Bug 5331 - Jive connexions to slim.exe detected as "worm" by Norton AV after reinstalling SlimServer 7.0
: Jive connexions to slim.exe detected as "worm" by Norton AV after reinstallin...
Status: RESOLVED INVALID
Product: Logitech Media Server
Classification: Unclassified
Component: Misc
: 7.0
: PC Windows XP
: P2 normal (vote)
: ---
Assigned To: Squeezebox QA Team email alias
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2007-08-28 16:58 UTC by David Barbey
Modified: 2007-08-29 00:43 UTC (History)
0 users

See Also:
Category: ---


Attachments
Norton Programs Control window (27.78 KB, image/jpeg)
2007-08-28 17:00 UTC, David Barbey
Details
Norton Pop Up window (43.04 KB, image/jpeg)
2007-08-28 17:01 UTC, David Barbey
Details

Note You need to log in before you can comment on or make changes to this bug.
Description David Barbey 2007-08-28 16:58:48 UTC
I have noticed that each time after installing a new version of SlimServer 7.0(nightly build) my Norton Antivirus asks me to re-authorized slim.exe (my Jive remote being detected as a worm intrusion trying to access slim.exe)
Usually Norton would only ask you once to authorize a suspicious intrusion.. then create the rule for you and off you go. 
But in this very case, as the slim.exe file has already been authorized (because of previous installation) but obviously has a different version id, there is some kind of conflicts and Norton do not create or overwrite the rule for you.
In order to stop it, here is what you have to do:
- Open your Norton Antivirus application
- Go in Options tab
- Choose the Internet worm protection option (guessed translation from a French Norton)
- Click on Programs control button
- Scroll down to slim.exe and select it
- Press Delete button
- Press OK button and close the antivirus interface
A few seconds later, Norton should prompt you once again to authorize the connection to slim.exe. Select "Authorize" from drop down list and press OK to close the window.
Hope this helps.
Comment 1 David Barbey 2007-08-28 17:00:33 UTC
Created attachment 2123 [details]
Norton Programs Control window
Comment 2 David Barbey 2007-08-28 17:01:02 UTC
Created attachment 2124 [details]
Norton Pop Up window
Comment 3 Michael Herger 2007-08-29 00:43:29 UTC
That's normal behaviour for this kind of protection: Norton notices that the authorized binary file (slim.exe) has been replaced by a new one. It therefore is asking you again. Otherwise worms and the like would simply install itself as eg. iexplore.exe or attach themselfs to that file, as it's been authorized to access the internet.

It's a feature, not a bug.