Slashdot Mirror

← Back to Stories (view on slashdot.org)

Rootkit-like Feature Found in Norton Systemworks

Posted by Zonk on from the i'm-helping-i'm-helping dept.

GenieGenieGenie writes "eWeek reports a rootkit-like 'feature' in Symantec's Norton Systemworks, discovered by the Mark Russinovich, who was also responsible for blowing the whistle on Sony's DRM rootkit. The cloaked directory is intended to prevent users from accidentally deleting important files, but could compromise a system by serving as a hiding place for malware, as was the case with Sony's rootkit. Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole."

59 of 221 comments (clear)

  1. Grant money well spent (not) by conteXXt · · Score: 2, Insightful

    I have always been suspect of Symantec.

    I am sure the DHS knows what it is doing when it gives Symantec money to "secure" linux.

    Gawd help us.

    --
    The truth about Led Zep should never be told on /. (Karma suicide ensues)
    1. Re:Grant money well spent (not) by Anonymous Coward · · Score: 2, Interesting

      I have always been suspect of Symantec.

      I am sure the DHS knows what it is doing when it gives Symantec money to "secure" linux.

      You "suspect" Symantec because they used a rootkit-like trick to hide the Norton NProtect feature's directory from other applications? Why is that? Do you believe that I don't want NProtect installed on my computer (NProtect is an optional feature of a software package that I choose to install)? Do you believe that Symantec is working against my interests, like Sony?

      I'm not sure that I agree with Symantec's solution. It would be trivial for Symantec to program Norton Antivirus to scan the NProtect feature's directory (NAV is a part of any package including Norton Utilities, which includes NProtect). I suspect that they abandoned the whole idea because: 1. The argument concerning multiple-'rootkit' incompatibly is reasonably persuasive; 2. You could conceivably decide to use something other than NAV by choosing not to install it and 3. They could be swamped by alarmed calls from users detecting a 'malicious' rootkit with the various tools that are coming into vogue.

      However, I still value a feature that prevents little Johnny from blowing away important files while he dorks around with Windows Explorer with all the "hide files" settings disabled. It is supremely aggravating that I have to let users run on a machine Administrator level to run half of their software, which prevents me from using directory security to effectively perform its God-given function of stopping the user from deleting anything but their own dang work.

      Invitations to switch OSs will be summarily ignored. You have been warned.

    2. Re:Grant money well spent (not) by molnarcs · · Score: 3, Insightful
      I have always been suspect of Symantec. Me too. That's why I wrote this recently. Just a few weeks ago I removed yet another NAV install from a puter. This time it went well - uninstall worked fine it seems, needed just one reboot. But previously, with certain NAV releases, it was impossible to remove - or at least harder than removing spyware. Even after "uninstalling" it NAV left a lot of cruft on the system, that not only was "just there" but it loaded code at boot time. It was only possible to remove by switching to safe mode, cleaning up the registry, and removing some files manually. Symantic is EVIL!

      Add to this their track record: failure to detect SONY's malware, (and now they seem to have one of their own) and they are always the last to provide adequate means to remove fresh exploits (no data here, but I distinctly remember that whenever something crops up, f-prot, free-av, etc. works, and NAV comes trailing behind other antivir solutions.). Plus it is a serious resource hog - more than any antivir progs.

      The first serious breach of "Do no evil" of Google was their inclusion of a Symantec product in google pack :)))

    3. Re:Grant money well spent (not) by catahoula10 · · Score: 2, Informative

      NAV also has a "trusted application list" that will update when the 'live update' feature is run. Yet i cannot find this list, or a way to edit it. There is also no choice in accepting or declining the list. It comes along with virus def updates. Only after the Def's are downloaded can you see that "trusted application list" has been updated also.

      Maybe, just maybe, there are applictions on that list that i do not choose to trust. Maybe i want to trust all of them. I would like to have that choice.

      Or maybe i simply so not understand what a "trusted application list" is. This feature should be made more clear.

      --
      This has been another valuable and informative opinion from:
      Catahoula!
  2. Uninstall vulnerable? by jbeaupre · · Score: 4, Interesting

    For those of us who dislike the pre-installed Symantec software and uninstall it first chance we get, is there still a vulnerability?

    --
    The world is made by those who show up for the job.
    1. Re:Uninstall vulnerable? by jim_v2000 · · Score: 3, Informative

      If you're using any product other than Norton SystemWorks, you're fine.

      --
      Don't take life so seriously. No one makes it out alive.
    2. Re:Uninstall vulnerable? by toleraen · · Score: 5, Informative

      For those of us who dislike reading TFA, we'd never find out about the free utility linked in TFA to check if the rootkit is there.

  3. Before the flame wars start... by thepotoo · · Score: 5, Insightful
    Lets get one thing clear.
    This is not the Sony rootkit. It's just a directory that's not scanned by antivirus/antispyware.

    And, now that it's potential vulnerability has been exposed, Symantec is releasing a new version without the protected recycle bin.
    In other words, too bad they had to have their wrists slapped to fix it, but there was no malicious attempt.

    --
    Obligatory Soundbite Catchphrase
    1. Re:Before the flame wars start... by jim_v2000 · · Score: 3, Informative

      Symantec is releasing a new version without the protected recycle bin Correction, they are releasing an update via LiveUpdate that will remove the cloak from the protected recycle bin folder. The protected recycle bin will still be there. *So once you run LiveUPdate, you're fixed.

      --
      Don't take life so seriously. No one makes it out alive.
    2. Re:Before the flame wars start... by VitaminB52 · · Score: 2
      Sony installed crappy DRM with security holes.

      To be more precisely, Sony installed crappy DRM software, which was implemented with rootkit technology.
      Norton has a hidden directoy to prevent certain files to be accidentally deleted by a user.
      Sony's DRM has hidden files, to prevent the DRM software to be intentionally deleted by a user who doesn't want to have DRM crap on his/her PC. The Sony DRM software hides all files starting with a certain string. In Sony's case it is the software itself that's being hidden from view - this is rootkit specific.

    3. Re:Before the flame wars start... by Tony+Hoyle · · Score: 2, Interesting

      There's a way of making files so that Norton won't scan them... Symantec actually volunteered the information a couple of years ago until I pointed out that putting that in an opensource product would make expose the information to virus writers. Me and my big mouth... I should have just gone ahead and got the information & published it.

      OTOH I still recommend that Norton is removed before using my (and any other) software.. it's junk and drags the machine down to a crawl. One place that I worked tried to force it on my desktop machine - I knew immediately because a 10 minute compile slowed to a 40 minute one (and the new icon gave it away)... ended up removing it daring them to complain (OTOH a week later they removed it from everyones machine once productivity went through the floor).

    4. Re:Before the flame wars start... by QuestorTapes · · Score: 4, Informative

      > Lets get one thing clear.
      > This is not the Sony rootkit. It's just a directory that's not scanned
      > by antivirus/antispyware.

      Let's be completely clear. It appears to be more than "a directory that's not scanned by antivirus/antispyware"

      It's a directory that is cloaked from the administrator. It's not merely bypassed by the antivirus and antispyware utilities, it is hidden from anything that uses the Windows FindFirst/FindNext APIs to view and scan files and folders.

      It -potentially- opens a bigger security hole than merely software that hides from antivirus. It can hide from other tools as well. But is is different from the Sony Rootkit; it doesn't open up ridiculous holes. It seems most likely that this was a case of reusing code without understanding the security implications.

      > And, now that it's potential vulnerability has been exposed, Symantec
      > is releasing a new version without the protected recycle bin.
      > In other words, too bad they had to have their wrists slapped to fix
      > it, but there was no malicious attempt.

      And, equally importantly, they didn't need to be dragged kicking and screaming, with the threat of lawsuits, into remediating the problem. That makes it a much smaller story.

    5. Re:Before the flame wars start... by Feyr · · Score: 4, Informative

      it does way more than slow the machine to a crawl. it prevents it from working properly.

      working for an ISP, we get a surprising number of users that can connect to the net (as in, the modem dial), but nothing works, no web, no email, nothing. everything checks out, configs are fine and all.

      but they have norton antivirus with their crap security. the configs to that seems fine. as soon as you uninstall that crap, everything work.

      do your users a favor, have them install AVG (www.grisoft.com)

    6. Re:Before the flame wars start... by GenieGenieGenie · · Score: 5, Insightful
      I guess the point about this whole story is not the intended malice of Symantec, but rather that ye-old first principle of medical science: If you're a doctor, trying to keep a system healthy, primum non nocere . First of all, do not harm.

      From this point of view, Symantec is actually worse than Sony, because the latter never claims to protect your system (not that I'm saying Sony are angels). True, the reaction by Sony was just before they had a gun pointed at their company's head, but how serious can you take a security-software company that has a rootkit in their software, acknowledges that due to developments in hacker-tech this has become a serious vulnerability (is this news at Symantec?), but still waits for some external source to publish their hole in order to fix it?

    7. Re:Before the flame wars start... by Biomechanical · · Score: 2

      I work for a local community telco here in Ipswich - Internet, mobiles, landlines - and I have to ask customers to disable, or even uninstall, Nortons "something or other" sometimes.

      Those poor bastards. For years we've - a general we've, not specifically you and I - been telling people have a virus checker, firewall, so on and so forth, and often recommending Symantec software because it used to be good, and now I gotta tell them that Nortons Security or Nortons Whatever is causing half their bloody problems, and the customer doesn't know why, or even understand.

      As a simple solution to this whole problem, I've been waiting for a virulent strain of code to take out all the world's Window's-based machines so I can start telling people to get a Linux, BSD, or Mac system. Kind of a pisser of a solution but I think it would work, to a certain extent.

      --
      His name is Robert Paulsen...
    8. Re:Before the flame wars start... by Lehk228 · · Score: 2, Informative

      index.dat caches the contents of a folder and icon previews for previewed files such as video and image files. index.dat it what makes it possible to open huge folders full of media files without a horrendous wait *every* time you open the folder.

      --
      Snowden and Manning are heroes.
  4. Deleting files by gr8_phk · · Score: 3, Funny

    They did it so users couldn't accidentally delete important files?? Sure would be nice if there was such thing as "root" on Windows so you could have files that every day users couldn't delete...

    1. Re:Deleting files by thepotoo · · Score: 2, Insightful
      From what I understand, this is so you can't delete all your precious word documents without meaning too.

      That's still a problem in Linux.

      --
      Obligatory Soundbite Catchphrase
    2. Re:Deleting files by l2718 · · Score: 2, Informative

      Symantec's "NProtect" is a service similar to the recycle bin: when you delete a file, it is moved to a special directory and its metadata is preserved. This allows for easy undelete. As with any internal state of a program, users mucking about the special directory could cause problems (e.g. what should you do if the users deletes a file from the NProtect directory?). This has nothing to do with "root" privileges.

  5. Rootkits are big now by filenavigator · · Score: 5, Interesting

    Rootkits in windows are becoming more and more of a problem. I found this interesting site the other day when looking for a rootkit detector: www.rootkit.com

    1. Re:Rootkits are big now by IngramJames · · Score: 2, Funny

      I found this interesting site the other day when looking for a rootkit detector: www.rootkit.com

      Dude, you slashdotted a rootkit (detection?) site.

      Somewhere there's irony in that.

      --
      'No rational religion claims "supernatural" exists, that's an atheist slander.' - seen on slashdot.
  6. $sys$Nothing 2 see here. Please move along.htm.pif by Anonymous Coward · · Score: 2, Funny
    I don't see any problem here at all.

    Heh, my "confirm you're not a script" image is "sanity."

  7. I don't get it by Anonymous Coward · · Score: 4, Interesting

    The cloaked directory is intended to prevent users from accidentally deleting important files

    There's thousands of important files on a Windows system, and they don't need a rootkit to protect them. What's special about Norton files that make them extra-specially important?

  8. Uninstalling Norton can be very time consuming by digitaldc · · Score: 4, Interesting

    I have had to uninstall Norton a few times and the 'Add and Remove Programs' feature in Windows did not work.
    So, I had to go to this link and do it manually....talk about a pain in the #*$%.

    --
    He who knows best knows how little he knows. - Thomas Jefferson
    1. Re:Uninstalling Norton can be very time consuming by darkitecture · · Score: 2, Informative

      I have had to uninstall Norton a few times and the 'Add and Remove Programs' feature in Windows did not work. So, I had to go to this link [symantec.com] and do it manually....talk about a pain in the #*$%.

      I have to admit that manually removing Norton is always a pain in the ass but Norton has provided a total removal tool for years. Before, it was called Rnav2003 and was available for free download on their website. Newer versions of Norton require SymNRT, which is also available free on their website:

      http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2005033108162039?Open&src=bar_sch_nam&docid =2004093015165236&nsf=tsgeninfo.nsf&view=docid&dty pe=&prod=&ver=&osv=&osv_lvl=

      It works like a charm and means you don't have to sit there manually removing Norton for two hours, secretly and silenting wanting to find a pencil, sharpen it and shove it in your eye.

    2. Re:Uninstalling Norton can be very time consuming by tkrotchko · · Score: 2

      The alternative, of course is to:

            JUST HAVE NORTON UNINSTALL LIKE A REGULAR PROGRAM!!!!

      Just what is Symantec hiding that they won't let you just get rid of their stuff when you uninstall?

      --
      You were mistaken. Which is odd, since memory shouldn't be a problem for you
    3. Re:Uninstalling Norton can be very time consuming by F_Scentura · · Score: 4, Insightful

      "They're really complicated!" is no excuse for not following the conventional uninstall procedure and requiring that a separate uninstall program be downloaded separately from the internet.

  9. Who needs Symantec? by PhakeDC · · Score: 4, Interesting

    Apparently insecure and/or incompetent sysadmins are behind the boom in "all-in-one-fix-'em-all" suites. Why not tackle the problems head-on yourself rather than relying on third party software which might actually jeopardise your entire system without you knowing it? And I found Norton Anti-virus to be a serious hog on system resources. It's safe to assume their other products are in the same league.

    1. Re:Who needs Symantec? by Ilgaz · · Score: 4, Insightful

      Their target for SystemWorks is not Slashdot posting people like you and there are people who actually DELETE these files making their system unusable.

      System admins use Symantec corparate solutions which has NOTHING TO DO with the stuff mentioned here.

      But keep bashing Symantec. It is number 2 favorite target of geeks after real networks.

      I bought it as a gift to a pure newbie computer user who is really busy with stuff rather than dll and registry hunting manually, he is happy to this day.

  10. No. by thepotoo · · Score: 2, Informative

    From what I can tell, if you uninstall it, you lose the system protected recycle bin (designed to prevent you from deleting your pr0n, actually it provides a hidden place for viruses to hide). Therefore, you're safe.
    If you are still paranoid, reinstall it and run the update patch with fixes it.
    Or, check out BlackLight Rootkit Elimination Technology, which is supposed to eliminate (or at least detect) the rootkit.

    --
    Obligatory Soundbite Catchphrase
    1. Re:No. by Spad · · Score: 2, Informative

      Certainly on older versions of Systemworks this isn't the case. My housemate came to me after being unable to account for 8Gb of used hard disk space, after much investigation it turned out that that 8Gb consisted of files that had been in Norton Protected Recycle bin when he uninstalled it and they were still there. In the end I had to use a DOS bootdisk to delete the folder structure and free up the space.

  11. Rootkits by cyp43r · · Score: 2, Insightful

    I've never much liked Norton Antivirus, and this just adds more fuel to the fire.

    1. Re:Rootkits by jim_v2000 · · Score: 2, Informative

      The article talks about Norton SystemWorks. Which if you ran LiveUpdate on already, you're fixed. This has nothing to do with Norton Antivirus.

      --
      Don't take life so seriously. No one makes it out alive.
  12. Wow, now with fewer holes! by frostfreek · · Score: 4, Insightful

    "...Symantec's update further protects computers by displaying the directory,"

    That's great! Our product is now better, because we turned off something bad we were previously doing!
    Now that's a nice spin!

  13. Uninstall vulnerable? clarification by jbeaupre · · Score: 2, Interesting

    My real problem is that my mom bought a PC at Christmas. While visiting (she's a couple time zones away), I did a little tuning (firewall, firefox, openoffice, etc.) Symantecs pisses me off so it got uninstalled (replaced with Avast). But ... did the uninstall really clean everything up? I can't check in person and I'm not going to walk my mom through rootkit detection unless neccessary.

    --
    The world is made by those who show up for the job.
    1. Re:Uninstall vulnerable? clarification by toleraen · · Score: 2, Informative

      Ahhh - well I can sympathize with you in that case! While a straight answer would have been better, the tool that's linked in the article is very very simple to run. You hit download, open it to install, accept the EULA, and hit scan. The window is simple and well laid out, tells you if you found anything, hit next if it did, and hit exit. Should be pretty easy to walk anyone through (a lot easier than stuff like a virus scan or spyware scan).

  14. Not a Surprise by u16084 · · Score: 2, Informative

    Maybe slightly off topic, but I'll speak my mind anyways. Systemworks is Very dangerous, for those that have observed how it actually installs onto a system its a scary sight, A VERY tight intergration with the OS. If a "User" rm's one of these "files" without a doubt the computer will suffer. Their intentions were good to "protect" the files, since meny users who install "Systemworks" have no clue anyways. A patch was issued (not ignored), Sony should learn from its mistakes.

    --
    -- I Dont Deserve A Sig I Have Bad Karma
  15. steps by trandism · · Score: 3, Insightful

    Steps of action when joe six-pack brings me a windoz box: 1. Uninstall Norton 2. Install AVG 3. Delete all "e"'s from everywhere 4. Install Firefox 5. Install Opera 6. Delete all Outlook shortcuts 7. Install Thunderbird 8. Install VLC and associate all media with it 9. Teach the guy to right-click/scan with AVG everything he downloads from the internet It worked nice in most occasions My 2p

    --
    www.lemonodor.com A mostly Lisp weblog
    1. Re:steps by stunt_penguin · · Score: 2, Funny

      10.
      teach
      user
      how
      to
      use
      BR
      tags
      .

      --
      When the posters fear their moderators, there is tyranny; when the moderators fears the posters, there is liberty.
    2. Re:steps by Shawn+is+an+Asshole · · Score: 2, Informative

      Don't forget about BitDefender. It has a free on-demand scanner, and I've found it to be excellent. I gave it a try this weekend on a few computers heavily infested with spyware and viruses and it found and removed things that Spybot, Ad-Aware, Microsoft AntiSpyware, AVG Free, F-Prot, and ClamWin didn't. I'm definatly going to be using this more often.

      --
      "It ain't a war against drugs.it's a war against personal freedom" --Bill Hicks
  16. Not quite the same... by drakewyrm · · Score: 5, Informative

    The hidden NProtect directory at the heart of this issue has been (reasonably) common knowledge for some time. They were up-front and honest about the presence of this directory, and made frequent reference to the "hidden" and "protected" nature of said directory in documentation and marketing literature.

    Also, according to Symantec's own writeup on the issue, the directory was cloaked specifically so that it would work as advertised: to keep people from deleting important shit, particularly files that can't be put in the Recycle Bin.

    Also, also, you need to give them a bit of credit for the fact that they worked with Mark Russinovich of Sysinternals and F-Secure in fixing this. Nobody needed to make a huge stink about the problem like the last big rootkit issue

    --
    Batou: Hey, Major... You ever hear of "human rights"? Major: I understand the concept, but I've never seen it in action
  17. Article doesn't say enough... by DnemoniX · · Score: 4, Interesting

    I must have missed something in the article. All it refers to is a "cloaked" directory. Now this shouldn't surprise anyone here. This is no different than how XP works normally. By default XP hides or "cloaks" protected system directories too, namely the System Volume Information folder in the root of each partition. The only way you can find them is by selecting to show hidden files and folders and to uncheck the "hide protected operating system files" option.

    Now what is interesting is that even if you have administrative privileges, you by default do not have access to that folder. You have to manually add yourself to the security on it just to open it. From the article this seems to be the exact deal with the Symantec product. They are worried that an intruder may use the location to stash files. Well guess what? That is exactly what attackers do with the System Volume Info folder. It happened to me on a system that I had an older version of the Backup Exec remote client installed on. A well known hole, thankfully it was on a test system with no access. I noticed a huge amount of outgoing connects from the box and used disk space that I could not account for. After some minor digging around I managed to find everything stashed in that hidden system folder.

    So what I would really like to know, and the article doesn't specify, is Symantec actually hooking into the kernel to hide the folder from Windows, or is it just setting the permissions on the folder in a way that is similar to the System Volume Information folder? If it is the later this is not a rootkit, it's just being sneaky. If they are hooking in, well shame on them.

    1. Re:Article doesn't say enough... by BVis · · Score: 2, Insightful

      A "cloaked" system folder that can be made visible in Folder Options is different from a directory created by a rootkit-like piece of software. By definition, a rootkit patches the OS it's compromised so that the operating system itself cannot see the directories. It sounds to me like Symantec's actions here are very similar to what Sony BMG got in all that hot water for.

      Odd thing is, it was pretty widely known that some anti-virus programs have rootkit-like properties; i.e. they hide directories from the OS. Ostensibly, this is to prevent malware from accessing the directories and compromising the anti-virus. Not saying it's right, just saying this shouldn't be a big shock.

      --
      Never underestimate the power of stupid people in large groups.
    2. Re:Article doesn't say enough... by vadim_t · · Score: 2, Informative

      It's another device name. "CON" stands for "console".

      For instance, open cmd.exe, and type:

      copy con test.txt
      type some text, press
      ^Z (Ctrl+Z)

      This is the DOS/Windows equivalent to cat > test.txt. Reading from CON reads from the standard input, writing writes to the standard output.

  18. I always knew... by Chaos1 · · Score: 2, Funny

    I always knew that Norton guy was shady. Just look at the smug picture on the back of his books and other products. Plus he went and trademarked his name.

    --
    I only need the Preview button when I haven't used the Preview button.
  19. It's hard to uninstall Symantec software by tkrotchko · · Score: 4, Interesting

    I remember a couple years ago when I still bought and used Norton/Symantec anti-virus; it kept claiming my subscription ran out and wouldn't update the definitions. So I uninstalled and reinstalled. Same problem. After doing some searching, I realized it had installed itself all over the registry and wouldn't get out. It took a good 2 hours of hand-editing to remove all traces of Symantec from my registry.

    So much for "uninstall".

    Which is why I never use their stuff anymore. Truth be told, I don't think they've done anything good since. Well. Since Peter Norton still loosened his tie and programmed for a living.

    I can't think of any software of theirs that I would consider putting on a system, so I can't say I'm surprised by stuff like this.

    --
    You were mistaken. Which is odd, since memory shouldn't be a problem for you
  20. Where was that place? by Evil+Closet+Monkey · · Score: 2, Funny
    Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole.

    I was getting directions to someplace the other day, the guy said the road there was paved with "good intentions". Damn, I can't remember the name of the place... think, think...

  21. Why is this a "rootkit"? by Keyslapper · · Score: 2, Interesting

    I may have missed something, but I saw nothing whatsoever in the article that sends information or provides external access without the users knowledge.

    Isn't that what a rootkit does - allow unauthorized access?

    Of course, it's hiding a directory, but as mentioned by other posters, Symantec has never been very secretive about that, they just didn't come out and announce in big flashing red letters that they were creating a hidden directory. Not a lie at all, as was the case with Sony.

    Now, apparently there are a few folks here that seem to consider Symantec only a couple notches away from M$ on the slimeball ladder, but the fact is they write software that attempts to protect computers (typically from the gifts M$ has bestowed on the world). Personally, I only use their antivirus SW, since Windows does just fine bogging the one machine I run it on without any unnecessary help. To date, I have had far fewer issues with Windows machines using Norton Antivirus than those without it. In fact, it seems to me Norton AV is as important for Windows machines as a network connection.

    Not that this isn't something to be aware of, but at best this is a potential security hole, not a rootkit. While I don't want anyone "hiding" stuff on my system, I know very well there are users out there that can be easily convinced to delete important system files - or doesn't anyone remember the SULFNBK virus?

    1. Re:Why is this a "rootkit"? by 99BottlesOfBeerInMyF · · Score: 4, Informative

      Isn't that what a rootkit does - allow unauthorized access?

      The terminology being used is confusing to many people. In common parlance a rootkit is a general purpose setup to compromise a system and hide all evidence of that compromise. Usually this includes a "kernel" patch that hides the offending files and in some cases network traffic. Symantec is patching the "kernel" to hide files, and doing so is wholly unnecessary. My guess is were not concerned about users so much as malware/worms that would automatically cripple their program. The side affect of this is worms can actually exploit this to hide themselves. It seems like a risky and invasive attempt at security through obscurity.

      A big part of the problem is that they are trying to secure an inherently insecure system, without having access to the source code. Windows users are generally admin (since Windows is pretty unusable as a regular user) and local privilege escalations are common and trivial. I don't think MS even tries to fix them anymore. As a result Symantec is basically in an arms race on even footing with malware authors.

      While I don't want anyone "hiding" stuff on my system, I know very well there are users out there that can be easily convinced to delete important system files...

      That is part of the danger of using Windows. Clueless users have unfettered access to delete vital parts of the system and rightly believe worms and viruses can easily infect their poorly secured machines. Still, Symantec should have known this was unworkable in the long term and would result in a persistent liability.

  22. Re:It's hard to uninstall Symantec software by NVP_Radical_Dreamer · · Score: 5, Informative

    Not to take up for symantec, but they do offere a free utility for removing all traces of their software. They have one for each piece of software as far as I know.

    http://service1.symantec.com/SUPPORT/nav.nsf/docid /2001092114452606

    --
    The best argument against democracy is a five-minute conversation with the average voter.

    - Winston Churchill
  23. Re:It's hard to uninstall Symantec software by remmelt · · Score: 2, Interesting

    Ghost has saved my life so often that I seriously love that tool. Apart from that, you're right.

    I just found out that Sygate has been acquired by Symantec and they discontinued the free for home use firewall.... Bummed!

    Symantec has never even made anything, they just buy the competition.

  24. Re:It's hard to uninstall Symantec software by tkrotchko · · Score: 3, Insightful

    I know they have that now, but they didn't at the time.

    Worse, I don't trust Symantec to really remove their software. Why doesn't uninstall remove the software? Why do I need to uninstall then run "really uninstall" to really uninstall it?

    --
    You were mistaken. Which is odd, since memory shouldn't be a problem for you
  25. You don't tell me that you mean... by Hurricane78 · · Score: 2, Interesting

    ...the norton recycle bin extension?

    I know that nowadays norton products are mostly crap with near-to-none options, and all non-basic funtionality removed successively in every version, but this recycle bin extension comes from the good days and already saved my ass may times. (every time i typed something like Ctrl-N, Ctrl-S, Enter, and overwrote my just finished huge file with an EMPTY file.)

    The direcory it used was not cloakrd in any other way than setting it to "hidden". I don't know if that changed in very recent versions (haven'T RTFA), but last time i used it (system works 2005) i could simply go into the directory and look what's inside it.

    So maybe this is a common bug of virus scanners...

    I even implemented something like this for my samba-shares. srue someone will come up with the "well, maybe it's a PEBCAK"-argument. but don't tell me you never did such an error and then whished to have the data back?

    --
    Any sufficiently advanced intelligence is indistinguishable from stupidity.
  26. Just to note by Anonymous Coward · · Score: 2, Informative

    The symantec web site report on this states that it only affects 2005 and 2006, but I am running 2003 and it is also affected! The update fixes (supposedly) the issue. Nprotect can now be seen in the RECYCLED directory.

