571514 - Norton saw that Firefox.exe as a threat

Status: RESOLVED INCOMPLETE

(Firefox :: General, defect)

Description

[Trevor McAlear]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a6pre) Gecko/20100611 Minefield/3.7a6pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a6pre) Gecko/20100611 Minefield/3.7a6pre

Norton Internet Security 2011(beta) saw that Firefox.exe was a threat. It proceeded to put Firefox.exe in to quarantine. I fix this error by restoring Firefox.exe. Thought you should know as it is not normal.

Reproducible: Didn't try

Comment 1

[Kevin Brosnan]

The best course of action is to notify Norton about the false positive.

Comment 2

[Trevor McAlear]

Done. Thanks

Comment 3

[Robert Strong (they/them - no direct email)]

Since the firefox.exe binary was seen as a threat, there is nothing the installer can do about this, and the installer itself was not identified as a threat (the typical case) moving this over to general.

Comment 4

[Kev Needham [:kev]]

Nightlies aren't signed, which increases the potential for an executable to be quarantined. I'll ping Symantec on it, but a combination of a nightly plus a beta version of adaptive security sw is probably not a typical usecase.

Comment 5

[Tyler Downer [He/Him]]

Reporter, are you still seeing this issue with Firefox 3.6.13 or later in safe mode? If not, please close. These links can help you in your testing.
http://support.mozilla.com/kb/Safe+Mode
http://support.mozilla.com/kb/Managing+profiles

You can also try to reproduce in Firefox 4 Beta 8 or later, there are many improvements in the new version, http://www.mozilla.com/en-US/firefox/all-beta.html

Comment 6

[Tyler Downer [He/Him]]

No reply, INCOMPLETE. Please retest with Firefox 3.6.13 or later and a new profile (http://support.mozilla.com/kb/Managing+profiles). If you continue to see this issue with the newest firefox and a new profile, then please comment on this bug.

Comment 7

[Kev Needham [:kev]]

Just to add on, this is a known side-effect of using unsigned nightlies. Executables that aren't signed are treated with a higher level of scrutiny by the Norton engine. Because of the behaviour the executable exhibits, it occasionally gets flagged/quarantined. The release cadence of nightlies makes it difficult to keep up-to-date (both from an admin and update pov), and whitelisting firefox.exe based on filename alone would be... bad. 

Using a nightly build you may see this from time to time, and have to whitelist it manually.