• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Norton Security is generating a "virus found" for "Trojan.Gen.NPE" every time I start my Logitech MyHarmony software (for my entertainment system's remote control).  I am submitting "Trojan.Gen.NPE" to Norton via Norton Security; but I wondered if anyone else who was using Logitech My Harmony software was experiencing this as well.

Right now, the MyHarmony program on my computer isn't even functioning--it won't start.  (Because I am submitting the file to Norton, I can't restore it; therefore I can't determine if the file is necessary for MyHarmony to function.  The program isn't functioning...so maybe it's safe to assume it IS necessary.)  The file's name is f_000196 (and I can't see a file extension).

Anyway, I will try to uninstall/reinstall Logitech MyHarmony (again) and see if it functions (again).  I was using the current version (whatever version that is), and will download the same version to reinstall.  Geez, what a PAIN! 

Replies

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Sure enough, I just installed Logitech Harmony MyHarmony software on my Windows 10 laptop (which didn't have it installed before), ran Norton Security's Full System Scan, and got this:

This leads me to believe Norton Security is seeing a "false positive" somewhere in the Logitech Harmony MyHarmony program or software.  As I did with the other file Norton Security identified, I am going to submit this file to Norton via the submission tool.  The file name of the "suspect file" this time is, "f_000009".  Here's a screen grab of the File Insight (not sure if this will help Norton, but for what it's worth...):

Kudos1 Stats

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

I also have a Logitech Harmony. I just duplicated what you show. All you need to do is restore it and exclude it. It's that easy. Works for me. It is called a false positive. Submit it here. It creates a temp file that Norton is detecting. The problem is fixed within 10 seconds once you restore and exclude it. The options are right in the file insight box you posted. Click on options and restore.

https://submit.symantec.com/false_positive/

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Good grief, what a pain!!  How certain are you that it is a False Positive?  Did this just begin as a result of a recent Live Update?  It may wind up being an exercise in futility, if MyHarmony is generating Temp files each time we open the program.  Are we supposed to submit these False Positives, every flipping time we use MyHarmony??  I sure hope not, since I think this was the third Temp file it alerted on.

Well...I restored it, excluded it, and filed a False Positive report.  (Little did I know, I had to go back and Restore the file, before I could submit the report--the file does need to be Restored, first.  Can't submit a file that's been Quarantined...at least, I don't think I can.)

Anyway...that was nuts...I totally hate False Positives.  They're not just "scary," they break programs, and result in numerous hoops being jumped through lol.  Say, if you would, could you please let me know how you knew it was a False Positive?  I'd appreciate it, and thanks.

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

PatsSoxBruins...PS...thanks for telling me how to submit through the online form.  However, I need to ask, then what's the point of the "sample submission" option in Norton Security?  I always thought that was the reason for that function--to submit files Norton Security had alerted on, so they could be examined by Norton.  Is that wrong?  Thanks.

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Of course it is a false positive cause the alert is coming from a legit program. It's not like you just downloaded a sketchy program. Using Norton to submit something will take longer then actually submitting via the link I sent you. If you use that link it is about a 24 hour turn around. 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

That's true. The MyHarmony program has been on my machine for years. I suppose I was being over-cautious (thinking maybe something had been downloaded to my machine in the background). Regarding the file submission tip, I didn't realize there was a faster method--that was also very helpful. Thanks much!
Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

I have a Logitech Harmony 650. I bought it years ago. Have had the software on my laptop since I bought the remote. I only used it to first setup my remote. Used it about 6 months ago to change around my preset channels. When you open up the Harmony software it dumps a temp file (obviously legit) but for some odd reason Norton flagged. No big deal. Once Norton emails you back let me know what they say. Then it should be white listed by them. 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

PatsSoxBruins, I can do that, sure; but nothing yet as of this morning.

I can tell you this--in the email I received when I made the submission, it shows:  File hash or clipboard paste from product = Filename: f_000019

The thing is, the actual file name (as you might already know) was f_000009.

I wonder if that difference in the file name and hash--000009 vs. 000019--could be what triggers Norton's response?

