Rootkit-like Feature Found in Norton Systemworks

GenieGenieGenie writes "eWeek reports a rootkit-like 'feature' in Symantec's Norton Systemworks, discovered by the Mark Russinovich, who was also responsible for blowing the whistle on Sony's DRM rootkit. The cloaked directory is intended to prevent users from accidentally deleting important files, but could compromise a system by serving as a hiding place for malware, as was the case with Sony's rootkit. Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole."

Comments

Grant money well spent (not)

[conteXXt]

I have always been suspect of Symantec.

I am sure the DHS knows what it is doing when it gives Symantec money to "secure" linux.

Gawd help us.

Re:Grant money well spent (not)

[Anonymous Coward]

I have always been suspect of Symantec.

I am sure the DHS knows what it is doing when it gives Symantec money to "secure" linux.

You "suspect" Symantec because they used a rootkit-like trick to hide the Norton NProtect feature's directory from other applications? Why is that? Do you believe that I don't want NProtect installed on my computer (NProtect is an optional feature of a software package that I choose to install)? Do you believe that Symantec is working against my interests, like Sony?

I'm not sure that I agree with Symantec's solution. It would be trivial for Symantec to program Norton Antivirus to scan the NProtect feature's directory (NAV is a part of any package including Norton Utilities, which includes NProtect). I suspect that they abandoned the whole idea because: 1. The argument concerning multiple-'rootkit' incompatibly is reasonably persuasive; 2. You could conceivably decide to use something other than NAV by choosing not to install it and 3. They could be swamped by alarmed calls from users detecting a 'malicious' rootkit with the various tools that are coming into vogue.

However, I still value a feature that prevents little Johnny from blowing away important files while he dorks around with Windows Explorer with all the "hide files" settings disabled. It is supremely aggravating that I have to let users run on a machine Administrator level to run half of their software, which prevents me from using directory security to effectively perform its God-given function of stopping the user from deleting anything but their own dang work.

Invitations to switch OSs will be summarily ignored. You have been warned.

Re:Grant money well spent (not)

[molnarcs]

I have always been suspect of Symantec. Me too. That's why I wrote this recently. Just a few weeks ago I removed yet another NAV install from a puter. This time it went well - uninstall worked fine it seems, needed just one reboot. But previously, with certain NAV releases, it was impossible to remove - or at least harder than removing spyware. Even after "uninstalling" it NAV left a lot of cruft on the system, that not only was "just there" but it loaded code at boot time. It was only possible to remove by switching to safe mode, cleaning up the registry, and removing some files manually. Symantic is EVIL!

Add to this their track record: failure to detect SONY's malware, (and now they seem to have one of their own) and they are always the last to provide adequate means to remove fresh exploits (no data here, but I distinctly remember that whenever something crops up, f-prot, free-av, etc. works, and NAV comes trailing behind other antivir solutions.). Plus it is a serious resource hog - more than any antivir progs.

The first serious breach of "Do no evil" of Google was their inclusion of a Symantec product in google pack :)))

Re:Grant money well spent (not)

[catahoula10]

NAV also has a "trusted application list" that will update when the 'live update' feature is run. Yet i cannot find this list, or a way to edit it. There is also no choice in accepting or declining the list. It comes along with virus def updates. Only after the Def's are downloaded can you see that "trusted application list" has been updated also.

Maybe, just maybe, there are applictions on that list that i do not choose to trust. Maybe i want to trust all of them. I would like to have that choice.

Or maybe i simply so not understand what a "trusted application list" is. This feature should be made more clear.

Re:Grant money well spent (not)

[DrSkwid]

> It is supremely aggravating that I have to let users run on a machine Administrator level to run half of their software

who are these "users" over which you have dominion ?

if you have dominion then use it

if you don't, then stop bitching

Re:Grant money well spent (not)

[Anonymous Coward]

who are these "users" over which you have dominion ?

if you have dominion then use it

if you don't, then stop bitching.

"Over which I have dominion?" What in the world gave you the idea that it could be characterized in this way?

They are users. They are also the wife, the daughter, and the mother-in-law. They can neither be fired nor killed.

But you can be told to F* off. Please do so.

Re:Grant money well spent (not)

[DrSkwid]

> "Over which I have dominion?" What in the world gave you the idea that it could be characterized in this way?

you did, here try listening to yourself :

"I have to let users run on a machine Administrator level to run half of their software"

ergo, you claim dominion

you can tell me to fuck off, lol no u can't you say F*

anyway, I'm going nowhere

Uninstall vulnerable?

[jbeaupre]

For those of us who dislike the pre-installed Symantec software and uninstall it first chance we get, is there still a vulnerability?

Re:Uninstall vulnerable?

[jim_v2000]

If you're using any product other than Norton SystemWorks, you're fine.

Re:Uninstall vulnerable?

[toleraen]

For those of us who dislike reading TFA, we'd never find out about the free utility linked in TFA to check if the rootkit is there.

Before the flame wars start...

[thepotoo]

Lets get one thing clear.
This is not the Sony rootkit. It's just a directory that's not scanned by antivirus/antispyware.

And, now that it's potential vulnerability has been exposed, Symantec is releasing a new version without the protected recycle bin.
In other words, too bad they had to have their wrists slapped to fix it, but there was no malicious attempt.

Re:Before the flame wars start...

[jim_v2000]

Symantec is releasing a new version without the protected recycle bin Correction, they are releasing an update via LiveUpdate that will remove the cloak from the protected recycle bin folder. The protected recycle bin will still be there. *So once you run LiveUPdate, you're fixed.

Re:Before the flame wars start...

[Directrix1]

Sony did not install a "rootkit". Sony installed crappy DRM with security holes. They both created completely hidden directories to save people from themselves (regardless of personal intention). There really is very little difference.

Re:Before the flame wars start...

[VitaminB52]

Sony installed crappy DRM with security holes.

To be more precisely, Sony installed crappy DRM software, which was implemented with rootkit technology.
Norton has a hidden directoy to prevent certain files to be accidentally deleted by a user.
Sony's DRM has hidden files, to prevent the DRM software to be intentionally deleted by a user who doesn't want to have DRM crap on his/her PC. The Sony DRM software hides all files starting with a certain string. In Sony's case it is the software itself that's being hidden from view - this is rootkit specific.

Re:Before the flame wars start...

[Tony Hoyle]

There's a way of making files so that Norton won't scan them... Symantec actually volunteered the information a couple of years ago until I pointed out that putting that in an opensource product would make expose the information to virus writers. Me and my big mouth... I should have just gone ahead and got the information & published it.

OTOH I still recommend that Norton is removed before using my (and any other) software.. it's junk and drags the machine down to a crawl. One place that I worked tried to force it on my desktop machine - I knew immediately because a 10 minute compile slowed to a 40 minute one (and the new icon gave it away)... ended up removing it daring them to complain (OTOH a week later they removed it from everyones machine once productivity went through the floor).

Re:Before the flame wars start...

[QuestorTapes]

> Lets get one thing clear.
> This is not the Sony rootkit. It's just a directory that's not scanned
> by antivirus/antispyware.

Let's be completely clear. It appears to be more than "a directory that's not scanned by antivirus/antispyware"

It's a directory that is cloaked from the administrator. It's not merely bypassed by the antivirus and antispyware utilities, it is hidden from anything that uses the Windows FindFirst/FindNext APIs to view and scan files and folders.

It -potentially- opens a bigger security hole than merely software that hides from antivirus. It can hide from other tools as well. But is is different from the Sony Rootkit; it doesn't open up ridiculous holes. It seems most likely that this was a case of reusing code without understanding the security implications.

> And, now that it's potential vulnerability has been exposed, Symantec
> is releasing a new version without the protected recycle bin.
> In other words, too bad they had to have their wrists slapped to fix
> it, but there was no malicious attempt.

And, equally importantly, they didn't need to be dragged kicking and screaming, with the threat of lawsuits, into remediating the problem. That makes it a much smaller story.

Re:Before the flame wars start...

[bogado]

rootkit is very well defined, it is a program that subverts the operational system so that it become in fact invisible. The files do not show in directory listings and the process is not reported as running even thougth it is actually there.

They are not evil or bad in way by definition, but is arguable that this behaviour is not good. This is similar to the "good virus" concept (a program that replicates it self and goes from computer to computer doing something good like cleaning up another virus).

The sony DRM did have a rootkit, and aparently the norton has a similar "feature" that hiddens the deleted files in a hidden folder, so they can be undeleted. If this hidden folder follows the rules of the operational system (much like dot files in unix) this is quite ok, because if needed it can be found. But if it is actually using a rootkit is much harder to locate the said folder.

Re:Before the flame wars start...

[Feyr]

it does way more than slow the machine to a crawl. it prevents it from working properly.

working for an ISP, we get a surprising number of users that can connect to the net (as in, the modem dial), but nothing works, no web, no email, nothing. everything checks out, configs are fine and all.

but they have norton antivirus with their crap security. the configs to that seems fine. as soon as you uninstall that crap, everything work.

do your users a favor, have them install AVG (www.grisoft.com)

Re:Before the flame wars start...

[GenieGenieGenie]

I guess the point about this whole story is not the intended malice of Symantec, but rather that ye-old first principle of medical science: If you're a doctor, trying to keep a system healthy, primum non nocere . First of all, do not harm.

From this point of view, Symantec is actually worse than Sony, because the latter never claims to protect your system (not that I'm saying Sony are angels). True, the reaction by Sony was just before they had a gun pointed at their company's head, but how serious can you take a security-software company that has a rootkit in their software, acknowledges that due to developments in hacker-tech this has become a serious vulnerability (is this news at Symantec?), but still waits for some external source to publish their hole in order to fix it?

Re:Before the flame wars start...

[Anonymous Coward]

on the other hand, you can legitimately say that symantec has reason to do stuff to your filesystem and OS. do you really know the nitty gritty details about how an AV product works? esp. those with heuristic testing etc. of code? but you vaguely know "it's there, it's running, it's doing something".

the key difference between that and what Sony was doing is that Sony WAS NOT SELLING SOFTWARE. You *thought* you bought music, but all of a sudden, without quite telling you what it was doing, was sticking stuff onto your PC.

Re:Before the flame wars start...

[Biomechanical]

I work for a local community telco here in Ipswich - Internet, mobiles, landlines - and I have to ask customers to disable, or even uninstall, Nortons "something or other" sometimes.

Those poor bastards. For years we've - a general we've, not specifically you and I - been telling people have a virus checker, firewall, so on and so forth, and often recommending Symantec software because it used to be good, and now I gotta tell them that Nortons Security or Nortons Whatever is causing half their bloody problems, and the customer doesn't know why, or even understand.

As a simple solution to this whole problem, I've been waiting for a virulent strain of code to take out all the world's Window's-based machines so I can start telling people to get a Linux, BSD, or Mac system. Kind of a pisser of a solution but I think it would work, to a certain extent.

Re:Before the flame wars start...

[glesga_kiss]

It's not merely bypassed by the antivirus and antispyware utilities, it is hidden from anything that uses the Windows FindFirst/FindNext APIs to view and scan files and folders.

In order to the first, you must do the second. There is no other way to do this. If the Windows APIs can see the data, then applications built on the APIs can see the data.

Re:Before the flame wars start...

[pipingguy]

Since we were covering the non-evilness of cookies last week, why is it that index.dat is never discussed? What does it contain and why is it tied so much to the OS?

Re:Before the flame wars start...

[im_thatoneguy]

Norton used to be good? I can't remember a time when I've appreciated Norton on my computer. I would rather be drowning in viruses and malware than have Norton on my computer.

