• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Windows Defender blocked a Norton Security file?

I just got this Window Defender warning, see attached file

-------

file: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NGC_22.16.2.22\CmnClnt\00025424.tmp

file: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NGC_22.16.2.22\CmnClnt\00030754.tmp

------

Norton HIstory shows 2 Windows Defender blocks at that same time, and they occur every 1/2 hour it seems as well (the blocks in Norton History happening that is)?

Replies

Kudos0

Re: Windows Defender blocked a Norton Security file?

Hello ispalten. Just an FYI, most users here on the forums won't open a .pdf file as a screenshot for obvious security reasons. Here is some info about how to post a screenshot directly into your posts.

My question about Windows Defender is do you have WD set for real time scanning? You can check for that using the information in this MS article.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows Server 2016 Essentials / Windows 10 Professional x 64 version 1903 / build 18362.449 / N360 Deluxe 22.19.8.65 / Norton Core v.288 on Android 2.21 / Opera GX
Kudos0

Re: Windows Defender blocked a Norton Security file?

Hmm, I'm on W10 Home, no Group Policy Editor?

Can't tell from settings, but I don't think so? There is an option I see for PERIODIC SCAN and it is OFF... and Norton seems to be in control?

I did try post JPG's, says not allowed?

--------

Allowed file types: txt pdf zip.

--------

When I tried it would not do it?

-------------

The selected file Capture.JPG cannot be uploaded. Only files with the following extensions are allowed: txt, pdf, zip.

-------------

I've added the JPG's here as a ZIP...

Posted them here... sorry, forgot about the IN-LINE way.

File Attachment: 
Kudos0

Re: Windows Defender blocked a Norton Security file?

The threat being detected is Adware and is considered a "HIGH" threat according to this Microsoft article. The detection was caught by Norton as shown in your screenshots and windows defender appears to be the target program. still you are protected. Nevertheless, I recommend downloading and running a full scan with Malwarebytes, it will look for items like PUP's and other malware Norton doesn't focus on. Please let us known what your results are so we can follow up.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows Server 2016 Essentials / Windows 10 Professional x 64 version 1903 / build 18362.449 / N360 Deluxe 22.19.8.65 / Norton Core v.288 on Android 2.21 / Opera GX
Kudos0

Re: Windows Defender blocked a Norton Security file?

It seems like some sort of real-time scan with Defender is enabled at the same time as Norton's real-time protection. While they shouldn't cause major problems if they're both on at the same time, it's better to just use one.

Double-check that Norton is enabled as the default scanner in the Threat Protection settings in Windows:

The warnings from Norton about Defender accessing process and thread data are benign, but they do indicate that some sort of periodic Defender scan is happening. In this case it's probably best to instruct Defender to ignore/exclude the Norton temporary folder from scanning.

--David

Kudos0

Re: Windows Defender blocked a Norton Security file?

Um, what does your Services report for Windows Defender?
Um, what does Virus & threat protection report?

Edit: I C dkane

Kudos0

Re: Windows Defender blocked a Norton Security file?

I think one of us read that wrong?

The top screen capture is of Windows Defender. The 2nd and 3rd are from Norton's History.

Top one is the one that called it a threat. The other 2 are Norton reporting that Windows Defender is trying to open Norton's main file.

At least that is how I read it?

Both of the files are located in C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NGC_22.16.2.22\CmnClnt, which is a Norton sub-folder. The .TMP files of course are not there now. Could they have been updates? Tried LiveUpdate but there are no updates to run.

I'm running SpyBot Search & Destroy now and then I'll run Malware Antibytes... usually they will find some cookies and PUP's though.

Kudos0

Re: Windows Defender blocked a Norton Security file?

Yes, mine is identical:

Periodic Scanning is  OFF as well. Have to turn that on it seems to exclude WD from the Norton Folder? When I do turn it on, Norton complains and wants it turned off?

It must be very random that this hits? Otherwise I'd probably get that warning everytime WD ran? No?

