Install blocked by Norton

[tommycrock]

MM4 is looking great but...
when I install the latest version (4.0.0.1423) Norton Internet Security causes an error because it thinks it detects a virus. The error is only caused by one file (winamp.exe) and the installer gives the error message

C:\Program Files (x86)\MediaMonkey4001423\winamp.exe
An error occurred while trying to rename a file in the destination directory:
MoveFile failed; code 2.
The system cannot find the file specified.

If I retry, the same occurs. If I ignore then the remainder installs without problem.
Norton gives the following details:

is-p7h98.tmp (Suspicious.Cloud)
This heuristic virus has been removed.
Very few users, very high risk.

I know you don't work for Norton but I thought I'd let you know in case you can do anything about it.
I'm guessing I can't generate a useful log file for you?

Environment details:
Existing MM 3.2.4.1304
Installing MM 4.0.0.1423
Norton Internet Security version 17.8.0.5, fully updated as far as I'm aware.
Windows 7 Home Premium SP1 64 bit | Intel P4 3GHz | 4GB

[rusty]

Thanks--I'll try to contact symantec about that.

It's just a near-empty file that allows winamp plugins that check for that filename to be installed, and runs MM when double-clicked.

-Rusty

[tommycrock]

Cheers. I've 'submitted the file to symantec' or some similar option that was available, hopefully they'll see it's fine and know how to unblock it.

[tommycrock]

Still getting the same problem :
c:\program files (x86)\mediamonkey4001436\is-1jpt9.tmp
____________________________
____________________________
On computer as of
24/09/2011 at 11:21:57
Last Used:
24/09/2011 at 11:21:57
Startup Item: No
Launched: No
____________________________
____________________________
Very Few Users
Fewer than 10 users in the Norton Community have used this file.
____________________________
High
This file risk is high.
____________________________
Threat Details
Detection of a threat based on malware heuristics.
____________________________
Origin

Downloaded from Not Available
____________________________
URL Not Available
UNTESTED

Source
is-1jpt9.tmp
____________________________
File Actions
File: c:\program files (x86)\mediamonkey4001436\is-1jpt9.tmp
Blocked
____________________________
File Thumbprint:
0a208504b38b9e7f5b964f1056d4cc40e0c6eca94aa88b31d52fd50c7cae7b3c
____________________________

[rusty]

Anyone else seeing this? I corresponded with Norton and they said they're not experiencing this problem when they test with MM builds

-Rusty

[Dreadlau]

I'm not using Norton.
But maybe you could turn off heuristic detection.

After a quick google search for "norton heuristic"
I found this: http://www.ehow.com/how_7172401_turn-of ... orton.html
Might be worth a try.

[mhilbush]

Yes, I'm seeing this, too. I haven't had a chance to sort it out, but I'll probably just disable Norton's heuristics.
Mark

[rusty]

mhilbush, tommycrock,

Can you confirm whether this problem occurs with MM3 as well?

-Rusty

[tommycrock]

I can confirm the problem does not occur when I install MediaMonkey_3.2.5.1306 (I've just tried it). I didn't have the problem previously with MM3 either.

[mhilbush]

mhilbush, tommycrock,
Can you confirm whether this problem occurs with MM3 as well?

I never saw it in MM3. In fact, 4.0.0.1397 installs without issue.

I started seeing this shortly after 4.0.0.1397, but I can't put my finger on the exact build when it first occurred...

Update: I started installing builds starting with 1398. I successfully got through 1415. Norton threw the Suspicious.Cloud error on 1416.

Update #2: I observed the following with the builds following 1416.
1418 (there is no 1417) - installs successfully
1419 - Norton throws error, install unsuccessful
1420 - installs successfully
1421 - Norton throws error, install unsuccessful
1422 - Norton throws error, install unsuccessful
1423 - installs successfully
1424 - installs successfully
1426 - installs successfully
1428 - installs successfully
1430 - Norton throws error, install unsuccessful
1431 - Norton throws error, install unsuccessful
1432 - installs successfully
1433 - Norton throws error, install unsuccessful
1434 - Norton throws error, install unsuccessful
1435 - Norton throws error, install unsuccessful
1436 - installs successfully
1438 - Norton throws error, install unsuccessful
1439 - installs successfully

In all failure cases
- MM setup complains about being unable to rename a file (winamp.exe) in the destination directory
- Norton complains about tmp files with names like: is-bqihb.tmp, is-8cu1i.tmp, is-aqai7.tmp, etc.

[Peke]

100% false positive, most likely norton tries to speed things by caching common filenames and than checking if they are executable and than throw error about of possible infections
Hate when they do that

[tommycrock]

100% false positive

I'm sure there's no virus there - it's still a bit of a problem!

1423 - installs successfully
1424 - installs successfully
1426 - installs successfully
1428 - installs successfully
1430 - Norton throws error, install unsuccessful
1431 - Norton throws error, install unsuccessful
1432 - installs successfully
1433 - Norton throws error, install unsuccessful
1434 - Norton throws error, install unsuccessful
1435 - Norton throws error, install unsuccessful
1436 - installs successfully
1438 - Norton throws error, install unsuccessful
1439 - installs successfully

Interesting, I couldn't install 1436 (without turning off Norton) at the time but can now. A lot of this list looks like which builds I installed, certainly 1423, 1424, 1428, 1432, 1436, 1439, so it looks like they're fixing the scan on a case by case basis, which at least means when the release is made it won't constantly fall over on Norton machines.

[dean1756]

Just thought I'd say that I often have trouble with Norton so I'm no fan! I can't explain why I have so many problems. Doesn't help you I'm afraid but I feel the need to tell people!!

[Pman]

Im using NIS11 atm and all builds have installed with no fuss and none of the errors mentioned above, however i did notice on some earlier builds, around 14xx+, occasionally Norton would say the download is suspicious and its at your own risk to install.

I think Norton is a much better product than the days of before 09 but it can sometimes through up a false positive (then again all other AVs do the same thing too).

I dont know what Norton you are using tommycrock and mhilbush but i would suggest to upgrade to the internet security 2011 (cheap on Amazon atm) or wait until xmas for cheap deals on NIS 2012.

[tommycrock]

Cheers Pman, good to know it's not happening for you. Don't know about mhilbush but I'm using NIS 2010. I'm just trying a free upgrade to NIS 2012, although I don't think I'll be renewing my subscription.