Re:Before the flame wars start...

[Lehk228]

index.dat caches the contents of a folder and icon previews for previewed files such as video and image files. index.dat it what makes it possible to open huge folders full of media files without a horrendous wait *every* time you open the folder.

Re:Before the flame wars start...

[Lisandro]

Norton utilities (and Norton Commander) used to be great in the DOS days. You know, back when Peter Norton did more than posing for the cardboard box.

Re:Before the flame wars start...

[iamlucky13]

In what way was Symantec trying to do harm here? As the article says, the hidden directory is a protected folder used to help prevent legitimate files from being deleted. Heck, Windows itself hides its system files by default (not in the same manner, granted) to keep stupid users from deleting all those DLL's that clutter up the hard drive. Please note that the installation of Symantec products takes place with the user's permission. Although hiding the directory may be a somewhat unsettling inclusion in that great "OK" button, it appears it was done with good intent. Symantec may not produce a very effective product, but they haven't sunk to Sony's lows here.

To truly compare somebody with Sony, you're going to have to find me an example of a company that installs software, not only without notification, but without any permission whatsoever. If you want to go even further, it should be software that intentionally disables features of your operating system and is potentially exploitable by malicious people. I think even 180solutions has given in and accepted inclusion into the EULA's of the products their software is bundled with.

One final word. The article described the hidden folder as a "rootkit-like" feature, not a complete rootkit.

Re:Before the flame wars start...

[Anonymous Coward]

You guys are blasting a software that, YOU probably have little knowledge of how to use. Just like the client that installed it. While you are telling them to turn that off or uninstall it why don't you go ahead and tell the to turn off windows firewalling. Then use dialup or better yet put the broadband modem in bridge mode and get a public NON NATed IP address. There now everything will work. They can even do file and print sharing over the internet. I bet, I could still collect IPs off my systems log scanning the net for file and print shares if I wanted too. And 70% of them would be those "IT Guys" that couldn't find their way out off a GUI interface.

Spend five minutes showing the clent how your app works with it disabled. Then spend another 5 telling them they SHOULD have some form of protection, But they need to RTFM and install it so that the apps don't break.

Now, I am surpirsed Norton still has a product to sale. With windows XP having a friewall built in. Mind you even if it lets you connect to antoehr system and login, before even getting around to ask you if you want to block the service.

On a lite note.. Someone shoudl do a study on how bad your taping gets when you get pissed off. I am only mad cause I miss Norton Disk Doctor and the Hex editor. Those where there greatest hacking tools I ever had.

Re:Before the flame wars start...

[QuestorTapes]

> In order to the first, you must do the second. There is no other way to
> do this. If the Windows APIs can see the data, then applications built
> on the APIs can see the data.

I think we're talking about two different things here. It isn't necessary to hook the Windows APIs to have Symantec's antivirus and antispyware utilities ignore that folder. It -is- necessary in order for -all- antivirus and antispyware utilities to do so, regardless if who created the utility.

Expanding on that point, hooking FindFirstFile and FindNextFile is not sufficient to block low-level utilities. There are other ways for low-level programs to enumerate folders. High-level applications won't use these methods. It's rather trivial for a malware program or low-level disk utility to do so.

Re:Before the flame wars start...

[NaDrew]

Lisandro: Norton utilities (and Norton Commander) used to be great in the DOS days. You know, back when Peter Norton did more than posing for the cardboard box.

AC: I am only mad cause I miss Norton Disk Doctor and the Hex editor. Those where there greatest hacking tools I ever had.

You guys aren't kidding. I had the Norton Utilities 1.0, for the IBM PC before it had a hard disk, and several later versions up until Symantec bought Norton and started putting out crap. I actually found a bug in the first Symantec-owned version of NU, tried to report it, and was treated with quite the lovely condecension.

DiskEdit, NDD, NDOS, there was nothing you couldn't do with the old Norton. Is he even still around and doing anything? Or just retired?

Re:Before the flame wars start...

[ultranova]

Sony did not install a "rootkit". Sony installed crappy DRM with security holes. They both created completely hidden directories to save people from themselves (regardless of personal intention). There really is very little difference.

Sony's rootkit did not try to save people from themselves. It tried to protect the interests of Sony by hijacking the machine from its rightfull owner. Symantec's feature tried to keep the user from accidentally damaging the program, thereby protecting the user from himself.

Sony's rootkit was meant to break the computer, Symantec's rootkit was meant to keep the computer from breaking. They are polar opposites.

norton

[fireiceviperhotmail.]

I just think its ridicules to hide stuff for me on MY Computer.

Julien. http://free.hostdepartment.com/8/81fortune/

Re:norton

[fireiceviperhotmail.]

nice job with the moderating... wats wrong with you ?

Deleting files

[gr8_phk]

They did it so users couldn't accidentally delete important files?? Sure would be nice if there was such thing as "root" on Windows so you could have files that every day users couldn't delete...

Re:Deleting files

[thepotoo]

From what I understand, this is so you can't delete all your precious word documents without meaning too.

That's still a problem in Linux.

Re:Deleting files

[l2718]

Symantec's "NProtect" is a service similar to the recycle bin: when you delete a file, it is moved to a special directory and its metadata is preserved. This allows for easy undelete. As with any internal state of a program, users mucking about the special directory could cause problems (e.g. what should you do if the users deletes a file from the NProtect directory?). This has nothing to do with "root" privileges.

Re:Deleting files

[Tim C]

Sure would be nice if there was such thing as "root" on Windows so you could have files that every day users couldn't delete...

You mean like the Administrative account? It's not entirely MS's fault that almost everyone abuses it; most of the blame lies squarely with the third party developers. XP has been out for a long time now, there's no excuse for new software to require admin privs to run.

I know, IHBT, IHL, I will HAND, etc.

Re:Deleting files

[Cro Magnon]

Why should the third-party developers fix Microsoft's mess? They know that everyone who buys a new computer will get a W95-like system with an "Owner" account, no password, and no hint that they should even create new accounts. Maybe 5% of those will add a password, and few of those might create extra accounts, which may or may not be limited. Plus, quite a few of those programs that won't run in limited accounts are FROM MICROSOFT!

I agree that devs have had half a decade to fix their crap, but MS has had half a decade to give the devs an incentive to fix their crap!

Re:Deleting files

[Steeltoe]

How is this post insightful? Both Gnome and KDE supports the concept of a trash-can, which is pretty similar to what Windows has to offer.

What is the meaning of keeping files on the disk that you have deleted anyhow? That is what backups are for. I personally recommend: BackupPC (incremental, on-the-fly, total, compressed, remote, minimal-storage and Free backup solution for Linux)

Re:Deleting files

[Anonymous Coward]

How is that a problem in Linux? KDE (and GNOME too, I expect) defaults to asking you if you are sure when you try and delete files with their file manager. And if the user is advanced enough to use the terminal for mundane things like deleting files, they are advanced enough to alias rm="rm -i".

So exactly who is meant to be protected? The people who don't want to delete a file, but try and delete the file and answer 'yes' when asked if they are sure?

Re:Deleting files

[dc29A]

It's not entirely MS's fault that almost everyone abuses it; most of the blame lies squarely with the third party developers.

3d party developer? You mean silly things like:
- The user created during XP install is an administrator.
- The builtin administrator account can have blank password.
- During installation the system doesn't warn you at all that you enter a blank password.

Yes let's blame the 3d party devs when the installation of Windows XP welcomes and encourages shitty shitty security.

Re:Deleting files

[Thundersnatch]

There is such a thing as "root" on windows NT/2K/Xp/2K3. It is the local Administrators group, plus the LocalSystem account. Those accounts have the power to hide anything from regular users. The problem is, most home users run with their account as part of the local Administrators group, since Windows makes the installing user part of that group. Which was stupid design decision on the part of MSFT.

That said, if a workstation is part of a Windows domain, by default new users are NOT part of the local Administrators group. They are only part of the much more restircted local Users group instead. Which is the way it has been since at least NT 4.0. All of the users in my company only have Users-level permission on their worksations; as a result we have had almost no spyware, virus incidents, or "oops I installed this thingy from tha Intraweb and broke my Windows" since we rolled out NT v4 in 1998.

Re:Deleting files

[greginnj]

From what I understand, this is so you can't delete all your precious word documents without meaning too.

That's still a problem in Linux.

I call BS. I have absolutely no problem with 'precious word documents' in Linux.

Re:Deleting files

[undeadly]

How is this post insightful? Both Gnome and KDE supports the concept of a trash-can, which is pretty similar to what Windows has to offer.

Open a console and execute "rm -fr ~/". Go have a look in your trash-can and search for files you won't find.

Re:Deleting files

[Anonymous Coward]

Open a console and execute "rm -fr ~/". Go have a look in your trash-can and search for files you won't find.

Then go back on your incremental backup and find the file you deleted by mistake.

Why should the disk hold files that are to be deleted, and someone capable of 'rm' should know enough to hold that power.

Re:Deleting files

[MSZ]

Same in Windoze, open command-line window, type "del /y *.*" and the files are gone straight to the bit bucket.

That "protected recycle bin" (or whatever it's called) is actually a quite useful idea, at least for average lusers. The implementation, however... well, since Norton Commander 4, Symantec was going downhill.

Rootkits are big now

[filenavigator]

Rootkits in windows are becoming more and more of a problem. I found this interesting site the other day when looking for a rootkit detector: www.rootkit.com

Re:Rootkits are big now

[IngramJames]

I found this interesting site the other day when looking for a rootkit detector: www.rootkit.com

Dude, you slashdotted a rootkit (detection?) site.

Somewhere there's irony in that.

$sys$Nothing 2 see here. Please move along.htm.pif

[Anonymous Coward]

I don't see any problem here at all.

Heh, my "confirm you're not a script" image is "sanity."

I don't get it

[Anonymous Coward]

The cloaked directory is intended to prevent users from accidentally deleting important files

There's thousands of important files on a Windows system, and they don't need a rootkit to protect them. What's special about Norton files that make them extra-specially important?

Re:I don't get it

[Anonymous Coward]

They are refering to the "Protected Recycle Bin" feature.

It's not for protecting Norton files. It's for files that get deleted by methods other than the regular Windows recycle bin feature, so that the user still has a way to get them back.

Basically, it replaces the regular Windows recycle bin with Norton's. They just hid theirs better than Windows does.

Re:I don't get it

[jc42]

There's thousands of important files on a Windows system, and they don't need a rootkit to protect them. What's special about Norton files that make them extra-specially important?

Well, judging from the comments here, there are lots of owners of the machines that want to delete the Norton files. This isn't generally true of Windows' system files or the users' own files. Protecting files from a machine's owner does often require special tactics. ;-)

Uninstalling Norton can be very time consuming

[digitaldc]

I have had to uninstall Norton a few times and the 'Add and Remove Programs' feature in Windows did not work.
So, I had to go to this link and do it manually....talk about a pain in the #*$%.

Re:Uninstalling Norton can be very time consuming

[jim_v2000]

Ha ha, I did support for Norton awhile back, and I dreaded going through that document on the phone with some poor SOB who managed to hose his box to the point where Norton wouldn't uninstall. LoL.

Re:Uninstalling Norton can be very time consuming

[darkitecture]

I have had to uninstall Norton a few times and the 'Add and Remove Programs' feature in Windows did not work. So, I had to go to this link [symantec.com] and do it manually....talk about a pain in the #*$%.

