Newsroom | Symantec Newsroom Symantec in the News Symantec to acquire LifeLock for $2.3 billion Symantec Corp (SYMC.O) said it would acquire U.S. identity theft protection services company LifeLock Inc (LOCK.N) for $2.3 billion, in a deal that it hopes will prop up sales at its Norton cybersecurity unit. 11/20/16 Liana B. Baker and Greg Roumeliotis, Reuters Using public Wi-Fi? Hackers may be picking your digital pocket Going online with computers or smart telephones over public WiFi can pose a significant risk of becoming victim of cybercriminals. 11/16/16 Tim Johnson, McClatchy Symantec: Gatak Trojan's top target is now healthcare sector The security vendor said the group behind the malware intensified its focus on healthcare organizations because the data is more valuable than other industries and providers commonly use legacy software that is not as secure as upgraded versions.

11/23/16 Jack McCarthy, Healthcare IT News Recent Press Releases Norton Introduces Elegantly Designed Norton Core, A Digital Safety Solution for Connected Homes New High-Performance Wi-Fi Router, Built from The Ground Up to Secure Home Networks and IoT Devices, Will Come Bundled with Subscription to Award-Winning Norton Security. Star Malware Protection Technologies | Symantec Star Malware Protection Technologies Remediation Overview Security Technology and Response (STAR) is the Symantec division responsible for the innovation and development of our security technologies, which address protection in five areas: file, network, behavior, reputation, and remediation. Within Symantec, Security Technology and Response (STAR) oversees the research and development efforts for all of our malware security technologies. These form the core protection capabilities of Symantec’s corporate and consumer security products. The Security Technology and Response (STAR) organization, which includes Security Response, is a worldwide team of security engineers, threat analysts and researchers that provide the underlying functionality content and support for all Symantec corporate and consumer security products.

With Response centers located throughout the world, STAR monitors malicious code reports from more than 130 million systems across the Internet, receives data from 240,000 network sensors in more than 200 countries and tracks more than 25,000 vulnerabilities affecting more than 55,000 technologies from more than 8,000 vendors. The team uses this vast intelligence to develop and deliver the world’s most comprehensive security protection. There are approximately 550 employees in STAR. Some years ago, traditional antivirus technologies were all that was needed to protect an endpoint from attack. However, with the dramatic shift in the threat landscape over the last few years, it is no longer reasonable to think that antivirus-based technologies alone are sufficient. To address this, STAR has developed a collaborative eco-system of security technologies to protect Symantec’s users from malicious attacks.

Top Threat Vectors these technologies protect against: Drive-by Downloads and Web Attacks Social Engineering Attacks – FakeAV and Fake Codecs Bots and Botnets Non-Process and Injected Threats (NPT) Targeted Attacks including Advanced Persistent Threats (APT), Trojans and general Malware Zero-day threats Malware as the result of drive-by downloads that bypassed other layers of protection Malware using rootkit techniques to hide This eco-system is comprised of the following five areas that work in collaboration: File-Based Protection continues to play a major protection role due to new innovations in static file heuristics. Network-Based Protection can detect when both known and unknown vulnerabilities are used to enter a user's system. Behavior-Based Protection looks at the dynamic behavior of malicious activity rather than static characteristics. Reputation-Based Protection examines the meta information of a file – its age, origin, how it travels, where it exists, etc. Remediation is a set of technologies that can help clean up an infected system. By collaborating, each technology is able to operate more efficiently and more effectively to determine whether a given situation is malicious or not. As each technology learns different attributes about a process or a file, it will share what it learns with the other technologies.

For example, the network-based protection technologies are able to track where web downloaded files originate and thereby share this information with the other technologies. Greater detail of each technology type can be found on the following tabs. File-Based Protection A common misconception about antivirus file scanners is that they simply look for known patterns in files in order to determine if a file is good or bad. Actually, modern antivirus solutions go beyond simple pattern matching and apply generic and heuristic techniques when looking for threats. In fact, the best antivirus engines provide multiple methods for identifying known and unknown threats. Symantec’s file-based protection is one such technology. File-based security has a long history as one of the cornerstones of our protection technologies. STAR continues to invest in and drive innovation to our file-based security to keep current with the latest developments on the threat landscape. Having infected files on a target machine is one of the main methods for threats to maintain a presence on a machine beyond the initial attack. Because of this, file-based protection will always be instrumental in detecting, neutralizing and removing threats on our customers’ machines.

Common threat vectors that file based technology protects against include: Malware and Viruses Spyware and Adware Keyloggers In order to address these threats, four components form the core of our file-based protection technology: the antivirus engine, Auto Protect, the ERASER engine, and our heuristic technologies, Malheur and Bloodhound. Antivirus Engine Symantec's unique scanning engine is broadly deployed on over 350 million machines. It is a stable, high-performance security technology providing advanced detection against the latest threats. The engine is frequently updated in the field via LiveUpdate to seamlessly respond to new threats. This allows us to update the detection capability of our product without requiring a complete product update. Auto Protect Symantec’s real-time file scanner detects threats being written to or from a file system. Written at the kernel level, Auto Protect is a high-performance and low-footprint scanning engine that protects against the latest threats while staying out of the user's way. When files are written to a machine’s disk, Auto Protect is triggered and uses the antivirus, Malheur and Bloodhound engines to scan the files. By running at such a low level, Auto Protect can block an infected file before it has a chance to run and infect the system.

In addition to file protection, Auto Protect delivers key functionality for Download Insight, part of our advanced analytics reputation technologies. ERASER Engine Symantec’s ERASER engine provides repair and removal capability for threats found on a customer’s system by our various detection technologies. ERASER is also responsible for checking that drivers and applications that run at startup are not malicious. To ensure that our product is not being tricked by rootkits or other malware, ERASER uses a number of techniques that bypass regular system registry and disk lookups. These technologies allow ERASER to perform direct registry and direct disk access. Malheur & Bloodhound In addition to signature based detections, we provide technologies that can convict a file that has never before been seen, but has characteristics common to malicious files. This heuristics-based protection is provided in our Malheur & Bloodhound technologies. Heuristic signatures can detect unknown malware based on file attributes,attempts to exploit vulnerabilities, and other common actions found in known malware. A Deeper Dive into Features Each of the following sections describes a file-based technology feature that is intrinsic to the core components explained above.