Kudos1 Stats

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

PatsSoxBruins, here's Norton's reply.  Including my submission, there were a total of 14 files shown.  The portion which applied specifically to my submission is below.  The RAPID RELEASE sequence is 181333.  (I am not at all sure what "RAPID RELEASE sequence" means; but since it also says "via the next Live Update," I assume it will be "updated very soon."  I am running another Full System Scan as I type this.)  Thanks again!

"In relation to submission 6689.

Upon further analysis and investigation we have verified your submission and, as such, the detection(s) for the following file(s) will be removed from our products:

    File name: f_000009
    MD5: 6a1c1e621843ec46198277ab50aadad9
    SHA256: a585cd2b290683c14d08e7fa3233e81a019308228092bfc98b6232098ba3ffda
    Note: Whitelisting is available by downloading a RAPID RELEASE indicated in the Further Information section below or via the next Live Update"

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

PatsSoxBruins, so far, the whitelist HAS NOT WORKED Or, rather, now the file Norton Security is "alerting" on is different.  It is no longer "f_000009", now it is "f_000012"!

I have NO IDEA what is going on with this thing.  I was told by a Norton Agent to forward my email from falsepositives to a different email.

After a whole lot of effort (AOL was not letting me forward the falsepositives email), I finally succeeded in sending more info to Symantec.  However, I have not received a reply yet.  Anyway--the whitelist apparently DID NOT FIX THE ISSUE.

Anything on your end??  Are you seeing something similar (f_000012 instead of f_000009)??

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Nothing on my end. Why don't you simply click "restore". Then go into exclusions and add the Logitech folder. Your honestly making this out to be bigger then it is. How many times do you need to sync your remote? I have not had to sync or program mine in over 6 months. I just opened up My Harmony and logged in with no alerts from Norton. Your alert is for a temp file. Temp files will have different numbers. 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Is your My Harmony software interface version 1.0.1.257? 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Here's how I see it:  Norton Security should not be telling anyone a "temp file" of any "legitimate program" is a virus.

That tells me something is wrong, either with MyHarmony or with Norton Security's definitions.  Norton is giving me "false info" by making me believe there is a virus on my computer, when in fact, there is no virus at allAnd that is not good.

I'm sorry; but I can't figure out the interface version.  What I thought was a "shortcut" in the Start menu is apparently an "Application Reference (.appref-ms)."  When I right click the icon and select Properties, I get the window below and can't see any version number.  It's not on the General tab, either.  Then, when I try to follow the Directory path, it just takes me right back to the Start menu icon--an exercise in futility.

I guess I'm just not that computer savvy.  From what I recall, I'm almost positive downloaded 1.0.1.257 when I uninstalled it and reinstalled it (I did that because I thought these "false positives"  were MyHarmony's fault).  It was whichever version for Windows 10 they have on the Logitech web site.

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Version number is available in add/remove programs. Every single antivirus out there has false positives.  Simply click on restore and exclude it. You can also go into Norton's settings and exclude the Logitech folder. My Harmony software is not something needed daily or even monthly. It is software to use when first setting up your remote. Why are you using this software daily or weekly? I have the same software with a logitech Harmony 650. But I get no such false positive once I clicked on restore then excluded it. 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Thanks (I figured that out late last night), and yes, it's 1.0.1.257.  I use a Harmony Ultimate One to control several components and use OTA for TV.  For me, things change; device timings, channel names and logos, customizable backgrounds, etc.  Some people can say it's being nit-picky; but that's why I bought one of these fancy remotes--to keep stuff in sync.

For the false positive, I'll use this analogy.  When my Airbag Warning light comes on, something is wrong.  The circuit is bad, the airbag is defective, or maybe the light is just a false alarm.  But should I just ignore the light, by opening up the dashboard and disconnecting it?  Probably not a good idea.

Same with antivirus.  When that "Trojan.Gen.NPE light" comes on, something is wrong.  Either I have a virus or the warning is bogus.  Either way, to me, "restore and exclude" is not "the best option."  To me, it isn't solving the problem, it's ignoring it.

What if I "restored and excluded" something that really was a virus?  How can a computer illiterate (me) judge which warnings are "real" and which are "false positives?"  I'd rather have Norton (the "professionals") make that determination, and if necessary, fix the problem.  (That's why we pay them the big bucks for their software.)