I have to admit that manually removing Norton is always a pain in the ass but Norton has provided a total removal tool for years. Before, it was called Rnav2003 and was available for free download on their website. Newer versions of Norton require SymNRT, which is also available free on their website:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2005033108162039?Open&src=bar_sch_nam&docid =2004093015165236&nsf=tsgeninfo.nsf&view=docid&dty pe=&prod=&ver=&osv=&osv_lvl=

It works like a charm and means you don't have to sit there manually removing Norton for two hours, secretly and silenting wanting to find a pencil, sharpen it and shove it in your eye.

Re:Uninstalling Norton can be very time consuming

[tkrotchko]

The alternative, of course is to:

      JUST HAVE NORTON UNINSTALL LIKE A REGULAR PROGRAM!!!!

Just what is Symantec hiding that they won't let you just get rid of their stuff when you uninstall?

Re:Uninstalling Norton can be very time consuming

[Ilgaz]

I don't know what version they are at now but if you actually look to Systemworks, it is not some "hit and run" $10 visual basic shareware. They are very advanced software products.

For example they have their own kernel like layer being shared by other products.

You people never met with some "computer users" deleting DLL files because "they are unreadable in ms word" ?

Just ask to Microsoft why they implemented System File Protection (SFP) :)

Re:Uninstalling Norton can be very time consuming

[Tim Browse]

if you actually look to Systemworks, it is not some "hit and run" $10 visual basic shareware. They are very advanced software products.

Exactly, so you'd expect a functional installer/uninstaller to be a given.

Re:Uninstalling Norton can be very time consuming

[F_Scentura]

"They're really complicated!" is no excuse for not following the conventional uninstall procedure and requiring that a separate uninstall program be downloaded separately from the internet.

Re:Uninstalling Norton can be very time consuming

[jim_v2000]

I have to admit that manually removing Norton is always a pain in the ass but Norton has provided a total removal tool for years. Before, it was called Rnav2003 and was available for free download on their website.

Unfortunately, RNAV and SYMNRT do not work for Norton SystemWorks. Those are tools for the Antivirus. SystemWorks is still a biatch to manually remove.

Re:Uninstalling Norton can be very time consuming

[Tim C]

So? Why can't they ship the downloadable uninstaller with the product and provide a shortcut to it from the program's Start menu entry, like every other program does?

I don't doubt that the software is both complex and well designed and written, but that's no reason not to provide correct uninstall functionality. If anything, you'd expect them to be *better* at that sort of thing if the rest of the software is so good...

Re:Uninstalling Norton can be very time consuming

[ziggyzig]

But why should you have to go through the process of finding a separate program on their website? While not intentionally malicious, it still reeks of a company that cares more about their bottom line than their customer.

Re:Uninstalling Norton can be very time consuming

[Anonymous Coward]

Uninstalling is easy -- I use a disk crusher.

Re:Uninstalling Norton can be very time consuming

[Ilgaz]

They have uninstall capability. In my PC times (2003) you click on add remove programs and uninstall like regular program.

As they moved to MSI (microsoft installer built with installshield) it was even easier to stop services etc.

Look, there explains how to uninstall with add/remove or even remove features
http://tinyurl.com/c6dnt

If you corrupt your registry or windows somehow stupidly loses the data (happened a lot), you need that program to uninstall safely without thousands of files in protected recycle bin which are PROTECTED.

Protected recycle bin is designed to make _you_ (and malware you run) stop from doing evil things to your files/documents so it is not very surprising that they hide it from system.

Since famous delete.sys times of MS DOS, such utilities are protecting you from yourself in fact :)

Re:Uninstalling Norton can be very time consuming

[pipingguy]

That's why some people (especially those with teenagers) decide to wipe disks clean and start all over again, paying $100 to have it done.

They don't really care if their machine has been rooted or "pwned", it just slows down unacceptably and then it's either disk wiping time or time to buy a new computer.

My brother is a good example of this. When I ask if he's running AV, anti-spyware and a firewall, he says yes. When I ask if he keeps all these up-to-date and installs Windows Updates, he goes - "doh". Of course, his copy of Windows is, err, free with his machine, and he has a buddy that takes care of that for him.

Re:Uninstalling Norton can be very time consuming

[Reziac]

I had that same thought. Several answers come to mind:

1) You don't want an AV/security product to be so easily uninstallable that any malware that comes along can do it. But that can be got around by requiring a password from the user. No need even to have the user make one up; print it on the box along with the unique product key.

2) More likely, the idea is that if it's too difficult to uninstall, ordinary users will wind up locked into it. Indeed, I've witnessed this thought process from users who would like to switch to a competing product, but don't dare because of the iffyness of removing the current product.

3) Shitty, incompetent, spaghetti programming, and the result of trying to be too many things to all users.

Who needs Symantec?

[PhakeDC]

Apparently insecure and/or incompetent sysadmins are behind the boom in "all-in-one-fix-'em-all" suites. Why not tackle the problems head-on yourself rather than relying on third party software which might actually jeopardise your entire system without you knowing it? And I found Norton Anti-virus to be a serious hog on system resources. It's safe to assume their other products are in the same league.

Re:Who needs Symantec?

[Ilgaz]

Their target for SystemWorks is not Slashdot posting people like you and there are people who actually DELETE these files making their system unusable.

System admins use Symantec corparate solutions which has NOTHING TO DO with the stuff mentioned here.

But keep bashing Symantec. It is number 2 favorite target of geeks after real networks.

I bought it as a gift to a pure newbie computer user who is really busy with stuff rather than dll and registry hunting manually, he is happy to this day.

Re:Who needs Symantec?

[Antiocheian]

From the day Symantec required that I install Internet Explorer on Windows 95 in order to run their system diagnostics software, they have been removed from my list of dependable companies.

System diagnostics and antivirii are useful applications, but not from Symantec.

Re:Who needs Symantec?

[geobeck]

Why not tackle the problems head-on yourself...

Because a lot of sysadmins don't have the luxury of having time to do their jobs properly. If your company has passed its 'boom' stage, and even its 'comfortably profitable' stage, and is into its 'slowly dying' stage, like so many large, bloated corporations, an office of 50 people might have one sysadmin who also handles database, documentation, tech support, and god knows what else. In a company like that, a good security suite, in addition to proper hardware firewalls and remote security services, makes it possible for the company to exist without daily worm shutdowns.

Of course, when I talk about a good security suite, I'm not talking about Symantec. But I've been very impressed with Trend Micro Office Scan.

Re:Who needs Symantec?

[shokk]

PFT!... I WISH I had a 50:1 user-admin ration.
I keep asking for a life preserver and they keep throwing cinder blocks.

Re:Who needs Symantec?

[unsigned integer]

You're absolutely right. Most of the people responding to this thread have never used the CORPORATE VERSION OF SYMANTEC ANTIVIRUS (or SYMANTEC __INSERT CORPORATE VERSION HERE__) - which typically has

a) much less bells and whistles in terms of GUI annoyance
b) lets you do things like setup a AV server, and then just update / fix that which will in turn rollout updates to your clients
c) many things i've forgotten because it's been a while since i administrated that (last version I did was 9.x something)

The Corporate version(s) is(are) FAR FAR less intrusive than the consumer version(s).

No.

[thepotoo]

From what I can tell, if you uninstall it, you lose the system protected recycle bin (designed to prevent you from deleting your pr0n, actually it provides a hidden place for viruses to hide). Therefore, you're safe.
If you are still paranoid, reinstall it and run the update patch with fixes it.
Or, check out BlackLight Rootkit Elimination Technology, which is supposed to eliminate (or at least detect) the rootkit.

Re:No.

[Spad]

Certainly on older versions of Systemworks this isn't the case. My housemate came to me after being unable to account for 8Gb of used hard disk space, after much investigation it turned out that that 8Gb consisted of files that had been in Norton Protected Recycle bin when he uninstalled it and they were still there. In the end I had to use a DOS bootdisk to delete the folder structure and free up the space.

Re:No.

[Ilgaz]

That is why he should uninstall Norton with methods suggested by Symantec if "add remove" fails.

Norton unistallers ask if you want to clear protected recycle bin and there are actually people using it. Another easy method is, right click to recycle bin and click "empty protected files" before attempting to uninstall Norton.

Re:No.

[Reziac]

I inherited a W2K system with the evil Protected Recycle Bin... and have noticed that the "Empty Bin" functions are buggy as hell. Sometimes it works (tho typically it takes several tries, and thumping on two different "Empty bin" menu items), sometimes it doesn't. The rest of SystemWorks on this machine seems to keep its claws politely out of stuff, but I'd like to get rid of its recycle bin meddling.

Sony Rootkit

[Anonymous Coward]

Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole.

Sony's rootkit was done entirely under good intentions as well (like it or not DRM is not a bad intention), and look how that turned out.

What's funny is everybody will blow this over because it's Symantec not the RIAA. It really is just as severe if not more so, coming from a software company that deals in security.

I trust Russinovich's technical analysis, but I don't his moral opinion.

Re:Sony Rootkit

[ozydingo]

It's probably a little better; I'm guessing the code isn't quite as poorly written as First4Internet's rootkit for Sony. That still doesn't make it ok though.

Re:Sony Rootkit

[Tim Browse]

Sony's rootkit was done entirely under good intentions

Except for the part where they installed invasive system software even if you clicked the "No, I don't want that" button.

Or was that an 'honest mistake'?

Re:Sony Rootkit

[99BottlesOfBeerInMyF]

Sony's rootkit was done entirely under good intentions as well (like it or not DRM is not a bad intention), and look how that turned out.

I'm not sure that your assertion is defensible. Sony wanted to make my computer less functional so that they could have more of my money. I don't consider that to be good intent.

Re:Sony Rootkit

[jim_v2000]

It really is just as severe if not more so, coming from a software company that deals in security.

I guess it's a good thing that Symantec released an automatic update via LiveUpdate that takes care of the issue then, eh?

Re:Sony Rootkit

[punkr0x]

Also note Symantec fixed the problem once they were caught, whereas Sony continued to deny any wrongdoing. Of course, Symantec could have fixed the problem BEFORE they got caught, but where's the fun in that?

Re:Sony Rootkit

[rbarreira]

Sony's rootkit was done entirely under good intentions as well (like it or not DRM is not a bad intention)

DRM is not a bad intention? What about restricting your right to legally backup a CD to mp3 files? Wasn't that what they did?

Rootkits

[cyp43r]

I've never much liked Norton Antivirus, and this just adds more fuel to the fire.

Re:Rootkits

[jim_v2000]

The article talks about Norton SystemWorks. Which if you ran LiveUpdate on already, you're fixed. This has nothing to do with Norton Antivirus.

Re:Rootkits

[cyp43r]

Oooh embarrassing...I meant SystemWorks.

Re:Rootkits

[mayesa]

Yeah.. do this people know the word "linux"? If they don't, I'm sure they know at least the word "avg".

Re:Rootkits

[laffer1]

Some versions of system works have included NAV. So it does have something to do with it.

Re:Rootkits

[rwise2112]

Actually some versions of NAV did included the Norton Protected Recycle Bin.

Wow, now with fewer holes!

[frostfreek]

"...Symantec's update further protects computers by displaying the directory,"

That's great! Our product is now better, because we turned off something bad we were previously doing!
Now that's a nice spin!

Uninstall vulnerable? clarification

[jbeaupre]

My real problem is that my mom bought a PC at Christmas. While visiting (she's a couple time zones away), I did a little tuning (firewall, firefox, openoffice, etc.) Symantecs pisses me off so it got uninstalled (replaced with Avast). But ... did the uninstall really clean everything up? I can't check in person and I'm not going to walk my mom through rootkit detection unless neccessary.