Kudos0

Re: Windows Defender blocked a Norton Security file?

See my reply above, WD info is the same.

Services, not the case:

Hmm, I just looked again and the Network Inspector is running?

It seems I can't do anything though, can't stop it or change Startup?

Kudos0

Re: Windows Defender blocked a Norton Security file?

Yes, as dkane wrote: <here>

"It seems like some sort of real-time scan with Defender is enabled at the same time as Norton's real-time protection." 

and the "Unauthorized access blocked" simply means Windows Defender is bumping into Norton.  

Kudos0

Re: Windows Defender blocked a Norton Security file?

Windows Defender should automatically disable itself when the Norton product registers as the anti-malware provider. Either it's not recognizing the Norton installation, or Defender's internal configuration is broken. I'm no expert on Defender, so I can't give definitive steps to fix it, but some Googling led me to an article with steps that look helpful (I make no guarantees about the content referenced):

https://superuser.com/questions/1372360/cant-re-enable-windows-defender-service-even-as-administrator

--David

Kudos0

Re: Windows Defender blocked a Norton Security file?

David, I think I'm going to wait and see if it happens again. Even that link wasn't a real help as it required the Group Policy to turn it off.

I found links to add exclusions but when I use the steps, V1903 of W10 doesn't look like that?

Checked wife's PC (w10 Pro V1903) and none of the services are running and WD is enabled like mine and same Norton Security installed and is active?

I'm going to REBOOT. It is possible messing with that setting to run it started everything. On wife's PC I can change how the services run too...

Kudos0

Re: Windows Defender blocked a Norton Security file?

David, I re-booted... NO CHANGE! All 3 services are running, Norton is the main protection, and it is clear this PC is different somehow from my wife's?

I had NEVER gotten that warning from WD before?

I even looked here:

After REBOOT all 3 WD services are running? I must have hit a time before when it stopped, or it was due to me playing around with the 'periodic' button turning it on, Norton complaining and I allowed it to turn it off, then I looked, and after that it restarted????

Like I said, I'll wait and see if I get a warning again I guess? Not sure why my PC is different from my wife's and even the one screenshot above where only 1 service was running (and she had NONE and WD says Norton is active?)?

Kudos1 Stats

Re: Windows Defender blocked a Norton Security file?

Windows Defender Firewall Service is supposed to be Running - Automatic. 
Windows Defender Firewall Service is required for Windows Updates. 

Were my machine.  I'd remove Norton.  I'd run Windows Defender Antivirus for 24/h....thru a few machine restarts.
Then, I'd reinstall Norton and confirm Norton install disables Windows Defender Antivirus.  

Kudos0

Re: Windows Defender blocked a Norton Security file?

FWIW!! As bjm's screenshot states the Windows Defender firewall WILL remain running in services since it is REQUIRED for windows updates to function. If Norton has been correctly installed, ALL OTHER WD SERVICES should be set to manual startup types by the OS as it will detect a third party antiviral solution on the system. I'm in concert with bjm.  Performing an R&R on Norton should correct the issue, please ensure you have fast startup DISABLED before doing the R&R and perform a "remove only" scenario and rebooting. 

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows Server 2016 Essentials / Windows 10 Professional x 64 version 1903 / build 18362.449 / N360 Deluxe 22.19.8.65 / Norton Core v.288 on Android 2.21 / Opera GX
Kudos0

Re: Windows Defender blocked a Norton Security file?

I posted 12 minutes before you my PRIVATE NETWORK settings, note that it states WD is not running?

I may do what you say, delete Norton, do a few reboots and re-install? Can't figure out thought if the WD Firewall service is required for Windows Updates, how is my Wife's PC getting updates if it isn't running? Do these start via a 'timer', do something, check whatever, and then stop until the next cycle?

Kudos1 Stats

Re: Windows Defender blocked a Norton Security file?

No Fast boot... I'll work on the removal and re-install. Removing Norton now.

Kudos0

Re: Windows Defender blocked a Norton Security file?