I understand "restore and exclude" is an expedient fix to the problem.  I understand...until the airbag explodes in my face... 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Now your going off on tangents. I was a GM master mechanic for 20 years by the way. Air Bags are "suppliments". Back on topic. EVERY single antivirus on the market has an issue with false positives from time to time. Avast is the king of that. AV Comparatives recently did a test. I have the same setup as you and do not get any issues. I also have a Logitech Harmony 650. Once I set it up I no longer needed to use the Harmony software but kept it installed. Using a computer comes with a lot of responsibility. Knowing what is legit and what is not is part of it. Now if you just downloaded program "xyz" and then got an alert from Norton then it is most likely a virus. If you just opened a program such as Logitech Harmony and Norton pops up with an then it is a false positive. If the doctor says "You will die in 30 days" do you believe him? No you seek a second opinion. I have used every single antivirus out there. I repair computers and remove malware for a side business. Norton is one of my top favs especially since it is free to all customers. Take a look at the link I posted. You will see that false positives are a part of life.Once your remote is setup it is setup. I only plugged in mine and opened up My Harmony to help you. I got the same alert. I restored it then excluded it. I then tried days later with no issues. is your Norton at all default settings? Sorry i do not know what else to tell you. Norton is not big bucks either. You can buy it off Amazon for $20. 

https://www.av-comparatives.org/wp-content/uploads/2016/10/avc_fps_20160...

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Either way, to me, "restore and exclude" is not "the best option."  To me, it isn't solving the problem, it's ignoring it.

Obviously you only want to do this if you have somehow determined the file is safe. At the same time, there should be an option to report the file to Norton/Symantec as the restore is being done. So it helps with the solution if Norton can retest the file and issue an update so it is not detected in the future.

Things happen. Export/Backup your Norton Password Manager data.
Kudos1 Stats

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

Hello

It seems like every time it is used, a different temp file is produced with a different number. Norton approves one number, but the next number is again alerted. If this is a setup file, unless you have a lot of these remotes, one setup should be enough unless you made a mistake when setting it up, if I understand things correctly.

Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit 1903 Norton Core Security Plus 22.19.9.63 Core Firmware 288 Android App 2.22 Chrome latest version.
Accepted Solution
Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

floplot, I believe you do understand the problem correctly.  peterweb, I do go along with PatsSoxBruins that the file(s) in question are almost certainly legitimate and clean (no virus), because they're created by MyHarmony, a "legitimate program."

After setting up the remote, there are a couple ways to make changes to the remote.  You can either use the remote (which I find kind of unwieldy), or the software (which I find easier to do).  Some people set up their remote and voila, they're done--no more changes, ever.  But that ain't me.  I do make occasional changes, so I prefer to access the software.

I should have expressed myself differently earlier, when I said "restore and exlude" ignores the problem.  It doesn't ignore it, not at all.  However, it does seem to treat the symptom, not the problem.  Maybe that's a better way to describe "restore and exclude."  What I mean is, yes, it does make the detection go away; but the "problem file(s)" still end up getting re-created (as floplot suggested).

In any event, I didn't mean for my comment to sound like an insult or anything like that.

Good news...I got another Live Update including another Norton Whitelist (5.9KB) at 1:09 PM today.  The next Full Scan, HOORAY...no Trojan.Gen.NPE detected!  That makes me think the 5.9KB whitelist contained the "fix" for MyHarmony.  I have since opened the software, and there was no Trojan.Gen.NPE detection then, either.  *sigh of relief*

Thanks, guys, (esp. PatsSoxBruins) for bearing with me and helping deal with the problem.  (And remember:  Go Broncos!) 

Kudos0

Re: Norton Security vs. Logitech My Harmony software (Trojan.Gen.NPE)

You are exactly right floplot. But I do not have this issue and I have a Logitech 650 remote and the only way to program it is to download the "My Harmony" software from Logitech. But once the remote is setup you know longer need to software. I have had my remote for about 2 years and only needed the software twice. Once for the initial setup and months after to program some favorite channels. But Saganized is doing this frequently. Why I do not know. But either way false positives are normal. Webroot is horrible for that. It flagged MalwareBytes as malicious. 

This thread is closed from further comment. Please visit the forum to start a new thread.