Broad File Support Compressed files and files embedded inside other files are among the broad set of file types that can be examined for hidden malware.

A partial list of analyzed file types include: DOC, .DOT, .PPT, .PPS, .XLA, .XLS, .XLT, .WIZ, .SDW, .VOR, .VSS, .VST, .AC_, .ADP, .APR, .DB, .MSC, .MSI, .MTW, .OPT, .PUB, .SOU, .SPO, .VSD, .WPS, .MSG ZIP, .DOCX, .DOCM, .DOTX, .DOTM, .PPTX, .PPTM, .PPSX, .PPSM, .XLSX, .XLSB, .XLSM, .XLTX, .XLTM, .XLAM, .XPS, .POTX, .POTM, .ODT, .OTT, .STW, .SXW, .eml, .MME, .B64, .MPA, ,AMG, .ARJ, .CAB, .XSN, .GZ, .LHA, .SHS, .RAR, .RFT, .TAR, .DAT, .

ACE, .PDF, .TXT, .HQX.

.MBOZ, .UUE, .MB3, .AS, .BZ2, .ZIP, .ZIPX Unpacker Engine In some cases, malware will use “packer” technology to obfuscate their files in an attempt to avoid detection by simplistic pattern matching algorithms. Our Unpacker Engine can: Decompresses affected executable files. Recognize hundreds of distinct packer families. Recursively unpack files that are multiply-packed until the core malware is reached. Generic Virtual Machine The GVM allows code to be executed in a sandboxed safe-environment. Byte code-based system like Java or C#, making it extremely safe to rapidly produce new protection technologies without crashes or hangs. Applies extremely complex heuristics and family signatures, for threats like Trojan.Vundo . Performs all scanning of non-traditional file formats; e.g., PDF, DOC, XLS, WMA, JPG, etc. Anti-Polymorphic Engine Includes advanced CPU emulation technology to trick polymorphic malware into de-cloaking. Anti-Rootkit Technology Symantec has 3 different anti-rootkit technologies designed to find and remove even the most stubborn rootkits like Tidserv and ZeroAccess, working around stealthing techniques commonly used by rootkits.

The techniques include: Directly access the hard drive volumes. Direct Registry Hive scanning. Kernel memory scanning. Anti-Trojan Engine Includes advanced hashing techniques to simultaneously scan for millions of Trojans and spyware threats in microseconds. Locates and extracts key file regions known to contain malware logic. Takes cryptographic hashes of each section and looks them up in the fingerprint database. Advanced algorithms enable the Anti-Trojan Engine to simultaneously scan for tens of millions of malware strains in literally microseconds. Photon Engine Uses 'fuzzy' signatures to identify both known and new, unknown malware variants. Scans files using hundreds of thousands of fuzzy signatures simultaneously, drastically improving scan performance. The fuzzy signatures can detect entirely new malware strains the moment they're released. Advanced Heuristic Engines Focused detection of server-side polymorphed strains. Over a dozen different heuristics (and growing) search for different suspicious file characteristics. All suspicious files are correlated against Symantec’s reputation cloud and our digital signature trust list. Engines use context to adjust heuristic sensitivity; e.g., heuristics are more suspicious of newly downloaded files than of installed applications. Symantec Products From BootRoot to Trojan.Mebroot: A Rootkit in Your MBR!

Network Network-based protection is a set of technologies designed to block malicious attacks before they have a chance to introduce malware onto a system. Unlike file-based protection that must wait until a file is physically created on a user’s computer, network-based protection starts to analyze the incoming data streams that arrive onto a user’s machine via network connections and blocks threats before they hit the system. Top Threat Vectors Symantec’s Network-Based technology protects against: Drive-by Downloads and Web Attack Toolkits Social Engineering Attacks – FakeAV and Fake Codecs Attacks via Social Media such as Facebook Detection of Malware, Rootkit and Bot Infected Systems Obfuscated Threat Protection Protection from Unpatched Software Vulnerabilities Protection from Malicious Domains and IP addresses This category consists of three distinct protection technologies: Network Intrusion Prevention Solution (Network IPS) The protocol-aware IPS understands and scans over 200 different protocols. It intelligently and accurately breaks apart binary and network protocols looking for signs of malicious traffic. This intelligence allows for highly accurate network scanning while delivering robust protection. At its heart is a generic exploit-blocking engine, which provides evasion-proof blocking of attacks on vulnerabilities. A unique feature of the Symantec IPS is that no configuration is needed to enable Network IPS protection capabilities out of the box.

Every Norton consumer product and every Symantec Endpoint Protection 12.1 and later enable this crucial technology by default. Browser Protection This protection engine sits inside the browser and can detect the most complex threats that traditional antivirus and Network IPS methods are unable to detect. Many network-based attacks today use obfuscation to avoid detection. Because Browser Protection operates inside the browser it is able to watch de-obfuscated code as it executes and so is able to detect and block attacks which are missed at lower layers of inspection within the protection stack. Un-Authorized Download Protection (UXP) Within the Network-based protection layer, this last line of defense helps mitigate unknown and unpatched vulnerabilities, without the use of signatures, providing a further layer of insurance against zero-day attacks. Targeting the Problems Together these network-based protection technologies address the following problems. Drive-by Downloads and Web Attack Toolkits Leveraging the Network IPS, Browser Protection, and our UXP technology, Symantec’s Network Threat Protection technologies block drive-by downloads and keep malware from ever reaching the end system. We use a variety of prevention methods with these technologies including our Generic Exploit Blocking technology (mentioned below) and our generic web-attack toolkit detection.

Our generic web-attack toolkit detection analyzes network characteristics of common web-attack toolkits regardless of the vulnerabilities being attacked delivering additional zero-day protection against new vulnerabilities as well as protection against the web-attack toolkits themselves. The best part of this protection against Web Attack Toolkits and Drive-by downloads is that the malware that would have silently infected a user's system is proactively stopped and kept off the system, something usually missed by traditional detection technologies. Symantec continues to block tens of millions of variants of malware that are not usually detected by any other means. Social Engineering Attacks Since our protection technologies are looking at the network and browser traffic as it is being rendered, we are able to use the intelligence of the endpoint to determine if a social engineering attack, like a fake antivirus solution or fake codec, is popping up. Our technologies work to block social engineering attacks before they are displayed, thwarting their attempts to trick the end-user. Most of the other competitive solutions do not include this powerful capability. Our solution stops millions of attacks that, if left to execute, other traditional signature-based technologies would normally not detect. Symantec blocks hundreds of millions of social engineering attacks with the network threat protection technology.

Attacks targeting Social Media Applications Social Media applications have become a way to instantly share personal and professional updates and interesting videos and information to thousands of our friends. This instantaneous quest for updates and the breadth of those networks also mean it is key focus of hackers to also use this to infect you. Some of the common hacker techniques include compromising accounts and sending out spam or malicious links, tricking users into taking fake surveys, or Facebook “Likejacking” attacks where a user is lured into clicking on a link to watch a video while an invisible ‘Like” button follows your mouse cursor around. You instantly Like the update whether you intended to or not. Symantec’s IPS technology can protect against these types of attacks often thwarting them before the user is ever tricked into clicking on something. Symantec stops rogue and malicious URLs, applications and scams with the Network based protection technology. Detection of Malware, Rootkit and Bot Infected Systems Wouldn’t it be nice to know where infected computers are in your network? Our Network IPS solution provides this capability and includes detection and remediation of threats that might have been able to bypass other protection layers. We detect malware and bots trying to ‘phone-home’ or get updates to spread more malicious activities.

This gives IT managers, who have a clear punch-list of infected systems to investigate, the assurance that their enterprise is secure. Polymorphic and challenging threats using rootkit methods to hide such as Tidserv, ZeroAccess, Koobface and Zbot, can be detected and stopped using this method. Obfuscated Threat Protection Today’s web-based attacks use complex methods to hide or obfuscate attacks. Symantec’s Browser Protection sits inside the browser and can detect highly complex threats that traditional methods usually do not. Zero-Day and Unpatched Vulnerabilities One of our more recent protection additions is our added layer against zero-day and unpatched vulnerabilities. Using signature-less protection, we intercept System API calls and protect against malware from being downloaded – what we call our Un-Authorized Download Protection (UXP). This is the last line of defense within our Network Threat Protection technology and helps mitigate unknown and unpatched vulnerabilities without the use of signatures. This technology is enabled automatically and has been shipping since the debut of Norton 2010. Protection From Unpatched Software Vulnerabilities Malware is often silently installed on systems by exploiting software vulnerabilities.

Symantec’s Network Protection solutions provide an additional layer of protection called Generic Exploit Blocking (GEB) technology. Regardless if a system is patched or not, GEB ‘generically’ protects against the exploitation of underlying vulnerabilities. Vulnerabilities within Oracle Sun Java, Adobe Acrobat Reader, Adobe Flash, Internet Explorer, ActiveX controls, or QuickTime are commonly found in today’s threat landscape. We created our Generic Exploit Blocking protection by reverse engineering how the vulnerability could be exploited and then looking for the characteristics of the exploitation on the network, essentially providing a network-level patch. One single GEB or vulnerability signature can protect against thousands of variants of malware that Symantec or other security vendors have not seen before. Malicious IP and Domain Blocking Symantec’s Network-based Protection also includes Malicious IP and Domain blocking capabilities preventing malware and malicious traffic from ever coming from known malicious websites. By leverage analysis from the Security Technology and Response team to find malicious websites and update them via LiveUpdate, Symantec delivers real-time protection against the continually changing threats. Improved Evasion resistance Additional encoding support has been added to improve detection efficacy and improve evasion resistance in attacks when encoded with common techniques like base64 and gzip.

Network Audit Detection for Policy Use Enforcement and Data Leakage Identification Network IPS can be used to identify applications and tools that may violate corporate use policies or be used for stop Data leakage protection via the network. It is possible to detect, alert or prevent traffic such as Instant Messaging, Peer to Peer, Logging in to open share, Social media and other 'interesting' traffic. STAR Intelligence Communication Bus The Network Protection technology doesn’t work by itself. This engine shares intelligence with our other protection technologies using the STAR Intelligence Communication Protocol (STAR ICB). The Network IPS engine communicates with the Symantec SONAR engine as well as the Insight Reputation engine allowing for more informed and accurate protection that no other security company can deliver. Symantec Products Norton Browser Protection: Protecting you from web attacks Behavior-Based Protection Millions of end users today are tricked into clicking on malware that are masquerading as video players or rogue antivirus applications that do nothing except infect the user and social engineer the user into paying for software that doesn’t do anything. Drive-by downloads and web-attack toolkits are silently infecting users who visit mainstream websites by the hundreds of millions. Some malware will install rootkits or inject malicious code into running programs and system processes.

Malware today can be dynamically generated rendering file-based detection insufficient for protecting end users systems. Why Behavior-based security? In 2010, Symantec saw more than 286 million variants of malware and blocked more than 3 Billion attacks. With the continued growth of malware threats and variants, Symantec saw the need to create industry-leading innovative approaches that to prevent malware infections and to protect users silently and automatically no matter what the end user does or how the malware gets on the end users systems. Symantec’s Insight Reputation Technology and our Symantec Online Network for Advanced Response (SONAR) behavior-based security are two of those innovate approaches. Behavior-based security technologies are best positioned to scale to this rate of rapid growth due to the fact that behaviors can generalize a vast population of malicious files and good files far better than file-based heuristics. Behaviors hardly change or cannot be changed very easily without serious effort that is detrimental to malware propagation and creation strategies. Behavior-based protection technology provides an effective and non-invasive protection from previously unseen zero-day computer threats. SONAR is the solution that provides protection against threats based on what the application does rather than what the application looks like.

SONAR is the main engine of our behavior-based technology and features: a classification engine based in artificial intelligence, human-authored behavioral signatures, and a behavioral policy lockdown engine. Together these components combine to provide industry-leading security protection against threats that are most often social engineered and targeted attacks. Top Threat Vectors Symantec’s Behavior-Based technology protects against: Targeted Attacks including Advanced Persistent Threats (APTs), Trojans, Spyware, Keyloggers and general Malware Social Engineering Attacks – FakeAV, Rogue Key Generators and Fake Codecs Bots and Botnets Malware as the result of drive-by downloads that bypassed other layers of protection Malware using rootkit techniques to hide When does the Symantec Behavior Based technology layer provide protection? No matter if the user executes the malicious application on purpose (tricked by social engineering) or malware attempts to automatically and silently get installed by a web-based attack like a drive-by download, SONAR stops malware from infecting systems in real-time after the malware is executed or started or tries to inject itself into running processes (NPTs).

Providing zero-day protection against Hydraq/Aurora, Stuxnet, as well as malware embedding rootkits like Tidserv and ZeroAccess have shown SONAR is an essential technology for endpoint protection. How does it work? Classification Engine Based in Artificial Intelligence Symantec has built up one of the world’s largest databases of behavioral profiles on nearly 1.2 billion application instances. By analyzing the attributes of what good applications and bad applications do using machine learning analysis, Symantec is able to create profiles of behaviors for applications that haven’t even been created yet! Relying on almost 1,400 different behavioral attributes and rich context that we can gather from our other endpoint security components such as the Insight, IPS, and AV engine, the SONAR classification engine is quickly able to spot malicious behaviors and take action to remove bad applications before they do damage. In 2011, more than 586 million executables, dll’s and applications were analyzed by SONAR for Norton and Symantec customers. Non-process Based Threat Protection Today’s threats are not always just standalone malware executables.

They try to hide as soon as possible by injecting into commonly running processes, applications or registering components to extensible applications, thereby concealing their malicious activity on behalf of trusted OS processes or trusted applications. As an example, when a malware runs, it can inject malicious code into running processes, such as explorer.exe (desktop shell process) or IExplorer.exe (Internet Explorer browser) or register malicious components as extensions to such applications. Henceforth the malicious activity is exhibited by well-known and trusted OS components. SONAR prevents the code from being injected into the target process by classifying the source process that attempts the injection. It also classifies and if necessary prevents malicious code from being loaded or executed in the target/trusted process. Behavioral Policy Lockdown Drive-by downloads work by exploiting vulnerabilities in browser plugin such as Adobe Reader, Oracle Sun Java, and Adobe Flash. After the vulnerability has been exploited the drive-by download can get the vulnerable application to silently launch any application it wants. By creating a behavioral policy lockdown definition, we can block malicious behaviors such as “Adobe Acrobat should not be creating other executables” or “dll’s should not be allowed to be inject into the explorer.exe process thereby protecting the system.

This can be described as locking down a behavior based on a policy or rule. These SONAR definitions/policies are created by the Symantec STAR team and automatically deployed in blocking mode and require no management by the customer. This prevents suspicious behaviors from good applications and automatically protects users. Behavioral Policy Enforcement (BPE) Signatures Being able to evolve with the continually changing threat landscape is the essential part of our SONAR technology and our protection is expanded with the ability to target tomorrow’s threats as well. When a new family of threats is seen, such as a new rootkit, Trojan, FakeAV or other type of malware, we can now create new behavioral signatures in order to detect a new family of threats and release them without having to do code updates to the product. These are called SONAR Behavioral Policy Enforcement signatures. These signatures are fast to write, test, and deploy and they give SONAR the flexibility and adaptability to respond to certain classes of emerging threats with a very low false-positive rate. We have many SONAR BPE signatures targeting FakeAV misleading apps to specific malware threats and rootkits like Graybird, Tidserv, ZeroAccess and Gammima. So how do the BPE Signatures work?

Let’s take a look at an application that gets executed. It drops certain components in the windows temp directory It adds a bunch of registry entries It changes the hosts file It doesn’t have a user interface And it opens up communications on high ports Any one of these behaviors alone may not be “bad”, but taken as a whole the behavioral profile is bad. Our STAR analyst creates a rule that says if we see this sequence of behaviors with executables with certain Insight Reputation characteristics, then we should stop the process from executing and roll-back the changes – SONAR has the ability to implement a virtual sandbox around the infected but legitimate application and by doing so can prevent the infected application from taking any malicious actions that might harm a user’s computer. This is quite a new paradigm in endpoint security protection by leveraging what the application does and how it behaves rather than what it looks like. Automation Remediation of malicious files with sandboxing Real-time behavioral protection engine monitors and sandboxes applications, process and events as they are happening instead of statically. System changes can be rolled-back to prevent the malicious activity from impacting the system.

Real-time application and process monitoring SONAR monitors and protects against over 1,400 aspects of all running applications, dll’s and processes delivering real-time protection against threats as they execute. STAR Intelligence Communication Bus The SONAR technology doesn’t work by itself. This engine shares intelligence with our other protection technologies using the STAR Intelligence Communication Protocol (STAR ICB). The SONAR engine communicates with the Network IPS, AV and the Insight Reputation engine allowing for more informed and accurate protection that no other security company can deliver. Symantec Products SONAR.KillAV!gen3 Reputation-Based Protection The newest addition to the suite of protection technologies developed by STAR, reputation-based security, addresses the latest development in the threat landscape, that of micro-distributed malware. Using the combined wisdom of over 130 million contributing users, our reputation system learns which applications are good and bad based on the anonymous adoption patterns of our users. It then uses this intelligence to automatically classify virtually every software file on the planet. This reputation data is utilized by all of Symantec's products to automatically block new malware and, conversely, to identify and allow new legitimate applications. The Problem: A Changing Threat Landscape In prior years, relatively small numbers of threats were distributed to millions of machines.

Each one could easily be stopped with a single antivirus signature deployed to each protected system. Realizing this, malware authors have shifted techniques and today use a variety of obfuscation techniques to rapidly change the appearance of the threats they produce. It is has become commonplace to see attackers generate a new threat variant in real-time for each victim, or a handful of victims, resulting in hundreds of millions of distinct new variants every year. These threats are then distributed via web-based or social engineering attacks to targeted computers. Our data shows that most threats today end up on less than 20 machines across the globe making it nearly impossible for security companies to learn about most of these threats, capture a specimen, analyze it and write a traditional reactive signature. With over 600,000 new variants being created per day (Symantec received 240 million unique threat hashes last year from protected customer machines), it is infeasible to create, test, and distribute the volume of traditional signatures necessary to address the problem. The Solution: Reputation-Based Protection Traditional fingerprinting of a virus requires the security vendor to obtain a specimen of each threat before they can provide protection. Symantec's reputation-based security takes a totally different approach.