Re:Uninstall vulnerable? clarification

[toleraen]

Ahhh - well I can sympathize with you in that case! While a straight answer would have been better, the tool that's linked in the article is very very simple to run. You hit download, open it to install, accept the EULA, and hit scan. The window is simple and well laid out, tells you if you found anything, hit next if it did, and hit exit. Should be pretty easy to walk anyone through (a lot easier than stuff like a virus scan or spyware scan).

Not a Surprise

[u16084]

Maybe slightly off topic, but I'll speak my mind anyways. Systemworks is Very dangerous, for those that have observed how it actually installs onto a system its a scary sight, A VERY tight intergration with the OS. If a "User" rm's one of these "files" without a doubt the computer will suffer. Their intentions were good to "protect" the files, since meny users who install "Systemworks" have no clue anyways. A patch was issued (not ignored), Sony should learn from its mistakes.

Re:Not a Surprise

[Anonymous Coward]

I had this happen myself, when an installation failed half-way through. A "network driver" (Sticks itself between the OS and the network card) was left on the system which caused crashes whenever the traffic went too high. Removing the file simply caused the internet to not work. Eventually my harddrive died so I just reinstalled Windows.

Rootkit GOODNESS

[Stuupid]

will all this media attention bring about a "rule" that honest companies follow-- "Dont hide things from your customers." ? its nice to see that we will, at least in the short term, retain absolute control over our computers.

steps

[trandism]

Steps of action when joe six-pack brings me a windoz box: 1. Uninstall Norton 2. Install AVG 3. Delete all "e"'s from everywhere 4. Install Firefox 5. Install Opera 6. Delete all Outlook shortcuts 7. Install Thunderbird 8. Install VLC and associate all media with it 9. Teach the guy to right-click/scan with AVG everything he downloads from the internet It worked nice in most occasions My 2p

Re:steps

[stunt_penguin]

10.
teach
user
how
to
use
BR
tags
.

Re:steps

[trandism]

Hehe... nice...
"Preview" is for girlies, real men click "Submit"
Sorry anyway

Re:steps

[Shawn is an Asshole]

Don't forget about BitDefender. It has a free on-demand scanner, and I've found it to be excellent. I gave it a try this weekend on a few computers heavily infested with spyware and viruses and it found and removed things that Spybot, Ad-Aware, Microsoft AntiSpyware, AVG Free, F-Prot, and ClamWin didn't. I'm definatly going to be using this more often.

Re:steps

[blake3737]

thats way to many steps.. I think my plan of action works much better with a jacked up windows box, and it's way faster: Step 1: Open window. step 2: throw plain old beige box out window. If you really don't like the person this can even be a one step fix.(skip step 1)

Re:steps

[Anonymous Coward]

I use a this kind of method
1. Install Ubuntu
2. Make .desktop files for firefox & evolution(configure evolution)
3. Install restricted multimedia codecs (optional)
4. Don't never ever tell them you installed Linux on their system, just refer to it as Ubuntu
    or Gnome.

Everything will be allright as long as they don't know that you installed Linux on
their system, because they aren't hackers and don't know how to use Linux :)

It might be a good thing to do to hide system folders as in OSX, but haven't found an easy way
of doing it...

Re:steps

[trandism]

yeah right... and then change telephone numbers... unless you wanna explain them why their PC doesn't run google earth or why they cannot play Fear...

Re:steps

[stunt_penguin]

Well i was just being cheeky :p

Re:steps

[rob_squared]

Awesome, I didn't know Firefox was up to version 5, nor that Thunderbird is at version 8. I wonder how they got there faster though, since firefox came out first.

Not quite the same...

[drakewyrm]

The hidden NProtect directory at the heart of this issue has been (reasonably) common knowledge for some time. They were up-front and honest about the presence of this directory, and made frequent reference to the "hidden" and "protected" nature of said directory in documentation and marketing literature.

Also, according to Symantec's own writeup on the issue, the directory was cloaked specifically so that it would work as advertised: to keep people from deleting important shit, particularly files that can't be put in the Recycle Bin.

Also, also, you need to give them a bit of credit for the fact that they worked with Mark Russinovich of Sysinternals and F-Secure in fixing this. Nobody needed to make a huge stink about the problem like the last big rootkit issue

And the directory needs to be invisible...

[Celarnor]

Why? Anyone who's in wherever/whoever/application settings/ or wherever/Norton/whatever is probably there for a reason, and knows what they're doing and aren't numb enough to delete something. Either that or they're doing something they don't want people to see. Of course, I don't use any of their products, so I don't know.

Re:And the directory needs to be invisible...

[lotrfan7007]

You'ld be surprised how many people think "Uninstalling" is the process of deleting the folder of the program in question. With Norton, this would be a bad idea, and probably would cause hours of headache. However, it's a good thing that they are uncloaking this folder.

F-Secure in collusion?

[Anonymous Coward]

In TFA F-Secure staff are quoted saying they have known about this since March 2005? So, I guess they believe it is ok? Why didn't F-Secure announce they had discovered this problem?

Article doesn't say enough...

[DnemoniX]

I must have missed something in the article. All it refers to is a "cloaked" directory. Now this shouldn't surprise anyone here. This is no different than how XP works normally. By default XP hides or "cloaks" protected system directories too, namely the System Volume Information folder in the root of each partition. The only way you can find them is by selecting to show hidden files and folders and to uncheck the "hide protected operating system files" option.

Now what is interesting is that even if you have administrative privileges, you by default do not have access to that folder. You have to manually add yourself to the security on it just to open it. From the article this seems to be the exact deal with the Symantec product. They are worried that an intruder may use the location to stash files. Well guess what? That is exactly what attackers do with the System Volume Info folder. It happened to me on a system that I had an older version of the Backup Exec remote client installed on. A well known hole, thankfully it was on a test system with no access. I noticed a huge amount of outgoing connects from the box and used disk space that I could not account for. After some minor digging around I managed to find everything stashed in that hidden system folder.

So what I would really like to know, and the article doesn't specify, is Symantec actually hooking into the kernel to hide the folder from Windows, or is it just setting the permissions on the folder in a way that is similar to the System Volume Information folder? If it is the later this is not a rootkit, it's just being sneaky. If they are hooking in, well shame on them.

Re:Article doesn't say enough...

[Anonymous Coward]

I did not dig the web to know if this is related, but I once discovered that you can not create a folder named "con" in any folder under Windows 2000 (and maybe XP too, don't use it, don't remember).
At least it is something weird, and that can give a headache to anyone trying to do some automatic folder creations based on some rules (for mail management for example) and that would have in some case (someone named con in my example) an abnormal behavior of the system that would be pretty difficult to diagnose. One could even blame some software for the problem while it is only MS fault of doing that.
Now that I think about it, maybe it is the real reason why they bloated exchange with a database, because the folder creation for accounts would have been bugged by design in the OS...

Re:Article doesn't say enough...

[BVis]

A "cloaked" system folder that can be made visible in Folder Options is different from a directory created by a rootkit-like piece of software. By definition, a rootkit patches the OS it's compromised so that the operating system itself cannot see the directories. It sounds to me like Symantec's actions here are very similar to what Sony BMG got in all that hot water for.

Odd thing is, it was pretty widely known that some anti-virus programs have rootkit-like properties; i.e. they hide directories from the OS. Ostensibly, this is to prevent malware from accessing the directories and compromising the anti-virus. Not saying it's right, just saying this shouldn't be a big shock.

Re:Article doesn't say enough...

[Anonymous Coward]

So? You can't make a dir named 'lpt1' either. Big deal. It's not an MS spyware-hiding conspiracy.

Re:Article doesn't say enough...

[Anonymous Coward]

I never implied it was a conspiracy, just stupid design. Beside my point was rather to know why "con" was not allowed.
I can understand the meaning of lpt1, but con, I was wondering if it was related to the parent point about volume information folder or not...
Since you are knowledgeable, can you explain why "con" is not a valid folder name?

Re:Article doesn't say enough...

[Anonymous Coward]

http://blogs.msdn.com/oldnewthing/archive/2003/10/ 22/55388.aspx

Re:Article doesn't say enough...

[path_man]

I can tell you why 'con' is not allowed. It is a device name reserved for legacy DOS stuff. Do this at a command prompt:

1.) copy con test.txt

2.) type random text you want inserted into test.txt HERE

3.) Ctrl-Z

You now have a file with the contents of what you just typed. And now for my next trick, I'll make the DOS cursor a flashing smiley-face! *bows and leaves the stage*

Re:Article doesn't say enough...

[vadim_t]

It's another device name. "CON" stands for "console".

For instance, open cmd.exe, and type:

copy con test.txt
type some text, press
^Z (Ctrl+Z)

This is the DOS/Windows equivalent to cat > test.txt. Reading from CON reads from the standard input, writing writes to the standard output.

Re:Article doesn't say enough...

[DnemoniX]

This is what I would like to know. But the article doesn't say this at all. It simply reffers to a "cloaked" folder.

Re:Article doesn't say enough...

[Andrewkov]

con is short for console, in case the parent didn't explain that in enough detail. And you can read from the console using the method described above since the early DOS days.

Reminds me of an old joke: Real men program by typing copy con: myprogram.exe

Re:Article doesn't say enough...

[blake3737]

this is slashdot... DON"T EVER MENTION THE WORD DIG.. even if it only has one G

Re:Article doesn't say enough...

[Reziac]

[laughing] Okay, how DO you make the DOS cursor into a flashing smiley face?

That would be just too damn funny :)

Re:Article doesn't say enough...

[Anonymous Coward]

Forever in windows you cannot create file or folder names that are reserved for device driver names. It is mostly legacy now, but still the case...

I always knew...

[Chaos1]

I always knew that Norton guy was shady. Just look at the smug picture on the back of his books and other products. Plus he went and trademarked his name.

It's hard to uninstall Symantec software

[tkrotchko]

I remember a couple years ago when I still bought and used Norton/Symantec anti-virus; it kept claiming my subscription ran out and wouldn't update the definitions. So I uninstalled and reinstalled. Same problem. After doing some searching, I realized it had installed itself all over the registry and wouldn't get out. It took a good 2 hours of hand-editing to remove all traces of Symantec from my registry.

So much for "uninstall".

Which is why I never use their stuff anymore. Truth be told, I don't think they've done anything good since. Well. Since Peter Norton still loosened his tie and programmed for a living.

I can't think of any software of theirs that I would consider putting on a system, so I can't say I'm surprised by stuff like this.

What prevents

[Anonymous Coward]

malware authors from simply creating their own "cloaked" directory? Why is it that they must use one already created by a piece of legitimate software?

I don't get it.

Not quite the same...Trigger Words.

[Anonymous Coward]

"Also, also, you need to give them a bit of credit for the fact that they worked with Mark Russinovich of Sysinternals and F-Secure in fixing this. Nobody needed to make a huge stink about the problem like the last big rootkit issue"

"Rootkit" is to geeks, what "terrorists" is to the common man.

--
BTW What's wrong with "/." today? Someone put in the wrong CSS file?

I don't trust their intentions

[m50d]

Given the way Norton will not uninstall without downloading a separate removal tool (and the fact they've known about this for five years but continue to ship versions that won't uninstall) I have zero confidence in Symantec having had good intentions with this.

Re:I don't trust their intentions

[Anonymous Coward]

They don't make money by helping people -uninstall- their products. Quite the opposite.

Re:I don't trust their intentions

[jim_v2000]

Given the way Norton will not uninstall without downloading a separate removal tool (and the fact they've known about this for five years but continue to ship versions that won't uninstall)

Give me a break, I uninstall Norton Antivirus all the time. The only time it doesn't uninstall is when someone has gone in and tried to delete files related to it, or if the Windows MSI is hosed anyway. (Trust me, I supported the product for a long time...till it went to India)

99% off "problems" people have with Norton are directly related to part of their OS being broken, like MSI, IE, scripting, DCOM, etc etc.

I have zero confidence in Symantec having had good intentions with this.

Man, take off the tin foil hat. Software companies don't make money with malevolent intent. It is good software when used by the people it was meant for. Norton products aren't for power users, they're for home users.

Re:I don't trust their intentions

[TheHawke]

The uninstall software that Symantec uses hinges on the fact that the software is intact and was functioning. If the AV or any other feature breaks, then the uninstaller is questionable at best, a system-breaker at worst. This is why I keep a copy of the cleaners on my flash drive if I run across an AV that got compromised because the dummy behind the keyboard didn't know a single thing about updating and maintenance. And a copy of the free version of Avast! Antivirus too.

Re:I don't trust their intentions

[glesga_kiss]

The only time it doesn't uninstall is when someone has gone in and tried to delete files related to it

Just as well you didn't say that last week, when I was fixing my box after removing Norton. Lot's of blue screens and other such crap started the moment I uninstalled it. Had to remove so much junk by hand, unfortunately I didn't know about the cleaner. There is clearly a problem here; if there wasn't why would they spend resource producing and maintaining a repair product?

99% off "problems" people have with Norton are directly related to part of their OS being broken, like MSI, IE, scripting, DCOM, etc etc.

Yup, because Nortons uninstall caused these problems. I was very close to reimaging, but I had too much setup I didn't want to repeat.

Norton products aren't for power users, they're for home users.

Then why did I need "power user" knowledge in order to perform the simple task of removal? IMHO Norton is for corporate environments where the end user cannot be trusted.

Where was that place?

[Evil Closet Monkey]

Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole.

I was getting directions to someplace the other day, the guy said the road there was paved with "good intentions". Damn, I can't remember the name of the place... think, think...

Re:Where was that place?

[Reziac]

I've seen that road. Guess what... there ain't no pavement. It's a dirt road...!!

Why is this a "rootkit"?

[Keyslapper]

I may have missed something, but I saw nothing whatsoever in the article that sends information or provides external access without the users knowledge.

Isn't that what a rootkit does - allow unauthorized access?

Of course, it's hiding a directory, but as mentioned by other posters, Symantec has never been very secretive about that, they just didn't come out and announce in big flashing red letters that they were creating a hidden directory. Not a lie at all, as was the case with Sony.

Now, apparently there are a few folks here that seem to consider Symantec only a couple notches away from M$ on the slimeball ladder, but the fact is they write software that attempts to protect computers (typically from the gifts M$ has bestowed on the world). Personally, I only use their antivirus SW, since Windows does just fine bogging the one machine I run it on without any unnecessary help. To date, I have had far fewer issues with Windows machines using Norton Antivirus than those without it. In fact, it seems to me Norton AV is as important for Windows machines as a network connection.

Not that this isn't something to be aware of, but at best this is a potential security hole, not a rootkit. While I don't want anyone "hiding" stuff on my system, I know very well there are users out there that can be easily convinced to delete important system files - or doesn't anyone remember the SULFNBK virus?

Re:Why is this a "rootkit"?

[99BottlesOfBeerInMyF]

Isn't that what a rootkit does - allow unauthorized access?

The terminology being used is confusing to many people. In common parlance a rootkit is a general purpose setup to compromise a system and hide all evidence of that compromise. Usually this includes a "kernel" patch that hides the offending files and in some cases network traffic. Symantec is patching the "kernel" to hide files, and doing so is wholly unnecessary. My guess is were not concerned about users so much as malware/worms that would automatically cripple their program. The side affect of this is worms can actually exploit this to hide themselves. It seems like a risky and invasive attempt at security through obscurity.

A big part of the problem is that they are trying to secure an inherently insecure system, without having access to the source code. Windows users are generally admin (since Windows is pretty unusable as a regular user) and local privilege escalations are common and trivial. I don't think MS even tries to fix them anymore. As a result Symantec is basically in an arms race on even footing with malware authors.

While I don't want anyone "hiding" stuff on my system, I know very well there are users out there that can be easily convinced to delete important system files...

That is part of the danger of using Windows. Clueless users have unfettered access to delete vital parts of the system and rightly believe worms and viruses can easily infect their poorly secured machines. Still, Symantec should have known this was unworkable in the long term and would result in a persistent liability.

Re:Why is this a "rootkit"?

[Hosiah]

I always explained a rootkit thusly: Imagine if I secretly replaced all the locks on your house with special locks that open just by turning them without any key. Now, nobody needs a key in order to rob your house, nor do they have to break anything to leave evidence. I didn't *take* anything, mind you, but all security is defeated so that anybody who wants to will find it wide open. That's what a rootkit does to your computer. Generally, if you want to crack security on box "X" and you discover a rootkit on it, your day is made easier!

Re:Why is this a "rootkit"?

[Keyslapper]

And that would be a very good explaination of a rootkit. But that's not how I understood the Symantec hidden directory issue.

Symantec has not changed the locks on your door. The Sony DRM did.

The best you could equate the hidden directory is as follows:

Say I somehow gain access to your house, and instead of changing all the locks, I build a new room, but put it behind a secret door. Now, I don't have access to this room from outside your house, but while I'm in your house, I can hide stuff there. That's what Symantec is doing. Sure it's a potential security flaw if someone else finds out how to get into the room and hides a bomb, but otherwise, it's not a real problem.

Now, I'm not saying this was ok for Symantec to do, but this is certainly not a rootkit. If I install a rootkit, that's all I need to gain access to that machine any time it is online. That's clearly not what Symantec has done.

Why was this such a big fiasco with Sony? Because they were able to gain access to information on your computer, and hid their installation in a cloaked directory. The cloaked directory was clearly the lesser of two bad moves by Sony.

Re:Why is this a "rootkit"?

[Anonymous Coward]

Windows users are generally admin (since Windows is pretty unusable as a regular user) and local privilege escalations are common and trivial.
Clueless users have unfettered access to delete vital parts of the system and rightly believe worms and viruses can easily infect their poorly secured machines.

These are the two biggest problems I see with windows. (1) A non-admin user is pretty useless. And (2) why is it that a malware author can protect a blasted *.dll to the point that I have to boot the machine with a Linux disk to remove the dll, yet any bozo that sits down at the keyboard can blow away enough system files to make the computer totally unusable without a full recovery?

Re:Why is this a "rootkit"?

[Hosiah]

Well, if that's *all* it is is a hidden folder, it seems kind of ludicrous that there'd be any fuss at all. All operating systems have the concept of hidden files and folders where the system keeps important stuff. On Linux, that's a filename beginning with a dot (even called a "dotfile"), so "ls -a" in your home directory would show a .kde folder where all your desktop preferences are kept. Back on Windows it seemed half the system folders had the "hidden" and "archive" boxes checked in the properties dialog (if you ever got to see it, that is!). Sure enough, I remember all kinds of malware using tricks with this to hide itself on Windows boxes. Files and folders not shown in the normal course of operation so they can't be inadvertedly damaged is as old as OS/2 warp, at least.

Re:Why is this a "rootkit"?

[Keyslapper]

Well, I actually have a better understanding of the *nix world than I do the Windows world, but I got the impression that this hidden directory feature was different.

You have a basic hidden directory in Windows, but you can still tell your explorer window to show them. If I understand this issue correctly, and it's possible I don't, the problem is that Symantec (and Sony) actually installed a kernel patch that filters the given directory out altogether - meaning you can't even see it as a hidden directory.

I've never been a kernel devleoper (client/server development on Solaris, 8 years, Windows dev 4 months now), but I don't think 'cloaking' a directory is so easy in *nix, and certainly not without root privileges, which even a newbie doesn't use on a regular basis. In Windows, as a previous post pointed out, you can't do anything without admin. My 6 year old daughter is an admin, because XP Pro won't even let you print to a bloody network printer without admin privileges (8 hours on the phone with Sanjii in New Dehli proved that).

Now, there are a couple reasons this isn't as bad with Symantec as it was with Sony.

Sony installed this kernel patch without your knowledge or consent - even if you refused to accept the EULA - wich made no mention of the software's true behavior, it was installed. So, you indicate you don't want anything installed, but you get it anyway.

Symantec included it as part of a software package that the user had to explicitly want installed before the patch would be added to the kernel. I read somewhere (previous post) that Symantec was never secretive about this patch either, whereas Sony tried to outright deny it in the beginning.

So, mistrust Symantec if it pleases you, but IMO, there are much worse fish in cyberspace to focus on.
Sony for one.
Microsoft mostly just gets a bad rap, sometimes they deserve the abuse, but they did build their reputation back in the day.
I'm sure there are plenty more. Symantec is still a small fish, and I'm not sure it's even carnivorous.

Re:It's hard to uninstall Symantec software

[NVP_Radical_Dreamer]

Not to take up for symantec, but they do offere a free utility for removing all traces of their software. They have one for each piece of software as far as I know.

http://service1.symantec.com/SUPPORT/nav.nsf/docid /2001092114452606

Re:It's hard to uninstall Symantec software

[remmelt]

Ghost has saved my life so often that I seriously love that tool. Apart from that, you're right.

I just found out that Sygate has been acquired by Symantec and they discontinued the free for home use firewall.... Bummed!

Symantec has never even made anything, they just buy the competition.

Tax dollars are going where???

[dwayner79]

Good thing the DHS is giving them a grant

Re:Tax dollars are going where???

[dwayner79]

http://it.slashdot.org/article.pl?sid=06/01/11/061 232

Re:It's hard to uninstall Symantec software

[mahdi13]

I can't think of any software of theirs that I would consider putting on a system, so I can't say I'm surprised by stuff like this.

Ghost, that is the only product of thiers I can think of that is even remotely worth getting. Even though the need to install it to make a boot disk seems a bit strange...

But if I ever have a need to image a disk I'd recommend Knoppix and use partimage if you have the capacity to read simple instructions and learn without pictures...otherwise I tell the lamaas to spend the $70 on Ghost (or whatever it is these days)

But Ghost is great if you have to roll out 20+ machines on a network, I've also used it to make a bootable CD that contains the image...but for someone that needs it once or twice, it's a waste of money

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[xtracto]

Although you are an anonymous troll I think you are somewhat right:

The actual real (for the end user) problem I see for Windows, that other OSS do not have is that you require to install certain "security" software after installing the O.S. The software is among others:
- Antivirus (Like McAffee or Norton or AVG or Sophos)
- System security programs: Kind of like Norton System works or SANDRA or Diskkeeper
- Another browser (like firefox or opera)

The bad thing about that is not the number of software programs you have installed but the number of programs that must stay RESIDENT on RAM from the beginning.

That slows PC a lot, and it is something that (at least in my experience) you do not need to do when using Linux.

As an example, my current machine has the Sweepsrv.sys (Sophos AV) with 25,796 private Bytes. Then I have Firefox with 141,188 Bytes and on my laptop I have AVG free version and perfectdisk monitor.

Sure, I know how to disable all those things but that is one of me most common problems why people have to reinstall windows after several months.

On Linux you dont need a running antivirus so that memory (and processing time) can be used for something better. Oh, and it is also annoying that if you are Moving large files, you have to wait after selecting and pressing CTRL+X to cut it and CTRL+V to paste it on another side because the antivirus is checking the file.

Re:It's hard to uninstall Symantec software

[tkrotchko]

I know they have that now, but they didn't at the time.

Worse, I don't trust Symantec to really remove their software. Why doesn't uninstall remove the software? Why do I need to uninstall then run "really uninstall" to really uninstall it?

