scan ineffective?

Someone must have a better idea than I do of how these things work!

Hmm, I installed NAV 2002 yesterday. under default settings, only two items are listed 'excluding' here: *.nch and *.dbx (which I have removed). Then again, I've not installed MS Office, so I don't even have those .exe's. Anyway, if I were you, I'd remove all exclusions, and perform a full system scan, just to be safe...

HeyAirhead:
Here is the Symantec answer to your question about exclusions:

http://service1.symantec.com/SUPPORT...436?Open&src=w

That may answer it - but I've got to admit it certainly wasn't the answer I was hoping for! If I am following their logic here, it seems that it almost amounts to, "If it might give a false positive or slow down your system, just don't scan it, even if the files involved are among the most likely to get infected." It makes me a little less satisfied with Norton Antivirus.

Anyone have a feel for what the rate of false positives might be? Slowing down the system while doing a manual scan isn't that big a deal, as I can always set it to run before I go off to do something else.

Maybe I'll just take Guus' advice and eliminate all exclusions and see what happens.

I think that would be quite an efficient sacrifice of time, waiting a little longer, or take the chance of losing your system due to not checking .dbx files.

sounds to me NAV is just trying to keep themselves from looking bad. it dosn't make any sense not to scan those files.

Well, if I had to hazard a guess... it'd kind of fall under the same reason you don't want to scan a virus scanner. Lots of false positives, etc. (and, at one point, MSWord originally combated macro viruses by trying to check the thing itself - that was about the time that the macro viruses went from being simple things to make your MSWord experience annoying to basically using MSWord to execute system commands and kill your system for you...)

Also, for real-time type scanning, things like MS Word, Excel and all of those other office things tend to have system access built in to them that you normally wouldn't expect out of a so-called "normal" word processor or spreadsheet. So, things like NAV might pick that sort of thing up as a "WTF?!?" (ie. Word's "normal" activities fall so far outside the normal realm of word processor that NAV can't figure out what the h*ll it's doing, so it's better to simply ignore it and hope that your macro virus gets found another way, hopefully before it's even written to disk).


So, my experience may be a bit dated in that realm (as I've stated elsewhere, I tend to try to avoid having to use M$ abortionware) and it may just reflect Symantec's "thinking of old" as well (one of those things they may have added long, long ago and no one seems to remember exactly why it was there in the first place, etc)

LOL, draziw

One thing I'm a bit confused about. Is there something about the way Norton Antivirus does their scan that is different from the way Panda does their online ActiveScan? The reason I ask is that Panda's online scan caught a Majistr-infected attachment in an old email on my computer. It had apparently been sitting there for a few months and I'd forgotten about it and had never opened it. It is entirely possible that I had temporarily disabled email scanning at the time it came in, then if the email files were in the exclusion list, it wouldn't have been caught by Norton during my full scans.

Also, if Norton can scan the email as it is coming in (if that option is chosen), why shouldn't it be able to handle a scan of email when doing a full scan?

I too had .dbx files as well as .nch files in the exclusions of my norton's antivirus 2000. I took Guus' s advice and removed them all. I am quite sure I can spare the extra time. I also don't use Outlook Express so maybe I didn't need to remove them but better safe than sorry.

They're set as defaults for the reason that Norton lists. If you don't like 'em then remove them!
Instead of worrying why, sometimes there are answers we may not agree or understand, then just do what you need to. There are plenty of other things to worry about than this!

Peace

Quote:

---

Originally posted here by Airhead
One thing I'm a bit confused about. Is there something about the way Norton Antivirus does their scan that is different from the way Panda does their online ActiveScan? The reason I ask is that Panda's online scan caught a Majistr-infected attachment in an old email on my computer. It had apparently been sitting there for a few months and I'd forgotten about it and had never opened it. It is entirely possible that I had temporarily disabled email scanning at the time it came in, then if the email files were in the exclusion list, it wouldn't have been caught by Norton during my full scans.

---

Well, as txwebman said, I think, the defaults are there for a reason... my guesses with Norton? Chances are your email system has a NAV plug-in that it should be using, so it's pointless to scan the mail database from the filesystem when using the plug-in should be able to give it a more-comprehesive scan (including, for example, the ability to decrypt messages that are encrypted with a key held by your mail client or another plugin or similiar, etc).

So, in short, it's up to you to make the best policy decisions for your own network(s) and or system(s) and, well, you have to live by the consequences of such a choice.

Quote:

---

Also, if Norton can scan the email as it is coming in (if that option is chosen), why shouldn't it be able to handle a scan of email when doing a full scan?

---

(I think I kinda answered this above, too)


Also, please remember that a virus scanner is simply a sophisticated "pattern matcher." So, there's always the caveat that a discussion about an virus can trigger an alarm on a message... or similiar.


My general principles about dealing with possibly-infected files... and this goes for things sent from people I know.

• Never trust an email attachment (particularly *.exe or *.scr)
• When dealing with documents sent to you, always use a viewer (not MSOffice)

"Making a big deal of it" or "Curiosity about how it works so one can better understand any implications" - I guess it is all in one's point of view. Guess I'm still an educator at heart. As little as I know about computer security, I know more than most of my friends and relatives, so am frequently asked for advice. And understanding how something works often allows one to go far beyond the answer to an immediate question.

As I said in post 4, slowing down the system while doing a manual scan isn't that big a deal. I was much more concerned about false positives. But since we aren't getting reports that people who tried it were driven to distraction with false positives, that may not be a problem, either.

Sorry, draziw, I didn't see your reply there before I wrote that last post. That description of a possible difference between the email scanning and a full system scan helps me better understand how these things may work.

Thanks to everyone for your replies and assistance. This is such a wonderful, helpful place! :D

HeyAirhead:

Here ia a link to the NAV (2001) forum:

NAV 7.0 (2001) forum

You might find the answer that you seek there.
Good luck.
:thumbsup:

Whoa! Look at this from Symantec Technical Support in answer to a question asked by someone else on that NAV 2001 support board:

Quote:

---

Certain types of files are included by default in the Norton AntiVirus exclusions list, and in fact the scanner will not work properly without them.

These files are excluded for safety reasons. They are mostly Microsoft application and data files which have been designed to integrate closely with your operating system. By design, they are resistant to modification, and serious corruption and data loss can result if NAV attempts to modify their contents.

Also, by Windows design, the contents of these files are inert until accessed by their parent applications. At this point they are written into temp files which are scanned, and you will be alerted to any malicious code present. You will then have an opportunity to act upon them.

---

For anyone with a burning desire to check that out in context, here is the source Symantec reply.

Guess it may not be such a good idea to eliminate those exclusions after all! Thanks for the reminder to check that board, Bucket.

BTW, Bucket, check your PM.

those are default settings. an antivirus program almost always has exclusions (unless you set it to scan all files and folders).

HeyRyan

It can be taken as given that these are default settings. The question raised by Airhead is why are these the default settings and is it OK to modify them ?
Do you have any ideas on this subject?

:confused:

Don't modify the defaults.......

These files are excluded for safety reasons. They are mostly Microsoft application and data files which have been designed to integrate closely with your operating system. By design, they are resistant to modification, and serious corruption and data loss can result if NAV attempts to modify their contents.

Good answer, Kapperdog.

:wow: