HomeSearchMerchandiseAboutMichael HorowitzMy Computerworld Blog

Norton AntiVirus 2004 Gripes  Norton Anti-Virus is the leading anti-virus program

Do you have gripes about Norton AntiVirus? If so, leave a comment. See also my Symantec gripes.

Norton Gets a Bit Less Secure by Sarah Lacy in Business Week magazine. December 1, 2005. Quoting: "Hackers, bored with attacking Microsoft, are going after Symantec, whose Norton products are the first line of defense on 50 million PCs worldwide ... hackers are bypassing or disabling Symantec software in their efforts to access personal information or spread viruses and worms."  Printer Friendly version

September 2005. Consumer Reports rated Norton Anti-Virus below Trend Micro's PC-cillin and below the Kaspersky product. 

July 9, 2005. A new Windows XP SP2 computer came with Norton AV pre-installed. The first run of Live Update required 8 MB of bug fixes (I opted not to download any new virus definitions). The next run of Live Update required a download of another 4MB of bug fixes. After another reboot, there were 7MB of outstanding virus definitions. How do dial-up users survive? 

FYI: A couple times recently, on two different computers, Live Update failed with an error LU1814 -- Live Update could not retrieve the update list. In both cases it was a firewall issue. Let me suggest shutting down the firewall as a first guess of the problem. 

 April 16, 2005. Windows XP SP1 with all recent bug fixes. When running LiveUpdate manually, I got an error: "LU1861: LiveUpdate has detected a problem with the task scheduling service on this computer. This may prevent LiveUpdate from running." I was able to continue and run Live Update normally. 

The problem started after renewing the NAV subscription and running Windows Update. 

To solve the problem, the error message suggested downloading the latest version of Live Update and provided a URL. I did that, however, during the installation, Live Update detected that the latest version was already installed. 

Searching Symantec's web site for LU1861, turned up Document 2005020116274413 (Last Modified:03/21/2005)
  Error: "LU1861: LiveUpdate has detected a problem with the task scheduling service on this computer..."

As described there, the Symantec NetDetect scheduled task has an exit code of 80 in the Last Result column. 

Symantec has another KB item that basically says the same thing as the one above (Document ID: 2004070811115213, Last Modified: 4/15/2005):
  Automatic LiveUpdate does not run on Windows XP, and the Symantec NetDetect task displays an exit code of 80

Symantec blames Windows for the problem. Quoting: "this is caused by a known Microsoft problem. To fix this, you must contact Microsoft Technical Support. For instructions, read the Microsoft Knowledge Base article 812400,"

Microsoft says: "To work around this problem, disable the Human Interface Device Access service (the HID Input service), and then restart the computer." 

April 16, 2005. FYI: If you renew a NAV 2004 subscription with one month left on it for a year, the new subscription is for 13 months, not for 12 months. No need to wait to the last minute to renew the subscription. 

April 8, 2005 Norton's Knockout Punch  By Ed Foster in The Gripe Log. Problems with Activation and more. 

March 30, 2005. Symantec Acknowledges Two Holes in Antivirus Products  by IDG News Service. Flaws could be used by hackers to crash PCs running the software. Bugs in NAV 2005 and NAV 2004. From Symantec: Denial of Service in Symantec Norton AntiVirus AutoProtect. March 28, 2005. 

Read my Norton Anti-virus 2003 gripes for a description of two instances where Trend Micro detected a virus that Norton did not. July 26, 2004. 

Followup: The Rebate Debate  January 18, 2005. From the WinXPnews newsletter by Sunbelt Software. An excellent article recounting rebate experiences, both good and bad from readers of the newsletter. There was little consensus regarding which stores or manufacturers come through with their rebates and which ones don't. But, the most complaints were about Symantec's rebates.

When I purchased NAV 2004 Professional, there were two rebates. One went well, it was paid very quickly. The other, an upgrade rebate, did not go well and is documented on my Rebates gripe page. Despite my complying with the rebate rules regarding proof of purchase for NAV 2003, which was pre-installed on a new computer, Symantec initially refused to pay the rebate. June 2004. 

Out To The Net

December 3, 2004. A new Windows XP SP2 machine came with a three month trial version of NAV 2004. While I was doing some initial setup work on it, I had Live Update set for manual mode only. I ran Live Update a few times and was up to date on everything. The machine had a newly installed copy of ZoneAlarm and every time it booted, Live Update wanted to get out to the Internet. Beats me why. It seems that manual Live Update is somewhat automatic. :-(  The program was LiveUpdate COM Module, LuComServer_2_5.exe. This is the same program that ZoneAlarm detects as going out to the Internet when you run Live Update manually.  