It doesn't just focus on bad files, but attempts to accurately classify all software files, both good and bad, based on countless anonymous telemetry "pings" sent to Symantec every second of every day from around the world. These near real-time pings tell Symantec about: The applications being deployed on our customer's machines (each application is uniquely identified by its SHA2 hash). Where applications came from on the web. Whether or not the applications are digitally signed. How old the applications are. A host of other attributes. We add to this data from our Global Intelligence Network, our Security Response organization, and legitimate software vendors who provide application instances to Symantec. This data is incorporated into a large-scale model, not unlike Facebook's social network, and is composed of links between applications and anonymous users rather than just user-to-user connections. This encodes the relationships between all of these files and our millions of anonymous users. We then analyze this application-user network in order to derive safety ratings on every single application – identifying each as either good, bad, or somewhere in between. Currently this system is tracking more than 1.98 billion good and bad files and is discovering new files at the rate of more than 20 million per week.

Features Symantec client, server and gateway products use Reputation data to help improve their protection in the following four ways: Superior Protection The reputation system computes highly accurate reputation ratings on every single file, both good and bad. This is not only effective against popular malware, but can also identify even the most arcane threats – even those affecting just a handful of users across the entire Internet. This increases detection rates across all categories of malware. The most visible aspect of the increased protection provided by reputation can be seen in the Download Insight (DI) feature in Norton products and our Download Advisor (DA) feature of our Symantec Endpoint Protection product. DI/DA intercepts every new executable file at the time of download from the Internet. Then it queries the Symantec reputation cloud for a rating. Based on ratings received from the cloud, DI/DA takes one of three different actions: If the file has developed a bad reputation, it is blocked outright. If the file has developed a good reputation, the file is allowed to run. If a file is still developing its reputation and its safety is unknown, the user is warned that the file is unproven. The user can then decide, based on their tolerance for risk, whether or not they want to use the file.

Alternatively, in corporate deployments, the administrator can specify different block/allow thresholds for different departments based on each department's unique tolerance for risk. Prevents False Positives Two separate aspects of the technology contribute to further lowering Symantec's already markedly low false-positive rates on legitimate software: Firstly, because reputation-based technology derives its file ratings based on the social adoption graph rather than on the contents of each file (like traditional antivirus scanning technology) it provides a second opinion to augment our traditional detection technologies such as antivirus heuristics or behavior blocking. If both opinions point to a file being 'malicious' the likelihood of a wrong conviction becomes infinitesimally small. Secondly, because the system maintains prevalence information on all executable content, this information can also be included into the decision to convict or not. For example an ambiguous conviction on a file that is on only two systems across the globe would be far less damaging than a comparable conviction of a file that is on millions of machines. Factoring this information into every decision means better informed decisions to better protect our users. Improved Performance A typical user's machine has many thousands of files that never change, and, with very few exceptions, all of these files are good.

However, because traditional antivirus focuses on looking for bad files based on a list of known malicious threats, it has to scan every file on a user's system to compare it against the list of known threats. As new threats are discovered, each file on a user's system must be rescanned with the new signatures to see if the file matches any of the newly discovered threats. This becomes a very inefficient process when you consider that security vendors publish thousands of new virus signatures each day. Reputation-based security, however, has accurate safety ratings on all files – both good and bad, by design. This enables products with reputation technology to scan a user's system and definitively mark known good files as good and set them aside so they are not scanned again – that is unless their contents change. This has a dramatic impact on performance, reducing the resource need of a traditional scan and real-time protection by up to as much as 90 percent – providing a much improved user experience. Policy-Based Lockdown Traditional security solutions have focused on blocking known malware in a binary way – anything that is definitively identified as bad is removed from a user's machine and everything else is left alone (whether or not it's actually bad).

Many opportunities in the real world where malware can still gain a foothold on a user's system are left unaddressed. Consider a brand new piece of malware that has just been created by a cybercriminal, it is highly likely that existing antivirus signatures will not be able to detect such a threat since the vendor has never had a chance to analyze it first. Unless the new threat exploits a known vulnerability or exhibits a predetermined pattern of suspicious behaviors, it may go undetected by existing security techniques. Reputation-based security helps users and IT administrators address this situation by making better, more informed decisions about the executable content that they allow onto their machines. In addition to managing information on whether a file is good or bad, Symantec's reputation-based system maintains additional attributes like each file's prevalence and age. These attributes can be used to implement policies in our upcoming enterprise products to enable administrators to control what can be installed on a user's system. For example, in the case of a new threat, even if it is not yet flagged as malicious, its age will be very young and users and IT administrators can use reputation information to implement policies about what they allow on to their machines.

For example, the IT administrator might choose to restrict employees in the Finance department to downloading only those applications with at least 1000 certified users and at least two weeks of availability on the Internet, whereas staff on the IT help desk might be allowed to download files of any age with at least 100 other users and a moderate reputation score. These policies enable administrators to tailor their protection based on each department's unique tolerance for risk. Our studies show that this is a very effective way to mitigate the risk exposure to new malware within an enterprise. Symantec Products Threat Write up: WS.Reputation.1 Remediation Although our goal is never to allow a threat to reach a machine, in the real world there are still situations where a user's system can get infected. Such circumstances likely include: Users who previously had no installed security product. Users whose product subscription expired. Users attacked by a new zero-day threat. Symantec remediation technologies address these situations by providing capabilities to clean up already infected machines. The core set of these technologies is built into all our malware security products. More recently we made available a set of standalone tools to assist with remediating more aggressive infections.

These tools include Norton Power Eraser and Symantec Power Eraser (included in the Symantec Endpoint Protection Support Tool). Features of these remediation tools include: A Nimble and Easily Updatable Engine Since the threat space is always changing in order to evade security suites, these tools can be easily updated to react to new zero-day threats. Targeting Infections in Their Entirety From the downloaders to the payloads and the rootkits that hide them, today's infections are complex, utilizing multiple components to orchestrate a profitable outcome for the hackers. The Power Eraser engine is tuned to detect and remove these risks by looking for behavioral patterns of not just the threat itself, but also the downloader that introduced the threat to the system in the first place. Aggressive Detection Techniques The Power Eraser engine utilizes multiple new heuristic engines and data analysis points in order to detect a broad range of threats. These include packer heuristics, load point analysis, rootkit heuristics, behavioral analysis, distribution analysis, and system configurations monitors.