Make sure you reboot your system a few times BEFORE reinstalling Norton. Give Windows a few rounds to readjust to not having norton on the system.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows Server 2016 Essentials / Windows 10 Professional x 64 version 1903 / build 18362.449 / N360 Deluxe 22.19.8.65 / Norton Core v.288 on Android 2.21 / Opera GX
Kudos0

Re: Windows Defender blocked a Norton Security file?

Rebooted and checked to see that WD is fully engaged, it is. Norton is clearly NOT running at all. Checked with Task Manager, nothing named Norton or Symantec running, and confirmed with WinPatrol which I use as well.

Will run for awhile, boot a few times and re-install tomorrow morning.

Will report back tomorrow.

I do see Virus and Threat Protection screens in Setting that is different. I can at this point add EXCLUSIONS... but look at what it shows:

I did NOT remove NS data, and it seems that was left I guess? So the actual problem that the Folder, C:\ProgramData\Norton, where the file resides is NOT in the list.

The filename is a TMP file though? I don't know why it would have a tmp file there? Wonder if it was just a fluke as both Norton and WD were doing something at the same time?

Of course, my Service settings for WD seemed messed up too? Even now, with Norton off the PC all 3 services are running.

We'll what tomorrows results are I guess?

Kudos0

Re: Windows Defender blocked a Norton Security file?

ispalten: WinPatrol which I use as well.  

 WinPatrol detects and prevents changes to important Windows settings.  

Is WinPatrol still a viable product?

The latest version on their website is 35.5.2017.8 & was released on May 7 2017.

https://www.wilderssecurity.com/threads/is-winpatrol-still-a-viable-product.406236/

WinPatrol plus no longer developed?

Sadly this year I found that WP was causing an important Windows 10 update not to be installed- so I felt it was finally time to euthanize that Pesky Pup on my system.

https://malwaretips.com/threads/winpatrol-plus-no-longer-developed.86426/#post-761713 

Kudos0

Re: Windows Defender blocked a Norton Security file?

Hmm, didn't know that about WinPatrol? I get newsletters randomly and there is a 2019 copyright? I've had no problems that I know of with W10 either. I like the warnings I get when start-ups change. The link above is old, but other Google searches sort of confirms it I guess?

I'll probably remove that as a precaution before installing NS again.

Thanks.

Kudos0

Re: Windows Defender blocked a Norton Security file?

ispalten:

Of course, my Service settings for WD seemed messed up too? Even now, with Norton off the PC all 3 services are running.

~ my machine without Norton

Kudos0

Re: Windows Defender blocked a Norton Security file?

bjm_:

~ my machine without Norton
 

Same here for Services,  but my scan took longer but it was yesterday, PC might have been busy?

I'm running a new Quick Scan now. Wow, not sure why but my file count doing the scan 'manually' by pressing Quick Scan is a lot higher, over 30,000 files?

I suspect the difference could be only the C: done on the first one above, and the manual one hits ALL partitions (I have 3)? Not sure what it looks at? On the C: there are almost 50,000 files but many are not executable files either?

I'm going to re-install NS now.

Kudos0

Re: Windows Defender blocked a Norton Security file?

bjm_:

Um, what does your Services report for Windows Defender?

OK, after the re-install, my services looks the same:

Don't know what happened? WD still shows Norton is the protection just like before?

I guess this is closed then, but still don't know how/why I got the alert/warning I posted in my first message?

Kudos0

Re: Windows Defender blocked a Norton Security file?

Seems to be solved.

Kudos1 Stats

Re: Windows Defender blocked a Norton Security file?

I'm running a new Quick Scan now. Wow, not sure why but my file count doing the scan 'manually' by pressing Quick Scan is a lot higher, over 30,000 files?

This could be similar to what Norton does. A scan can identify certain files that do not need to be scanned again in subsequent scans. But when new virus definitions are downloaded, those files will be scanned again to test for the latest malware detections.

Things happen. Export/Backup your Norton Password Manager data.

This thread is closed from further comment. Please visit the forum to start a new thread.