Installation Gripes 

May 17, 2004. Installing NAV 2004 caused a new program to try and set itself up as a server. I saw this on two Windows XP machines, one with the Professional edition of NAV, the other using the regular edition. Each machine was running ZoneAlarm which warned that Generic Host Process for Win32 Services wanted server rights. The program was svchost.exe version 5.1.2600.0 and it wanted to listen on port 5000 which is the Universal Plug and Play port. 

In addition, installing NAV also caused one of the "Messenger" programs (XP has three programs that all go by the name "messenger") to run during the first re-boot after installing NAV.  Again, this happened on both Windows XP machines. I know it is the first time that this "messenger" ran because ZoneAlarm asked about allowing the Messenger program to access the Internet. I assume that messenger got kick started thanks to the default configuration of NAV 2004 which includes running shotgun over the MSN Messenger IM software. I guess to run shotgun over it, it must first start it up. Thanks for nothing NAV. 

Critical Bugs

April 22, 2004.   More critical flaws found in Symantec products By Sam Varghese. TheAge.com. Security firm eEye Digital Security has discovered four critical vulnerabilities in Norton Internet Security 2004, Norton Internet Security 2004 Professional, and Norton Personal Firewall 2004. They bugs could result in the execution of remote code. There are no fixes. 

More holes found in Symantec security software By INQUIRER staff. April 22, 2004.  Bugs scuttle from under the patched rug.

Live Update Bugs

April 26, 2004. Microsoft Patch Fixes Norton AntiVirus by Scot Finnie in his newsletter. For about two years Mr. Finnie struggled with an intermittent problem with Norton AntiVirus that has, at times, driven him to try competing products. The problem was that Automatic Live Updates would stop working. Symantec managed to fix this in Norton AntiVirus 2003 for a time, but the problem returned and persisted in Norton AntiVirus 2004. 

Symantec slams the door on LiveUpdate flaw January 13, 2004, CNET News.com. Symantec, fixed a problem in LiveUpdate - a vulnerability that could allow malicious users to gain unauthorized administrator access rights to an affected PC. A new version (2.0) of LiveUpdate is now available for download. It is 4MB.  
After January 7, 2004, your computer slows down and Microsoft Word and Excel will not start Symantec Document ID: 2004010810205113

Assorted Gripes

When Live Update is running in the background, the main NAV window does not indicate this. You only find out by clicking on the Live Update button and getting an error that it can't be run manually while it also running on its own in the background. August 10, 2004. 

A couple people have told me about CPU spikes with NAV 2004 when "Auto Protect" mode is enabled (which it normally would be). The problem seems to be related to running both NAV and Spy Sweeper from Webroot. Spy Sweeper has a memory shield that causes 100% cpu spikes that last for a couple seconds and happen every 90 seconds or so. If you turn disable Auto Protect mode in NAV, the cpu spikes go away. I don't use Spy Sweeper and can' t confirm this. August 6, 2004. 
Update. September 23, 2004. Another reader confirmed this and said that replacing Spysweeper with Spybot fixed the problem. 

Perhaps the biggest gripe is that to get bug fixes (patches) for NAV you have to run Live Update manually. In addition, there is no way to even know when there are outstanding bug fixes that you need (think Windows Update). The automatic Live Update feature only brings in new virus definitions, not patches to NAV itself. They do mention this is the manual that comes with the product, but it is buried. When you configure the Automatic Live Update feature, there is an option called "Notify me when updates are available". This only applies to virus definitions. 

Friday night scans: After installing NAV 2004 on a Windows XP Pro computer and getting all the updates, I reviewed all the configuration options I could find. Nowhere did NAV say anything about a full scan of the computer on Friday night. By accident, I stumbled across the Windows task scheduler and found that indeed, it had scheduled a full scan for Friday night. I disabled it in the Windows scheduler. June 2004. 

Email scanning: NAV 2004 can scan email messages for viruses, but it does not support the IMAP email protocol, AOL email, POP3 email when using SSL, Hotmail, Yahoo or any other web-based email system and Lotus Notes.