Resources Norton Utilities 16 hangs during Registry scan | Norton Community Norton Utilities 16 hangs during Registry scan Posted: 13-Aug-2015 | 7:34AM • 44 Replies • Permalink I upgraded from Windows 8.1 to Windows 10 two weeks ago. I have Norton Utilities 16 set up o do a nightly scheduled scan. Everything ran fine for 10 days, but now it hangs during the registry scan. There is no error message; it merely stops working and won't let me exit, not even with the Task Manager. I have to restart the computer. How do I solve this problem? Re: Norton Utilities 16 hangs during Registry scan Posted: 13-Aug-2015 | 1:26PM • Permalink If you use Win 10, an issue with Windows 10 is the Fast Start feature. With this enabled, you may not actually get a full shutdown, which is needed by Norton, and other programs, every once in a while to fully update itself. See this information from TenForums on how to turn off this feature.

You can also get a full shutdown if you right click on the Start Button and choose Restart from the Shut Down or Sign Out link. Things happen. Export/Backup your Identity Safe data. Re: Norton Utilities 16 hangs during Registry scan Posted: 13-Aug-2015 | 2:21PM • Permalink Thanks for the suggestion. I turned off Fast Start and restarted the computer. Unfortunately it didn't solve the problem; Norton Utilities 16.0 still hangs during the Registry scan. I tried running a manual Registry scan. Here is a screen shot of the point where it hangs: peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 13-Aug-2015 | 8:12PM • Permalink Try running a Disk repair on your system drive from the Recovery tab. If there is a physical problem with your drive, it could be causing this hang. I would suggest the Surface Scan option with the Perform on Reboot checked. Things happen. Export/Backup your Identity Safe data.

Re: Norton Utilities 16 hangs during Registry scan Posted: 13-Aug-2015 | 8:56PM • Permalink I ran Disk Repair on the system drive, including a surface scan. It did report and fix a few unspecified errors, However, after restarting Windows I ran the Registry scan again and it still hangs in the same place as in the screen shot above. peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 6:51AM • Permalink I just tried a registry scan on my system upgraded from Win 7 Ultimate to Win 10 Pro and it ran fine. As Win 10 is still a moving target and no 2 systems are the same there have been many problems with program compatibility. Are you running the Complete Scan or a Custom Scan? I would suggest reinstalling NU 16 might sort things out. Start by uninstalling NU from Windows Control Panel. Restart the computer, then run the NU installer. Be sure you run the Smart Update after the reinstall. Then restart once more and test. Things happen. Export/Backup your Identity Safe data.

Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 7:14AM • Permalink It hangs no matter whether I run a Complete Scan or a Custom Scan. If I run a Custom Scan, it only hangs if the Custom Controls box is checked. It's interesting that it ran without problem for 10 days after upgrading to Windows 10, but now hangs. One of the first things I did after encountering the problem was to uninstall and reinstall Norton Utilities 16. It didn't make any difference. peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 7:32AM • Permalink I'll see if I can get some help. Have you added any new software around the time you started seeing this issue? Things happen. Export/Backup your Identity Safe data. Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 7:59AM • Permalink Like most of us, I'm continually installing various software updates.

Here is a summary from the list of installed programs sorted by date: Norton Utilities 16.0 uninstall/reinstall iTunes 12.2.2.25 update Windows 10 and Microsoft Office 2007 August 11, 2015 cumulative and security updates (that's the biggest one) Microsoft Silverlight 5.1.40728.0 update Various Norton Security Live Updates I suppose any one of them could be the culprit. peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 5:09PM • Permalink If I were to guess, the Stardock Start might be a likely candidate for using custom controls that your scan seems to get stuck on. Are you willing to try uninstalling that to test? Things happen. Export/Backup your Identity Safe data. Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 6:00PM • Permalink I've just run several of the NU16 routines on my primary W10 system without incident, error, or hang.

Please try peterweb's suggestion and see if that does make a difference. Dick Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Aug-2015 | 8:30PM • Permalink I uninstalled Start10 and tried running the Norton Utilities Registry scan. There was no change; it still hung up in the same place. peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 15-Aug-2015 | 6:37AM • Permalink Maybe @Mohan_G can get some help. Things happen. Export/Backup your Identity Safe data. Re: Norton Utilities 16 hangs during Registry scan Posted: 19-Aug-2015 | 8:03PM • Permalink I have the same issue with NU16 (running on machine that was upgraded from Win 8 to Win 10). The registry scan stops at 77%. The log shows nothing of interest and I notice from a google search that this has been plaguing people in the past (including NU 14 pre Win 10).

File Attachment: Re: Norton Utilities 16 hangs during Registry scan Posted: 23-Aug-2015 | 8:04AM • Permalink I have the same problem as soon as I upgraded from win7 to win10. same place "inprocserver32" also did disk scan, uninstall/reinstall, with no difference. Am able to close using task manager after a bit. Seems that sometimes completes after 24hrs or so of continuous running. When attempt to stop, dialogue window is missing yes/no buttons. Re: Norton Utilities 16 hangs during Registry scan Posted: 27-Aug-2015 | 7:14AM • Edited: 27-Aug-2015 | 7:15AM • Permalink Yes, for me the "Yes" and "No" buttons are also missing from the dialog box to close NU when if hangs. It does seem as if this is a legitimate issue. It would be fitting if Symantec at least acknowledged they read this forum and are looking into a solution.

Re: Norton Utilities 16 hangs during Registry scan Posted: 07-Sep-2015 | 11:36AM • Permalink I have the identical problem as described above. After upgrading to Win 10, NU 16 hangs every time at 26% of Scanning Registry, which is hkey_classes_root\clsid\{e24b75dd-6ada-4256-83a0-a4499720d221}\inprocserver32\1.0.3702.42458. The only way to kill it is rebooting computer. I have been using Norton products for nearly 30 years....trust me Symantec ...look into it, it is a legitimate problem in your Norton Utilities 16. Re: Norton Utilities 16 hangs during Registry scan Posted: 07-Sep-2015 | 12:39PM • Permalink I spent about 5hrs with Symantec over a couple of days and it was escalated from agent to case manager. The solution was to set the branch of registry which hangs to the ignore file.

If you click on the "Performance" Tab then click on "Clean Your Registry" there will be a "Configure Ignore Lists" link on the lower right. Click on this then place "hkey_classes_root\clsid" in the "Enter Key or Value" field then click on "Add". This works for me. Case manager mentioned that not scanning this not a big deal since in the windows area and moving target as windows 10 stabilizes further. I'll try removing the ignore in a month or two or whenever there's a big OS update. But NU16 back up and running for me. Hope it works for you as well. Re: Norton Utilities 16 hangs during Registry scan Posted: 08-Sep-2015 | 1:38PM • Edited: 08-Sep-2015 | 1:39PM • Permalink Just a note that wasslow's workaround must be entered under the Keys tab in the Registry Ignore List. It will not work if entered under Values. When entered correctly under the Keys tab, the workaround worked for me.

Re: Norton Utilities 16 hangs during Registry scan Posted: 16-Oct-2015 | 1:43PM • Permalink Re: Norton Utilities 16 hangs during Registry scan Posted: 14-Dec-2015 | 9:46PM • Permalink BillPierce wsaslow Thank you very much for your time publishing , the same thing happened to me , in fact spent a lot of time researching , coming to think it was a virus , but seeing this post reassure me , I do the recomendation and everything worked again Accepted Solution Re: Norton Utilities 16 hangs during Registry scan Posted: 15-Dec-2015 | 6:08AM • Edited: 15-Dec-2015 | 6:09AM • Permalink It appears that upgrading to Windows 10 Version 1511 (the November 2015 major update) solves the problem entirely without requiring an entry in the ignore list for any registry key.

peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 15-Dec-2015 | 5:24PM • Permalink Thanks for letting us know. Finally a Windows update that does some good. Things happen. Export/Backup your Identity Safe data. Re: Norton Utilities 16 hangs during Registry scan Posted: 28-Dec-2015 | 3:03AM • Permalink Sadly the solution doesn't appear to be a solution after all, for me and my HP desktop at least. I am running Windows 10 Home which is up to date showing version 1511. And guess what? The registry scan hangs. It used to hang at around 60% and I read something about recently installed software. I had installed some which actually wasn't suitable for what I wanted so I unintalled it and rebooted. Did it make a difference? It sure did. Now registry scan hangs on a different registry entry at 33% instead. I guess I will have to try some of the other workarounds. However this comment is primarily to moan about Norton's behaviour when it does hang.

I get the same symptom that someone else mentioned which is that when I click the x to close the window it asks if I am sure I want to stop the scan, but the yes and no boxes are missing. If I go to task manager instead I find that I can't stop the program from there because (I assume) some clever clogs who wrote the registry scanner decided to intercept the Windows end task routine to bring up the same box asking if I am sure that I want to stop the scan with - of course - the yes and no boxes missing! So a plea to Norton, if anyone there is reading this, please do not interfere with the Windows end task utility - it should be the ultimate control over a program. I have found though that if I go to 'close window' on the NU symbol in the taskbar and work from there, the same 'are you sure' box is displayed but with the yes and no boxes visible. By clicking yes, NU is closed down successfully. A final general comment is that this hang problem seems to have been around for a long time. Surely by now the program could have been modified to trap a problem with examining a registry entry and handle it without hanging up.

Re: Norton Utilities 16 hangs during Registry scan Posted: 11-Jan-2016 | 2:18AM • Permalink I'm sure that I'm on Win 10 1511. At least that is what the 'Winver' utility reports - screenshots fresh from this morning attached showing the version, hanging registry scan and the close window without the yes and no buttons. But I was wrong about something. I said before that if I use the close window funtion in the taskbar it displays the yes and no buttons on the Norton close window. Sadly, I have since found that it rarely works and today, for example, I get the same window with the yes and no buttons missing. Not that this ever solved the problem of the scan hanging. The scan was still incomplete but at least the button allowed me to close NU. Usually the only recourse is a reboot which is a pain. I can avoid the problem which is to do a custom scan missing out the custom controls part, but I would much prefer to do a complete scan with Norton having resolved this very longstanding issue.

File Attachment: Re: Norton Utilities 16 hangs during Registry scan Posted: 26-Jan-2016 | 8:16AM • Permalink Yes, thanks. I've now told NU to ignore the relevant part of the registry. Sadly though that is problem avoidance rather than problem solution and of course now means that part of the registry isn't getting checked. I still think that the reg scan should include what is surely fairly basic error handling and trap any problem with reading one or more registry entries and deal it within the program, not just fold it's arms, stick it's nose in the air and refuse to function or even to quit. peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 27-Jan-2016 | 8:14AM • Permalink Well, I take the point that the registry scanner can be turned off. I am relatively ignorant about the inner workings of Windows, but after I set 'ignore' for a branch of the registry, the utility then ran and reported quite a few errors which it listed as high priority to fix. It was reporting errors, not merely offering to remove extraneous or dormant elements.

Should I believe its conclusions and its evaluation of the priority? I chose to believe it and let it go ahead and fix them. Not using the scanner at all is practical advice to avoid problems, and I value the kindness in suggesting that option. However it is not at the heart of the matter from my perspective. This is not about buying software and then not using it, or at least not using part of what I have paid for. It is that having bought the software and choosing to use it, it should work and not hang up because of a failure to intercept and handle what seems likely to be a fairly predictable problem of a read error due to either or both data corruption and physical disk damage. Given the length of time it has been reported and the range of Windows versions it has affected, it now appears to me at least that the problem almost certainly lies with NU not with Windows and so is unlikely to be solved by a new version of Windows be that 10, 10:1511 or anything else.

Even if the trigger of the problem on a particular computer is removed by deleting certain software along with its problem registry entries or upgrading to a new version of Windows, it looks like the weakness remains in the scanner program code waiting for another trigger to set it off. I would have expected that a major player like Symantec would have jumped on this by now and sorted it. Naive of me? Almost certainly :) peterweb Guru Mobile Master Re: Norton Utilities 16 hangs during Registry scan Posted: 03-Feb-2016 | 9:21AM • Permalink Unfortunately, this "accepted solution" does not solve the problem. I have Windows 10, fully updated through 02/03/2016, and Norton Utilities 16.0 still hangs up during registry scan. It can scan most of the registry categories successfully, but hangs every time I try to scan the Custom Controls category. Specifically, it hangs while scanning hkey_classes_root\clsid\..... While an error message appears, no button appears to cancel the process, and the program is fully locked up. I have to use Windows Task Manager to shut down Norton Utilities in order to get out of the locked-up program.

I have Norton Internet Security, fully updated, and have run Power Eraser, but it has no effect on the problem with Norton Utilities. While it is possible that there might be some incompatibility with Windows 10, it seems much more likely that some hacker has devised a rootkit virus that Symantec has not yet identified or found a solution for, and that Norton Utilities and Norton Internet Security are not capable of dealing with. Re: Norton Utilities 16 hangs during Registry scan Posted: 26-Mar-2016 | 1:09PM • Permalink I am having the same problem. Worked fine for a while after upgrading to Windows 10, but hasn't done a complete registry scan for over a month. Windows 10 fully up-to-date, tried uninstalling and re-installing, etc. etc. Clean registry hangs at 77% consistently. Can't get out of it without a system restart. I thought this was a new thing, but was surprised to see this issue goes back to last year. Norton - I've relied on your utilities for years to keep my computers clean and safe.

And I agree with the others who don't feel that leaving a portion my registry unscanned is an acceptable option. As for Windows managing registry better than ever, that may be true, but it is very far from perfect and frankly, I don't trust Microsoft to ever be able to make Windows do that effectively. Now I'm wondering whether I can continue to rely on Norton to address problems with my computers that Microsoft can't. I really hope you are working to find a real solution. Re: Norton Utilities 16 hangs during Registry scan Posted: 29-Mar-2016 | 4:53AM • Permalink On the apparent suggestion from peterweb that the problem disappeared with Win10 update 1511, we seem to be going round in circles here. Please see my earlier post (18 Dec 15) with images attached that clearly show the problem on my PC running 1511 and it was also reported in this thread by jeskov (23 Jan 16). This problem didn't disappear when I updated to 1511 and then come back with a subsequent update of the Win10 'work in progress'.

The problem has been there since long before Win 10, it was there with Win 10, it was there with update 1511 and it stubbornly remains. The fact that BillPierce struck lucky with the 1511 update solving his problem doesn't mean that the rest of us did. At the time I deleted some recently installed but then unwanted software and that had an effect too, but unfortunately only of shifting the point at which the registry scan freezes to a later entry that it can't handle. There is something about some registry entries that Norton can't cope with, and it should, even if as a last resort that is to give up on a problem entry and report that it couldn't deal with it. That is basic, basic error handling. Regards Nick Re: Norton Utilities 16 hangs during Registry scan Posted: 29-Mar-2016 | 6:50AM • Permalink On the apparent suggestion from peterweb that the problem disappeared with Win10 update 1511, It was more of an observation than a suggestion. It did help some users, but not others.

The problem with Windows computers is that there are millions of combinations of hardware and software that any given program has to try to be compatible with. It sometimes amazes me that anything works at all. There are a number of users here that are seeing this issue with the registry scan, but there are also others, like myself that do not have the same issue. The difficulty comes in trying to find the common denominator for the problem systems. Things happen. Export/Backup your Identity Safe data. Re: Norton Utilities 16 hangs during Registry scan Posted: 01-Apr-2016 | 12:45AM • Permalink From thinking again about the symptoms and behaviour of this problem, I think it most probable that it is the format of some registry entries that is causing the hang ups as suggested by peterweb and BillPierce - the latter being the envied winner of the 1511 jackpot that solved his problem :). Whilst I accept that that Windows operates on a large number of hardware platforms and that the number of hardware/software permutations is huge, I don’t believe that is likely to be at the root of the problem. The registry scan works just fine … until!

The ‘until’ is a specific point in the registry of a particular user. That suggests that the hardware and the software is all ticking along just fine until that point. Now, is it likely that the program can’t handle the format/content of the entry at that position in the registry? I think that Krusty13 may be on to something in noting that NU hasn't been updated for a very long time. It follows that the program may well be out of date with some entry formats, as mentioned also by BillPierce. How about a new version of Windows solving the problem – i.e. 1511. Well, if that caused the registry to be rebuilt it would then be without any old problem entries that were no longer in use. If the software is still loaded and the registry keys are re-entered by the upgrade, the problem key is reinserted. That would explain why the 1511 upgrade helped Bill. However it didn’t help others including, sadly, me so the reality is that the problem isn’t solved.

If the scan is working fine, then new software is loaded which writes a ‘problem’ registry entry then that would trigger the hang up when the registry scanner hits it whether the user is running Windows 7 or 8 or 10 or 10v1511 or 10v9999. If you don’t have software loaded that writes ‘problem’ registry entries, then you won’t ever experience the hang up. If it was a hardware/software combination problem, it would seem likely that the program wouldn’t execute and foul up immediately it started, if it started. That root cause isn’t consistent with it running fine until a very specific point, or running fine to the end if that branch of the registry is excluded from the scan. Either way, I find myself coming back to my comment in an earlier post on this thread. It is inexcusable for the program to just hang up. Professional, market-leading software like this should be engineered to handle problem events not just go on strike. In the meantime, excluding the branch works for me as it has for others in so much as it avoids the problem albeit leaving me without a scan of that part of the registry.

I hate problem avoidance though - I so much prefer problem solution. Are you listening in on this Symantec? This has been going on for a very long time and your action is long overdue on a product where we, your customers, have jointly paid you a very large amount of money. Please do something, even if that is only a minor maintenance upgrade and you have a shiny new product in development. Re: Norton Utilities 16 hangs during Registry scan Posted: 16-Jan-2017 | 11:34PM • Permalink So many replies, so many solutions ... My new Norton Utilities 16 (only a few hours old) worked well on my new Windows 10 Pro computer (only a week old), but bombed just like everyone else reported. when I installed and ran it on my old (about 10 years) Windows 7 Enterprise machine. The solution ... and I got it online, is to reboot the computer in safe mode, and run Norton. It ran perfectly, found something like 5,000 plus registry errors, and when I told it to repair them, it apparently did.

That's a lot of errors, but I guess with running the unit for 10 years without Norton, it should be expected. I rebooted in normal mode, and ran it ... all the registry issues were still gone, and the scan ran fine. SO, if you've been using the machine a lot, regardless of which OS, and NU hangs up, clean things up in safe mode, then run the 'one button' at least once a week so things won't get so bad. peterweb Guru Mobile Master

Question: What corporation (as at 2011) owns and operates the Norton internet security product range?
Answer: Symantec