Re:It's hard to uninstall Symantec software

[ArtfulDodger75]

The current Ghost products are simply rebadged products they gained through their purchase of PowerQuest. Ghost was dying a slow drawn out death until this move. I was very bummed when I heard the news, since I respected PowerQuest and I'm familar with Symantec's strategy of just buying out the competitors and then letting the new software acquisitions die a horrible death by not continuing to develop them. Look at WinFax - Dead. Look at Act! - I think they sold it off after killing it through neglect. Look at pcanywhere - going absolutley nowhere. Now they have Veritas in their pocket, and I have no doubt I'll be forced to use alternative products once Symantec have done their work with BackupExec. Oh, I'll also add that North Internet Security is the biggest load of horse crap I've ever seen. I can configure enterprise level firewalls and security products with ease, and yet I find NIS difficult to use, unintuitive, inconsistant, contradictory, a huge resource hog, and sometimes difficult to remove. I have a pet hate against it and I won't bother trying to help anyone using it unless they agree to unistall it. Symantec sucks.

There are better things to hyperventilate about.

[Saeed al-Sahaf]

Mikko Hypponen, director of anti-virus research at the F-Secure Corp., said his company's BlackLight Rootkit Elimination Technology also detected the NProtect directory, which was hidden from the Windows FindFirst/FindNext APIs. "We found out about this when we shipped the first BlackLight beta in March 2005 and started getting reports back from users. Then we tested it in our own labs and confirmed the functionality in Symantec. It's not a huge problem, but I'm glad they've now fixed it," Hypponen said in an interview.

Non-issue. There are better things to hyperventilate about. Move on...

Re:It's hard to uninstall Symantec software

[XorNand]

Try Acronis True Image and leave the dark side behind entirely. ;-) It's definately better than Ghost.

Re:It's hard to uninstall Symantec software

[ArtfulDodger75]

Agreed. Acronis was the best alternative to PowerQuest when they were eaten by Symantec, and now in my opinion they're the ones at the forefront of disk imaging software.

Re:It's hard to uninstall Symantec software

[mahdi13]

Thanks! I WILL have to keep Acronis in mind, looks good and is cheaper (less expensive) then Symantec...now to teach people that brand names mean nothing :)

Article does say enough

[Anonymous Coward]

Snip
---
Mikko Hypponen, director of anti-virus research at the F-Secure Corp., said his company's BlackLight Rootkit Elimination Technology also detected the NProtect directory, which was hidden from the Windows FindFirst/FindNext APIs.
---

So yes, it does hook windows functions

Full control?

[Anonymous Coward]

From the fine article:
"When you use rootkit-type techniques, even if your intentions are good, the user no longer has full control of the machine. It's impossible to manage the security and health of that system if the owner is not in control."

Full control of the machine? As far as I know, in Windows you don't have full control of the machine.

Re:It's hard to uninstall Symantec software

[kebes]

I love Ghost too... it's a lifesaver. However it can get expensive if you need many copies. You should also consider using the (obviously free) linux partimage which can do the same things. In fact, it can make images of a greater variety of filesystem types (at least compared to the last version of Ghost I used). Even if you're running Windows boxes, you can still boot off of a Linux LiveCD, and use partimage to backup/restore partitions (in fact, there is a Linux LiveCD specifically optimized for rescuing your PC: System Rescue CD, which includes partimage).

You don't tell me that you mean...

[Hurricane78]

...the norton recycle bin extension?

I know that nowadays norton products are mostly crap with near-to-none options, and all non-basic funtionality removed successively in every version, but this recycle bin extension comes from the good days and already saved my ass may times. (every time i typed something like Ctrl-N, Ctrl-S, Enter, and overwrote my just finished huge file with an EMPTY file.)

The direcory it used was not cloakrd in any other way than setting it to "hidden". I don't know if that changed in very recent versions (haven'T RTFA), but last time i used it (system works 2005) i could simply go into the directory and look what's inside it.

So maybe this is a common bug of virus scanners...

I even implemented something like this for my samba-shares. srue someone will come up with the "well, maybe it's a PEBCAK"-argument. but don't tell me you never did such an error and then whished to have the data back?

Re:You don't tell me that you mean...

[Hosiah]

but don't tell me you never did such an error and then whished to have the data back?

OK, so I'm a freak of nature. But, no, I've never never never never in my entire life ever deleted anything that I wasn't 999999% positively absolutely sure that I never wanted to see again under any circumstances. But I have (true story) physically beat a piece of hardware to death with my bare hands when it wouldn't stop asking me "ARE YOU SURE?" at every single individual keystroke and mouseclick.

Perhaps it's because I learned computers during an age when you asked for it and you got it right away, and the first assumption didn't always default to "User is randomly drooling into keyboard and shorting it out." At least on some operating systems, you have the possibility to turn confirmations off, and are then at least given the *chance* to actually have a system do what you tell it to do, just as if you knew what you were doing. And thankfully, I have found and now run exclusively those.

Re:You don't tell me that you mean...

[Hurricane78]

> But, no, I've never never never never in my entire life ever deleted anything that I wasn't 999999% positively absolutely sure that I never wanted to see again under any circumstances.

Let me guess... you're a messie... right? ;)))

> But I have (true story) physically beat a piece of hardware to death with my bare hands when it wouldn't stop asking me "ARE YOU SURE?" at every single individual keystroke and mouseclick.

ARE YOU SURE? Because I don't believe this. ;))

Re:What about RAR files?

[HTH NE1]

That's great Symantec. But when are you going to fix this other flaw that affects RAR files?

Indeed, I'm puzzled why we haven't heard anything more about that problem beyond the initial report. It has been nearly three weeks.

Just to note

[Anonymous Coward]

The symantec web site report on this states that it only affects 2005 and 2006, but I am running 2003 and it is also affected! The update fixes (supposedly) the issue. Nprotect can now be seen in the RECYCLED directory.

Info can be found here:

http://securityresponse.symantec.com/avcenter/secu rity/Content/2006.01.10.html

Yet another feature . . .

[denverradiosucks]

Another feature added to the already bloated Norton family of software. Is it just me, or is Norton making themselves more and more useless every time they release a new version of there software?

Symantec were trying to benefit the user...

[blorg]

...of the computer by providing a safer "Recycle Bin" to protect their files better (e.g. more difficult to accidentally delete, or indeed for other software to delete). The Norton Recycle Bin also protects for example files deleted from a network share, which the standard Windows one doesn't (although this is a seperate issue.)

Sony's rootkit offered no benefit to the user, only to Sony.

Disclaimer: I don't and wouldn't run Norton, it's a massive hog and really gets into the depths of your system, the point is just that their intention is not so bad here.

Re:It's hard to uninstall Symantec software

[glesga_kiss]

Just last week I had a hell of a time removing Norton AV after it expired. The MSI installer registry was not cleaned out and the PC thought it had extra applications the the Symantec installer had removed. NOTHING else would install that used the MSI mechanism; the installer would hang every time.

After spending days cleaning out obscure HEX GUIDs from the registry, it still didn't work. In the end my googling for the GUIDs they'd used unearthed a registry file that appeared to remove every Symantec entry from the registry that's I'd found. More importantly, it had some additional obscure ones I would never have found. Things who's key values made me think WTF? This is my AV software?

Backed up the registry, ran the strange clean.reg I found on the net (what harm could it do... ;-) and all seems well now. Symantec stuff seems to install itself using techniques similar to a nail bomb.

How to get unlimited free subscription

[jambarama]

When you install Symantec (works with McAfee too I've been told) just set the system clock forward a few years. If it installs in 2010, but then finds itself in 2006, it'll think you have a 4 year subscription. I did this when I was still in the 'give me free stuff script kiddie' mode a few years back. A friend of mine just did it and confirmed that it still works. I switched to Debian and haven't had a problem with ClamAV.

Silly Symantec, not getting a real date online.

Self security

[grubbymitts]

I bought a new compaq a few months ago and removed Norton AV (so I believe) from it as I wanted to go as freeware as I could. I'm not a noob when it comes to PCs and the net, and it always annoys me when I read about how these security holes are going to open up your pc to all manners of naughty trojans and stuff.

Let's face it - 99% of these infections come from stupid users who don't have a firewall/av protection in the first place (a trojan still has to come in somehow and a good firewall and AV should be able to stop it/grab it as it comes in piggybacking on whatever). The same users are the people who click on any attachment in an email whether or not they trust the sender, visit porn websites or warez/mp3 sites, download Smilie Central type things because they look "cute", still use unpatched pcs and IE with no pop up blockers/spyware stoppers...well, you know the deal.

Christ alone only knows if I have this vulnerability, but you could drive yourself crazy worrying over every security hole that appears. Just use the net wisely and you should be fine.

Re:It's hard to uninstall Symantec software

[Solosoft]

The problem im having with finding a linux backup tool (somthing like ghost which makes nice convienent images and you just click to restore) is that none of them tend to support my RAID-0 (software) array. Would anyone know of a nice convienent way to backup a complete image for my array. Im running 2 old HDD's linked together cause im too cheap to buy one big one and since the nature of RAID-0 I wouldn't mind somthing that could be clicky clicky fixed.

I googled it up but all the apps didn't like my raid array maybe you guys know a way.

It's a Dual Pentium Pro 200MHz with 192mb EDO RAM running Debian Linux

:)

Not very surprising

[Kristoffer Lunden]

They have gaping holes in their firewall, so why not in more products?

Explanation: a fresh install of Windows XP on my father machine, SP1 because that was the CD that came with the machine, then an install of the Norton firewall that also came with the purchase - firewall set on as paranoid as the settings allowed... plug in network, and bam! Instant infection. There aren't any settings in the stupid product for "block everything" or anything either, just security levels or whatever it was. In any case, highest whatever apparently still left ports open... impressive.

The reinstall was because their firewall and antivirus had already failed to protect the computer btw. Why anyone would use thir products is way beyond comprehension. It's utter crap.

systemworks is not a rootkit

[Truekaiser]

it doesn't completly hide it from the user by subverting the windows kernel like the sony root kit.
all it does is create a normal hidden directory on the root of every rive you have called 'RECYCLER' in which it place a copy of the rycleling bin.
if you don't like that it hides the directory from you then just go to.
Tools --> Folder options --> 'view' tab --> and checkmark 'display contents of system folders'
Uncheck 'hide protected operating system files'
select the radial button for 'show hidden files and folders'

if this was a rootkit you would not be able to see it even after this.

Re:systemworks is not a rootkit

[grubbymitts]

Isn't RECYCLER just the name of your recycle bin directory? The directory the article refers to is called NProtect that lies within this directory and could cause troubles. If you rename RECYCLER to anything, Windows will automatically make a new RECYCLER directory.

Re:systemworks is not a rootkit

[cqnn]

I think you are mistaken
RECYCLER is the standard recycle bin created by Windows on NTFS partitions. <b>
  It is set to hidden and system attributes by default.

Re:systemworks is not a rootkit

[cqnn]

I think you are mistaken.

RECYCLER is the standard recycle bin created by Windows on NTFS partitions.
  It is set to hidden and system attributes by default.

  Systemworks may utilize it as a starting point for its own stealth directory,
but what you describe has nothing to do with what Norton installs of changes
on your machine (You need to look for nprotect).

catch 22

[Anonymous Coward]

It is supremely aggravating that I have to let users run on a machine Administrator level to run half of their software

...

Invitations to switch OSs will be summarily ignored. You have been warned.

Are the applications you require unavailiable? How will that situation ever get better if you ignore any advice involving alternate OS's? Do you enjoy living in denial?