Full system scans: Despite the full system scan never having been scheduled, NAV 2004 runs it once a week. On a computer with the auto-protect option enabled, this is overkill. There is no way to tell NAV not to ever run a full system scan. Instead you have to schedule it to run once and make that date way in the future. In contrast, NAV 2003 does not run a full system scan unless it is explicitly scheduled or manually requested. May 14, 2004. 

Full system scans: It is not obvious from the NAV 2004 user interface whether the "scan my computer" function scans just the C disk or also scans the D, E, F, etc. disks too. When, from the main NAV window, you click on full system scan to start one running, it says nothing about which disks it will scan. While the scan is in-flight you are shown the name of the current file being scanned and the scan always starts with the C disk. There is no indication if it is also going to scan the other disks. 

Wiping: Page 104 of the NAV 2004 Professional manual describes how to wipe a file or folder in Windows 2000 or XP. It is 12 steps. That's too much. All you should have to do is right click on a file and select an option to delete it and wipe it. Also, the ability to wipe existing free space is not available in Windows 2000 or XP, only in Windows 98/Me. 

Who is the Biggest Turkey? By Ed Foster, November 26, 2003. An updated Hall of Shame has Symantec listed fifth.  

Symantec's DRM of Choice By Ed Foster, October 2, 2003. About product activation in Norton Antivirus 2004. 

Symantec adds product activation CNET News.com August 26, 2003  Norton Antivirus 2004 will use product activation, a technique to tie a copy of an application to a particular PC. Symantec plans to add activation to the rest of its consumer software line over the next year. 

Still More Bugs

On a Windows 2000 SP4 computer, the main window for NAV 2004 would not indicate the date of the virus definitions. Instead it said "Updating..." and stayed that way. Rebooting did not help. The computer was off-line and auto-updates were enabled. Going online and running Live Update manually refreshed the display. July 20, 2004. 

A reader of this web site was the victim of this problem and brought it to my attention. The cause is unknown as of November 20, 2003. 
   Internet browsing slows down after installing Norton AntiVirus 2004   Document ID:2003091216122306 
   Situation: After installing Norton AntiVirus 2004 (NAV), when you browse the Internet, the display of Web pages slows down noticeably. 
December 17, 2003. I heard this bug has been fixed and the fix should install itself when you run Live Update. 
January 7, 2004: A reader of this web site said that the slow browsing patch only works for some people, not for all. I can't verify this.

Norton Antivirus: Activation is Seriously Broken By Loyd Case on ExtremeTech November 24, 2003. A once loyal customer of Norton Antivirus has switched to a competitor because their activation scheme breaks too frequently. The article describes this problem documented on the Symantec web site:  Norton AntiVirus 2004 prompts to activate whenever the computer restarts  A fix came out at the end of November 2003. See Symantec Acknowledges Activation Bug, Posts Fix from ExtremeTech or Symantec fixes product activation glitch from CNET News.com. The problem is:

You install Norton AntiVirus 2004 (NAV) and activate the program successfully. However, whenever you restart the computer you are prompted to activate the program again. If you enter the activation code each time, then after a number of restarts you see the message "The trial period has expired. This product has been disabled because you have not activated it."

Great Expectations By Ed Foster November 6th, 2003. Symantec has acknowledged that bugs in its product activation for Norton AntiVirus 2004 is forcing some customers to re-activate whenever they re-boot their computer. This is the same story as below. 

Symantec Acknowledges NAV 2004 Product Activation Bugs By Ed Foster October 31, 2003. Symantec has acknowledged in a support document that at least some users are having problems with the DRM in Norton AntiVirus 2004. The bug forces customers to reactivate the software each time they restart the computer, eventually resulting in the message: "The trial period has expired. This product has been disabled because you have not activated it."  

The document referred to above is Norton AntiVirus 2004 prompts to activate whenever the computer restarts It is Document ID:2003093015493306 and as of November 6, 2003 was Last Modified October 31, 2003. 

On December 9, 2003, NAV was upgraded from version 10.0 to 10.0.1. To see the list of bugs fixed by this update read Program changes made through LiveUpdate to Norton AntiVirus 2004

RTFM

May 15, 2004. Months after creating this page, I finally purchased a copy of NAV 2004 for myself and Read The Fine Manual. It's not so fine. In fact it is miserably written providing very little useful information and making simple things confusing. That perhaps the most popular product for Windows based computers comes with such a disgraceful manual, says volumes about the state of the industry.  

Specific gripes on the manual for NAV 2004 Professional. The documentation is version 10.0.10. 