    Info can be found here:

    http://securityresponse.symantec.com/avcenter/secu rity/Content/2006.01.10.html

  27. How to get unlimited free subscription by jambarama · · Score: 4, Interesting

    When you install Symantec (works with McAfee too I've been told) just set the system clock forward a few years. If it installs in 2010, but then finds itself in 2006, it'll think you have a 4 year subscription. I did this when I was still in the 'give me free stuff script kiddie' mode a few years back. A friend of mine just did it and confirmed that it still works. I switched to Debian and haven't had a problem with ClamAV.

    Silly Symantec, not getting a real date online.

  28. Not very surprising by Kristoffer+Lunden · · Score: 2, Interesting

    They have gaping holes in their firewall, so why not in more products?

    Explanation: a fresh install of Windows XP on my father machine, SP1 because that was the CD that came with the machine, then an install of the Norton firewall that also came with the purchase - firewall set on as paranoid as the settings allowed... plug in network, and bam! Instant infection. There aren't any settings in the stupid product for "block everything" or anything either, just security levels or whatever it was. In any case, highest whatever apparently still left ports open... impressive.

    The reinstall was because their firewall and antivirus had already failed to protect the computer btw. Why anyone would use thir products is way beyond comprehension. It's utter crap.

    --
    Spine World
  29. Symantec's Norton Removal Tool by Rodness · · Score: 2, Informative

    I've used this a lot lately when upgrading NAV, this is a removal tool which will nuke all traces of many Norton programs off a computer. Not as useful if you have, say, NAV and Ghost and just want to remove NAV, but if you only have NAV, this works for different versions. (As my family all uses NAV, but everyone always seems to have a different version, sticking this on my usb drive has been invaluable.)

    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2005033108162039?Open&src=&docid=2001092114 452606&nsf=nav.nsf&view=docid&dtype=&prod=&ver=&os v=&osv_lvl=&seg=

    The SymNRT.exe remover will remove ALL installs of:
            * Norton AntiVirus 2004/2005/2006
            * Norton AntiVirus Professional 2004
            * Norton AntiVirus 3, 5 and 10 User Pack 2004/2005/2006
            * Norton GoBack 3.1/3.5/3.6/4.0/4.1
            * Norton SystemWorks 2004 Professional Edition
            * Norton SystemWorks 2005/2006 Premier
            * Norton SystemWorks 2004/2005/2006
            * Norton SystemWorks 2006 Basic Edition
            * Norton Password Manager 2004
            * Norton Internet Security 2004/2005/2006
            * Norton Internet Security 5 and 10 User Pack 2004/2005/2006
            * Norton Internet Security 2005 AntiSpyware Edition 8.2
            * Norton Personal Firewall 2004/2005/2006
            * Norton AntiSpam 2004/2005
            * Norton Ghost 2003/9.0/10.0

  30. Re:It's hard to uninstall Symantec software by linuxtelephony · · Score: 2, Insightful

    I don't know if there is a relationship or not, but when the company was known as Norton (for Peter Norton), they had good products. When they transitioned to Symantec they seemed to make whatever they touched worse.

    Norton's utilities were great, tiny, fast little tools that did what you wanted in a predictable way. A must have in the DOS days, and even early Window days. As Symantec the tools seemed to get more and more bloated. Then some of the tools had to be bought separately, costing more money. They took over PC Anywhere at some point, and made the tool so large that it was all but impossible to load into some DOS based systems (with plenty of RAM) and still be able to run the rest of the system properly. They took over WinFax and took out some of the best features and seemed to make it more prone to failures.

    It's a pattern of theirs. And a great disappointment. And why I, also, no longer buy or use anything from them. First thing I do on new equipment that has their software is uninstall it. Same thing I tell others.

    --
    . 62,400 repetitions make one truth -- Brave New World, Aldous Huxley
  31. Cloaked Directory = Windows Registry by pahoran · · Score: 2, Funny

    "The cloaked directory is intended to prevent users from accidentally deleting important files, but could compromise a system by serving as a hiding place for malware..."

    Is it just me, or does that sound like the Windows Registry?

    --
    I'd give my right arm to be ambidextrous.