Re:catch 22

[Anonymous Coward]

Are the applications you require unavailiable? How will that situation ever get better if you ignore any advice involving alternate OS's? Do you enjoy living in denial?

Yes.
The situation does not get better if I have to retrain users on a new OS, new applications, and deal with the fact that the rest of the world uses Windows and the old applications, just to overcome a problem that I can reasonably mitigate with NProtect and Norton Ghost.

It is not denial, it is optimization. I chose to use a shotgun to defend myself from the wolf, not a nuclear bomb to obliterate the wolf's habitat.

Re:What about RAR files?

[Baunker]

What about it? http://www.symantec.com/avcenter/security/Content/ 2005.12.21b.html

The road to hell is paved with good intentions...

[schlumff]

... and some rootkits.

Symantec's Norton Removal Tool

[Rodness]

I've used this a lot lately when upgrading NAV, this is a removal tool which will nuke all traces of many Norton programs off a computer. Not as useful if you have, say, NAV and Ghost and just want to remove NAV, but if you only have NAV, this works for different versions. (As my family all uses NAV, but everyone always seems to have a different version, sticking this on my usb drive has been invaluable.)

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2005033108162039?Open&src=&docid=2001092114 452606&nsf=nav.nsf&view=docid&dtype=&prod=&ver=&os v=&osv_lvl=&seg=

The SymNRT.exe remover will remove ALL installs of:
        * Norton AntiVirus 2004/2005/2006
        * Norton AntiVirus Professional 2004
        * Norton AntiVirus 3, 5 and 10 User Pack 2004/2005/2006
        * Norton GoBack 3.1/3.5/3.6/4.0/4.1
        * Norton SystemWorks 2004 Professional Edition
        * Norton SystemWorks 2005/2006 Premier
        * Norton SystemWorks 2004/2005/2006
        * Norton SystemWorks 2006 Basic Edition
        * Norton Password Manager 2004
        * Norton Internet Security 2004/2005/2006
        * Norton Internet Security 5 and 10 User Pack 2004/2005/2006
        * Norton Internet Security 2005 AntiSpyware Edition 8.2
        * Norton Personal Firewall 2004/2005/2006
        * Norton AntiSpam 2004/2005
        * Norton Ghost 2003/9.0/10.0

Re:It's hard to uninstall Symantec software

[pilkul]

I can't think of any software of theirs that I would consider putting on a system, so I can't say I'm surprised by stuff like this.

Exactly. I'm not too sure at which point their software became counterproductive trash, but lately on every system I've seen it on it seems to do more harm than good. I've lately seen a lot of XP computers with quite a lot of power and RAM which are slowed to an absolute crawl (as in, takes 5 minutes of thrashing to start IE), and the common thread is that they all seem to run Symantec anti-virus software. Now I'm not sure if it's because they're infested with malware and Symantec completely failed to offer any protection, or if actually Symantec itself is directly causing the problem with all its hooks into system functions, but at any rate I would never install that crap.

Re:It's hard to uninstall Symantec software

[linuxtelephony]

I don't know if there is a relationship or not, but when the company was known as Norton (for Peter Norton), they had good products. When they transitioned to Symantec they seemed to make whatever they touched worse.

Norton's utilities were great, tiny, fast little tools that did what you wanted in a predictable way. A must have in the DOS days, and even early Window days. As Symantec the tools seemed to get more and more bloated. Then some of the tools had to be bought separately, costing more money. They took over PC Anywhere at some point, and made the tool so large that it was all but impossible to load into some DOS based systems (with plenty of RAM) and still be able to run the rest of the system properly. They took over WinFax and took out some of the best features and seemed to make it more prone to failures.

It's a pattern of theirs. And a great disappointment. And why I, also, no longer buy or use anything from them. First thing I do on new equipment that has their software is uninstall it. Same thing I tell others.

WHAT ABOUT SYSTEM VOLUME INFORMATION FOLDER? apk

[Anonymous Coward]

Hmmm, IS Dr. Russinovich absolutely right on this?

I.E. -> YES, The mechanism for hiding the rootkit's files from detection are there because of how the folder is "hidden from view" from antivirus programs (specifically/only Symantec's, or is it others' too? I haven't read the article in its entirety yet, so I must ask here now (on lunchbreak & in a hurry))...

BUT, it's not a rootkit in & OF itself.

Now, something to think about, provided I am not 'off' here on the mechanisms employed (their NOT quite the same here, but still imo, would possibly allow files of this type to escape detection by programs run under a current user's security context in memory, & even if a local system admin usergroup member, typically? They're not allowed access to the folder I mention next)...

So, to hide rootkit files (on disk, not in memory or by altering a key/critical system file/service memory image while loaded OR on disk prior to its loading/being called by the OS or other progs)... ??

Well - What about the "System Volume Information" folder on YOUR drives, that Windows itself makes & ONLY the "SYSTEM" userentity SID for your OS has rights to it, via NTFS & being hidden, by default!

(By default, iirc, not only is it hidden from view, but NTFS filesystem security ONLY allows the SYSTEM entity SID ingress/entry to that folder... wouldn't that ALSO be considered such a risk?) :(

* I hope not on that last account - because if it is, then MS is just as "guilty" as Symantec/Norton here!

APK

P.S.=> PLUS, I do NOT like giving the "Pro-Linux Penguins" here ammunition to shoot @ Microsoft with, period...

I see TOO MUCH of that here @ slashdot, but other than that, it's a GREAT website for news/info. on things computing & sciences...

HOWEVER, on the 'flip-side'?

That type of argument/controversy/conflict (Windows vs. Linux stuff)?

Heh, It's GREAT for the webmasters/owners here, because it gets them pageviews/hits! apk

Cloaked Directory = Windows Registry

[pahoran]

"The cloaked directory is intended to prevent users from accidentally deleting important files, but could compromise a system by serving as a hiding place for malware..."

Is it just me, or does that sound like the Windows Registry?

If you want a detector

[Sycraft-fu]

Go get Rootkit Revealer (http://www.sysinternals.com/Utilities/RootkitReve aler.html). That's the one that was used to find this rootkit and the Sony one. The guy who writes it, Mark Russonivich, is quite good at this kind of thing. HE wrote the book, literally, on Windows (Windows Internals).

Re:If you want a detector

[Q-Cat5]

A casual 2 minute browse of that site (meaning rootkit.com) revealed 2 exploits that can hide from RootkitRevealer. One hopes that Russinovich and others are paying attention to these exploits and coming up with ways to counter them.

Re:WHAT ABOUT SYSTEM VOLUME INFORMATION FOLDER? ap

[Anonymous Coward]

EDIT OF MY FIRST REPLY (quoted above dotted line below for quick-reference), WITH ADDED POINTS (after reading the article) BELOW THE DOTTED LINE BELOW:

"Hmmm, IS Dr. Russinovich absolutely right on this?

I.E. -> YES, The mechanism for hiding the rootkit's files from detection are there because of how the folder is "hidden from view" from antivirus programs (specifically/only Symantec's, or is it others' too? I haven't read the article in its entirety yet, so I must ask here now (on lunchbreak & in a hurry))...

BUT, it's not a rootkit in & OF itself.

Now, something to think about, provided I am not 'off' here on the mechanisms employed (they're NOT the same here from this idea of mine vs. what M.R. of SysInternals found & used as his bloodhound/detection technique flag to look for, but still imo, would possibly allow files of this type to escape detection by programs run under a current user's security context in memory, & even if a local system admin usergroup member, typically? They're not allowed access to the folder I mention next)...

So, to hide rootkit files (on disk, not in memory or by altering a key/critical system file/service memory image while loaded OR on disk prior to its loading/being called by the OS or other progs)... ??

Well - What about the "System Volume Information" folder on YOUR drives, that Windows itself makes & ONLY the "SYSTEM" userentity SID for your OS has rights to it, via NTFS & being hidden, by default!

(By default, iirc, not only is it hidden from view, but NTFS filesystem security ONLY allows the SYSTEM entity SID ingress/entry to that folder... wouldn't that ALSO be considered such a risk?) :(

* I hope not on that last account - because if it is, then MS is just as "guilty" as Symantec/Norton here!

APK

P.S.=> PLUS, I do NOT like giving the "Pro-Linux Penguins" here ammunition to shoot @ Microsoft with, period...

I see TOO MUCH of that here @ slashdot, but other than that, it's a GREAT website for news/info. on things computing & sciences...

HOWEVER, on the 'flip-side'?

That type of argument/controversy/conflict (Windows vs. Linux stuff)?

Heh, It's GREAT for the webmasters/owners here, because it gets them pageviews/hits! apk" - by Anonymous Coward on Thursday January 12, @01:03PM

==========

ADDENDUM TO THE ABOVE (my original post reply to this topic):

I see I was a 'bit off' on how its hidden from the Win32 API & thus, ALL programs that leverage it (& not the NtNative API which operates console mode apps @ system bootstrap for instance & iirc, but if you put a rootkit to work on programs that run here, to 'instance' your rootkit/virus/malware to me, this = problem - the patching of OS system files for instance, or other often called dlls/libs or .exe files in Win32, once into the Explorer shell, could be done IN REALMODE/BOOTSTRAP EXECUTION TIME imo)!

They hide their folder, not via other mechanisms I mention above (NTFS rights/security) for the folder I mention above but via hiding from the Win32 API...

Also - AND, & how the Norton Protected Recycle Bin works, I was aware of but never thought of it as Mark Russinovich did - very GOOD on his part imo!

(Plus, iirc, as an "added note" on that account & how NProtect works? IIRC, Execsoft's Undelete/Recovery Bin works the same way also!)

However, please - DON'T QUOTE ME ON IT (again, I'm in a hurry here @ home from work on lunch replying now, & did a bit more reading from the article ala "RTFA")!

Anyhow!

Comments appreciated on my noting how "system volume information" folder works & is by default, a way of hiding rootkit files possibly also - since ONLY the SYSTEM entity SID (iirc) has rights to that folder on the root of ANY NTFS FORMATTED DISK you have, by default!

Could it also be used in that capacity, albeit via diff. means (NTFS security defaults)?

NTFS is great, but

Bullshit!

[Anonymous Coward]

Norton Protected Recycle Bin has always been a service that could be accessed by the owner of the machine. It's turned on by default, however it can be turned off with ease. I always turn it off as it's a memory hog. If I delete something it's because I want the god damned thing deleted. I don't want Microsoft, Symantec, State and Federal government or myself to bring the bitch back to life.

Symantec intentionally makes it hard to uninstall

[chiguy]

Why does Symantec require you to go download their 'real' uninstaller? Why doesn't the uninstaller do a full uninstall?

This is clearly not an accident. They obviously have the 'technology' to do a full uninstall. And yet they choose leave their refuse all over your computer.

What's their goal in making it hard to remove their crap?

Re:What about RAR files?

[slashslashdotdot]

I would recommend you actually READ your links.

From your linked page: Symantec Response Symantec is currently building, testing and distributing product updates for all supported affected products.

Their suggested workaround? Don't scan RAR files for viruses. Awesome!

Re:What about RAR files?

[slashslashdotdot]

Tsk tsk. Who modded itninja's post? Offtopic? Hmmmm...Symantec employee perhaps?

Trust is necessary...but it is earned?

[HiThere]

When the author comments that Symantech's intentions were honorable, he's making a statement that may or may not be true. He's trusting Symantech to not have intended to go beyond what he has detected.