1. Page 13 suggests using the NAV CD to scan a PC for viruses in case it wont' boot. This ignores the fact that the virus definitions on the CD are extremely old making this all but a waste of time. 
2. NAV supports both Emergency disks and Rescue disks. The manual has lots of "click here, type this" sort of information but does not compare and contrast the two types of disks which is the only thing the manual is needed for. 
3. It wasn't clear to me what virus definitions are used on an Emergency Disk (page 14) 
4. Page 16 says "Run Live Update regularly to receive new program updates". This means you have to run Live Update manually a fact that they are trying to hide because it is disgraceful that NAV can't update itself with new patches. They are also hiding the fact that NAV is not smart enough, despite being the tenth version of the product, to tell you when there are new patches that need to be applied. Instead you have to run Live Update "regularly". How often is that? Finally, this is buried on page 16 in the middle of a long laundry list. It should be front and center in big bold letters.  
5. Page 20 is about Product Activation and the manual says how it protects you. This not true, it protects them (Symantec). 
6. Page 23 says that the Wipe Info program wipes the free space on your hard disk. It does not. It only wipes files you point it to. Wiping the free space means that it would be wiping files you deleted prior to installing NAV 2004 which a later reading of the manual makes clear it does not do. 
7. This is a minor point. Page 37 tells you how to find the readme.txt file and instructs you to double click on it to read the file. Fine. Then it says to "Close the word processing program when you are done reading the file". What does it say, that the person who wrote the NAV manual thinks Notepad is a word processing program? 
8. Page 69 says "Live Update automates the process of obtaining and installing program updates". This is a lie. Most people reading this sentence will think that "program updates" means bug fixes (patches) to NAV itself. It does not. The manual means new virus definitions. That it doesn't explicitly refer to new virus definitions as such is, I think, a way of hiding the fact that NAV does not get new bug fixes for itself automatically. Further proof of my suspicion is the fact that the manual also refers to "protection updates" and "product updates". Why all this word-smithing? The terms "bug fixes" or "patches" or "virus definition updates" are never used. 
9. Translation: Protection updates = new virus definitions. You can get them automatically (see page 74) 
10. Translation: Product updates = bug fixes (patches). You must get these and check for their very existence, manually. 
11. Chapter 9 about recovering missing or erased files is very poorly written making a simple subject much more confusing than it need be.
12. Page 98 mentions the Norton Protected Recycle Bin but never explains what it is. For example, how big is it? 
13. Page 101 says: "When you wipe a file, Wipe Info wipes the file..." Makes me sorry I read the manual 
14. Page 101 also says "Wipe Info eliminates a file's contents from the disk, but does not remove the file name." Say what? 
15. Page 102 says "Wipe Info uses hexadecimal values to wipe files". It does not. It writes binary data. All computers write binary data to your hard disk. Have for years, for decades. Hexadecimal is nothing more than an easy way for humans to read binary data. 
16. Page 105 says "Wipe Info wipes the free space on the selected disk. This includes free disk space..." 
17. The next words in the sentence above are "file slack space". The meaning of which is not explained. Is it self-explanatory? Does everyone already know what file slack space is? My guess is that the author of the manual didn't know what it is. 

FYI

How to remove Norton Anti-virus by Jay Lee October 18, 2005 of the Houston Chronicle

Removing your Norton program using SymNRT  SymNRT is a program that can remove some Norton software from your computer. SymNRT runs on Windows 98, Windows Me, Windows 2000, and Windows XP. SymNRT will remove these Norton programs:  Norton AntiVirus 2004/2005, Norton AntiVirus Professional 2004, , Norton AntiVirus 3, 5 and 10 User Pack 2004/2005, Norton SystemWorks 2004/2004 Professional Edition, Norton SystemWorks 2005/2005 Premier edition, Norton Password Manager 2004, Norton Internet Security 2004/2005, Norton Internet Security 5 and 10 User Pack 2004/2005, Norton Personal Firewall 2004/2005, Norton AntiSpam 2004/2005, Ghost 2003 and Ghost Version 9.0. Document ID:2005033108162039. Last Modified: September 6, 2005.
ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/SymNRT.exe  Added September 20, 2005.

Norton's Knockout Punch By Ed Foster April 8, 2005. About activation problems with NAV 2004 and NAV 2005. 

Stupid PC Error Messages: Fatal! by Stephen Manes PC World magazine December 22, 2004. Quoting: "Norton AntiVirus, which is supposed to update itself automatically. I've repeatedly run into situations when the updater tells me that it has aborted--and, afterward, that my virus definitions are up-to-date. Which is correct? Who knows?"

