• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

restored file from Quarantine plus Exclude but file not listed in Exclusion list

I followed advice about restoring a file from quarantine and to exclude it from being a target of Auto-protect, and then submitted the suspect file to Norton/Symantic.    See postings here:  https://community.norton.com/en/comment/7279201#comment-7279201

Now, I checked in Settings, AntiVirus, and looked at the Configuration+  to check what is shown in the exclusion list.  Nothing is shown there.  If I chose to exclude the file with the file's restoration, then I should expect to see something about it listed in this exclusion list, but NOTHING is shown there.  

Now, in case the file really is a threat, Norton Security has no way of allowing Autoprotect to spot it again and to quarantine it; or since the item is not listed in the exclusion list, Autoprotect should not know to exclude it, in case the file really is not a threat.  I am confused.

Replies

Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

Hello

Restoring a file from Quarantine does not always restore it to original location. Have you tried doing a Search for the file? Did you send the file to Virus Total to see what they say about the file? Did you get a reference number or tracking number from Symantec? They should respond within a day or 2.

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

floplot such questions:

No choice was offered of where to restore the file to, but I will look in the expected directory to be sure.

I'm not familiar with Virus Total.  I only knew to submit to Symantec, and used the earlier submission site a member from the other link gave to me.

Symantec gave a reference number for the file-submission.

Does any of that make any meaning about the exclusion list not showing the excluded restored item?

Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

What component of Norton actually quarantined the file originally?  Was it SONAR, for example?

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

Auto-Protect quarantined the item.  

Symantec sent me a email note about my submission, saying that what I submitted was determined to be a false positive, and that Symantec will remove it from their list.  (Is it acceptable to give the submission number here on the forum?).

Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

Hello

I was just going to ask you for the submission number. bit it seems like you got your answer already. I was going to see if I could speed it along on Monday.

Virus Total will give you a report almost instantly if a file is malicious and which companies say it's clean or malicious. You can send a file or a website.

www.virustotal.com    You can take a look around the site if you want to or test out some file so you can see how it works.

Thanks.

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

My question here is about understanding the Exclusion list for Autoprotect, Sonar,...

When I chose to restore, I checked the box for (YES, kept it with the checkmark) Exclude from further action by Autoprotect.  When I look in that exclusion list, NOTHING IS SHOWN.

Kudos3 Stats

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

The AutoProtect and SONAR exclusion lists are internal and not view-able / editable by the user.  They can be added to (as you have done when restoring the file from Quarantine) but for security reasons, not edited by the User.

The User does have total control over items that are completely manually added to the Exclusion Lists; that is, any process, files or folders that are added to the Exclusion Lists by the User (not by a Norton process) are visible and editable by the User.

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

dbrisendine,

That description about what is and is not in the exclusion list seems like a risk.  We should have a way to recheck or let the computer recheck the restored item again, if the item really is a risk or an infection.  In my current case, I assume nothing is really wrong with the quarantined and then restored item.  An email from Symantec told me so.  At least, I should be able to do a custom scan, and in case a file is a high risk, the custom scan should tell me and give a way to remove or quarantine, even if Auto-protect would no longer do it for the item.

Kudos2 Stats

Re: restored file from Quarantine plus Exclude but file not listed in Exclusion list

It would seem like a risk except that Norton has the final word in your safety and security.  The file is still scanned but the outcome is different when you restore and exclude.  The logic goes something like this:

Is the file changed?

Is the definition changed (level of threat is part of this also)?

If both of these are negative then the file is ignored and everything seems OK.  If either is changed, then the file is scanned and the threat level is accessed to see if it is now high enough to trigger a protective over-ruling of the User exclude (remember that now this [the file / definition combo] is not EXACTLY what the User Excluded earlier).

Win10 x64; Proud graduate of GeeksToGo

This thread is closed from further comment. Please visit the forum to start a new thread.