This can only be trusted to be a true statement to the extent that you trust Symantech (and the author, of course). I remember a time when I was comfortable trusting not only their intentions, but also their skills and software. Then they totally destroyed a system of mine. Twice, separated by months. And it was basically unrecoverable, though many text files were recoverable. Well, it wasn't too important a system, I only used it for game playing. But it did lead me to be more skeptical about their technical skills. That, somehow, also lead to their being more skeptical about their honesty...partially because they never did admit that their software had caused the problem.

Well, someone was probably playing CYA while claiming to represent the company. There's no real evidence that the company as a whole is intentionally evil. But this does markedly decrease the amount of trust that I have in any action claimed to be an action of the company. That definitely includes hidden directories (though there's nothing particularly strange about hiding a directory...but not uninstalling it on request is something a bit beyond the average hidden directory).

It finally all comes down to trust. Do you trust that Symantech is being honest with you?

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[Bill Dog]

Anyone reading this site ought to be technical enough to be able to learn how to secure their system and understand the importance of practicing safe computing. I know that Windows doesn't need AV software and security monitoring software, and using IE all the time is fine, because that's how I run, and I've never caught anything. Norton et al are for people who don't know and don't want to know about security, who cannot resist anything offered to be installed to them for free, and who already have their machines so bogged down with and unstable from things like AOL software, consumer-grade HP printer drivers, etc., that they'd hardly notice the extra load.

Re:It's hard to uninstall Symantec software

[Anonymous Coward]

"It's a pattern of theirs. And a great disappointment. And why I, also, no longer buy or use anything from them. First thing I do on new equipment that has their software is uninstall it. Same thing I tell others."

The first thing I do, on new equipment that Norton software installed, is send it back for not following my instructions :-)

Grogan

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[Anonymous Coward]

Bill? Is that you?

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[Anonymous Coward]

I know that Windows doesn't need AV software and security monitoring software, and using IE all the time is fine, because that's how I run, and I've never caught anything.

Ah, the good old ostrich argument. Proven wrong many a time.

Re:HELP MY SHIFT KEY IS STUCK apk

[Anonymous Coward]

"Up my ass! Help, quick! apk" - by Anonymous Coward on Thursday January 12, @03:07PM

Well, as you see, judging from your being 'modded down' with that rude reply and pretending to me me posting?

YOU GOT YOURS FOR THAT!

(The mods doubtless can see your IP Address & such, so they KNOW it wasn't me posting that garbage... thus, you got your mod-down!)

* :)

(Above all - Man, if you don't have anything useful to say about my hypothesis/theory up there, then don't saying anything @ all... how about that, ok?)

Sheesh...

APK

Re:What about RAR files?

[Baunker]

And if you look at the table of affected products, you will see on the right-hand side a column called "Update To" that lists the version of the product that you can update to to fix the issue. So maybe it is you who should read.

Years ago

[Tekoneiric]

I ran into the Norton thing a few years ago. It was annoying. Took awhile to get rid of that folder.

Re:It's hard to uninstall Symantec software

[Hosiah]

Why do I need to uninstall then run "really uninstall" to really uninstall it?

Makes about as much sense as clicking "Yes, dammit, I'm sure!" when you want to delete this file, then it doesn't delete it, it sends it to the recycle bin so you have to chase it there and re-delete it and answer "Yes, dammit, I'm sure!" again, doesn't it?

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[Hosiah]

How many more vulnerabilities and malware will it take for you braindead Windows users to wake up? Aren't you tired of the endless viruses, trojans, and "rootkits"? Either you control your computer or Bill Gates does. It's one or the other, people. Windows is not safe, PERIOD.

No, people, this is not Flamebait that our good friend anonymous posted. Look past your precious pride for a minute: he is telling you that you have a right to demand BETTER for yourselves! Of course, so have a gazillion others...

*sigh* I don't wanna do this anymore: I'm bored.

Re:What about RAR files?

[slashslashdotdot]

Indeed you are correct. My blood sugar must be low or something. I being a real dick today.

Cloaking Device

[kill_-9]

The cloaked directory.......

And pray tell me where I can buy this "cloaking device"?
I need one for my starfighter :-)

Insightful?! The mods are on crack again.

[Anonymous Coward]

I've never much liked icecream, and this just adds more leaves to the tree.

C'mon then --- where's my "Insightful" mod??!?

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[werewolf1031]

How is that an ostrich argument? I do much the same as GP, with the exception of the ZoneAlarm firewall (love it, never going back to MS' built-in firewall), and I use Firefox not because it's safer -- the extra security's a nice bonus -- but because, IMO, it's simply much better than IE in terms of functionality and reliability. I don't run AV software because, as mostly everyone here knows, it bogs the system down to being nearly useless for anything beyond surfing and email (I play and program 3D games as hobbies, which AV software makes a frustrating experience). I don't catch spyware or viruses because, quite simply, I don't click every Shiny Widget(tm) that flashes before me. I've had this XP installation for nearly two years, and it's never been hosed. Yes, I download a lot of stuff (new LPB!), I simply think before I click.

Disclaimer: I'm not a MS apologist, I use Windows because that's where my apps of choice are at, and I'm familiar with XP so there's no learning curve for me. I have nothing against OSS (hello? Firefox?), nor any non-MS OS -- that's simply a matter of preference. I'm just saying that the OS is not (entirely) to blame when someone catches a new virus every five minutes; clearly, the user is doing something very wrong.

Just my two cents.

Re:$sys$Nothing 2 see here. Please move along.htm.

[Anonymous Coward]

Heh, my "confirm you're not a script" image is "sanity."

...and my last X-Bender header was "Aw, this bends!". Why the hell do people feel the need to share these things?

Re:Symantec intentionally makes it hard to uninsta

[netsharc]

This uninstaller probably deletes anything they know are related to them, whereas an Uninstaller for Symantec Product A would be careful enough to leave some things installed so that Symantec Product B doesn't get broken, in case you have Product B installed.

That's what you call dependency hell. :)

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[xtracto]

I'm just saying that the OS is not (entirely) to blame when someone catches a new virus every five minutes; clearly, the user is doing something very wrong.

The truth is, Microsoft Windows XP is responsible. First, Microsoft WinXP lets their users run with Administrator privileges, meaning that they, or any program they run (remember this) can corrupt the operating system.

Now, some people MAY run windows with non- administrator privileges but from my experience, you can not do too much without it.

Besides for that, because (I told you to remember) the user is running Internet Explorer as ADMINISTRATOR, it means any exploit makes the whole computer vurnerable (in contrast with say... FreeBSD where only the current user home gets compromised).

Now, you can tell me you do not "click" on untrusted links but if you know the WMF vulneravility or about the Jpeg buffer overrun, you just have to SEE the images (like... an add one of your so trusted pages) or open an email (or the preview in gmail) to be vulnerable.

And there is where the difference between a "secure by design" operating system against a "not secure by design" one strives, in FreeBSD the attacker could at most take control of the users ~/ data while on Microsoft Windows the attacker has control over all your computer.

So, that is why Antivirus, anti-malware, etc etc are there on Microsoft Windows.

Re: PETA-loving hippie

[Anonymous Coward]

"I have to let users run on a machine Administrator level to run half of their software"

Sorry, that's not dominion, that's life. They will use the computer, and there are too many common application that will not run correctly when the account is only running with user privileges. Palm, I'm giving you a particularly nasty look.

Meanwhile, learn to use capitalization, punctuation, complete sentences, and actual words. Your writing style screams "I'm a 14 year old loser".

Re: PETA-loving hippie

[DrSkwid]

content over style

I'd rather sound 14 than sound like someone who can't tick 'run with different credentials' on a few of his wife's desktop icons.

Re: PETA-loving hippie

[Anonymous Coward]

Secondary credentials are not the cure-all for this problem. Need I list all the posts describing why this is a poor hack? Plus, and this is the best flaw of all, the File/Open and File/Save dialogs in that application then run at the Administrator privilege, so that the 'protected' files can still be 'accidentally' deleted.

But thank you for that invaluable -- meaning, in this case, worthless -- advice.

Content over style. More like vacuousness in combination with ineptitude.

Re: PETA-loving hippie

[DrSkwid]

like I said

quit yer bitching

Re: PETA-loving hippie

[Anonymous Coward]

Slick, you relied to your own post to write quit your bitching. Does that mean that you intend to take your own advice?

I don't see hot it applies to me. The entire point of the original post was that the NProtect feature was flawed, but served a useful purpose. This was not bitching. Notably, you have yet to suggest anything that approaches the usefulness of the NProtect feature that wa removed to solve this rather common problem.

Re:WINDOWS IS IRRETRIEVABLY BROKEN

[werewolf1031]

You're right about the admin privileges, of course. It is damn near impossible to get any real work done in XP without admin or power user privs. However, 3rd-party software developers are (mostly) to blame for that sorry state. There are many, many rants all over /. about top-tier games (among many other apps) from major publishers that simply will not even install without admin rights, and that practice will only continue to make limited/restricted user access on XP all but pointless. While Microsoft have failed miserably to discourage this practice on the part of 3rd-party devs, those 3rd-party devs must also be held accountable for their software's requirements.

Of course IE is a gigantic security hole that should never have been tied into the OS itself. I never suggested otherwise. That is 100% Microsoft's fault. No argument there. (My recommendation to those who seem to get a lot of viruses is, as always, "use Firefox".)

Having said that...


The truth is, Microsoft Windows XP is responsible.

Again, not entirely. That's like saying that every time there's an automobile accident, it's the car's fault. Clearly that's not true. Barring a malfunction or defect causing the crash, it is a fault of one of the drivers involved. it's the responsibility of all drivers to keep their cars on the road, in the proper lane, and avoid collisions, and generally use common sense. If there's a defect in my car's electrical system that makes the car prone to catching fire, that's the manufacturer's fault. If I'm fiddling with the stereo while yapping on my cell and subsequently wrap my car around a phone pole or collide with another vehicle, that's MY fault.

sigh. This argument gets old, so I'll sum it up by saying that not everyone places the security of their home PC at the very top of their priorities list. (Oh no, shocking!) There are no 'classified secrets' on my system, nor data that must be 'locked-down'. I have unneeded system services disabled, email auto-preview disabled, and a few other small but very helpful measures taken. Sure, it's not bullet-proof, but it doesn't need to be, not for playing games, writing fiction, and doing the occasional hobbyist programming. Personally, I'll take my chances, if only because it's the OS I'm familiar with, not that it's necessarily the best -- I just know how to make a few tweaks to tighten up the leaks and avoid most major (non-hardware) problems.

Again, just my two cents, and your mileage may certainly vary.

unfortunately, it doesn't remove all traces

[earthsound]

According to the page you linked to (http://service1.symantec.com/SUPPORT/nav.nsf/doci d/2001092114452606) the "removal" tool, rnav2003.exe does not remove everything:

"Rnav2003.exe does not remove the following items:

        * The files or registry keys for the virus definitions
        * Subscription information
        * Entries in Windows Scheduled Tasks
        * Other shared files"

Go through the manual removal instructions on that page to remove what rnav2003.exe does not get.

Also, if you want to "[r]emove Norton AntiVirus 2005/2004 installed as a stand-alone product or as a part of Norton SystemWorks 2005/2004 or Norton Internet Security 2005/2004" "[f]ollow the instructions in [r]emoving your Norton program using SymNRT to remove these program versions":

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2005033108162039

There, you will also find a .reg file to clean out your registry.

In addition to the .reg file in the above link, perhaps their most useful removal instructions can be found here:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2004110113064039

Among several things, they link to Microsoft's Windows Installer CleanUp utility (http://support.microsoft.com/default.aspx?scid=kb ;en-us;290301) which is extremely helpful in removing programs that used the Microsoft Windows Installer.