Quoting Ed Foster: "The last few months has seen the biggest wave of Symantec gripes since I started the Gripe Line. And that's saying something, because customers of Norton anti virus products have long been a particularly rich source of gripe fodder. But what is it exactly that has so many readers sick of Symantec at the moment? That's not going to be an easy diagnosis to make, because the symptoms are many." December 6, 2004. 

Dealing With Symantec By Ed Foster August 17th, 2004 

Windows XP SP2 and Symantec FAQ for Consumers  says "The Windows Security Center will be aware that you have Norton AntiVirus installed, but it will not be able to determine its working status due to Symantec's tamper-protection technology"

Windows XP SP2 and Symantec FAQ for Enterprise users

Why won't Norton AntiVirus turn on? from pcuser.com August 24, 2004

Why is NAV slow to come up? From pcuser.com  July 20, 2004

The main tech support page for Norton AntiVirus is www.symantec.com/techsupp/nav/ from which you have to select a particular version of NAV. 

The main technical support page for all Symantec consumer products is www.symantec.com/techsupp/consumer_cs.html. Here you have to select both the product and the version on this page. 

The main tech support page for NAV 2004 is  www.symantec.com/techsupp/nav/nav_2004_tasks.html  
The main tech support page for NAV 2004 Professional edition is www.symantec.com/techsupp/nav/nav2004_pro_tasks.html 

Obtaining free technical support is not obvious. From either of the above pages click on anything in the section "top support issues and contact". You will want the "Contact". For example, click on either "Error message issues" or "Installation issues". On the next page, click on the yellow Contact tab. In the next page click on "Free online support". As of June 2004, this took you to https://support.ece.com/forms/symantec/contactsymantec.asp where a request can be entered for free technical support. 

Yet another starting point for Symantec support is www.symantec.com/techsupp/support_options.html 

Symantec also provides an online knowledge base for current products and one for old products. 

Live Update requires the use of an Administrator account under Windows NT/2000/XP When you install or run Live Update on a computer running Windows NT/2000/XP, you must be logged in using an Administrator account. This also applies to older versions of Norton Anti-Virus. There is more on this in my NAV 2003 gripes page (see below). 

After installing NAV it adds itself to Windows Explorer. You can remove this with View -> Toolbars -> Norton AntiVirus. 

You have to activate NAV 2004. In addition you might want to register it. These are apples and oranges. 

There is a Professional version of NAV 2004 that can un-delete previously deleted files, securely delete files so they can not be un-deleted, can be installed on two computers and scans zip files in Windows 98 and Me. 

NAV 2004 is not supported on Windows 95, Windows NT4 and server versions of Windows. 

Automatic Live Update checks for an internet connection every five minutes until one is found. Then, it checks for new virus definitions every four hours. There is no way to know this from using the product (it is in the manual on page 74). 

The NAV 2004 Professional manual warns that if you can't read or send email, you should shut down its email scanning. Nice to know that under some circumstances NAV can interfere with email. Not to fear however, even if NAV is not scanning your email, you are protected as long as auto-protect is on. 
Update: I did have a case where NAV 2003 interfered with all email on a computer. See my NAV 2003 gripes dated December 12, 2004. 

You can install NAV 2004 on top of NAV 2003 or NAV 2002. If you have an older version of NAV, you are supposed to uninstall it before installing NAV 2004.

If you want help from Symantec in removing a virus, they charge $40 to $70 per incident and are available business hours Monday thru Friday

Activating your product  a Symantec KB article

PC Fear Factor: Symantec Links has links to some useful Symantec KB items

How to use the EICAR test string to test Norton AntiVirus Symantec told me about this in reply to a problem described above. It applies to NAV 2004. The EICAR test file helps you answer these questions:
 1. Is your AntiVirus program installed correctly?
 2. Does it intercept and detect viruses as it is supposed to?
 3. What happens when the AntiVirus program finds a virus?
 4. Which messages does it display?
 5. What about custom warnings, batch files, or administrators network notifications?
 
Norton AntiVirus 2004 reviewed by PC Magazine November 11, 2003 

Read my gripes about

• Norton Anti-virus 2005  
• Norton Anti-virus 2003  
• Norton Anti-virus 2002 
• Norton Anti-virus 2001 
• Norton Anti-virus 2000