Anti Virus and VW12.0.01

[Christiaan]

quote:

---

Originally posted by michael john williams:

As I have already said I have tried the suggestions, including Katie's suggestion - I have set a rule in Norton Programme Control to Permit All to VW on both pcs and still the virus warnings of intruder keep popping up.

---

When you've got a number of suggestions being made it helps to be explicit about what have and haven't tried. Have you tried blocking Vectworks as I suggested?

[ 04-03-2006, 11:50 AM: Message edited by: Christiaan ]

[ErichR]

Christian,

Please look at my enrty just before yours. On a PC network, program files on client machines aren't accessible by the server, since, the message says, the program folder can't be shared, because it contains system files. Therefore, without installing VW on the server, is it possible to block VW from the server?

[Christiaan]

Erich, I'm a bit confused, I assume you (and payne) work with Michael, or are you simply having similar problems, or do you just use Nortons as well?

I'm a little perplexed that whoever is having the problem is getting virus warnings for such network activity to be honest. I would have thought you'd get such warnings only from Norton Firewall, but Michael says he does not have Norton Firewall. Then again I'm not an expert, it's been a long time since I used Nortons and I've never used it on Windows.

One way forward might be to switch on the default Firewall(Windows has a built-in one these days right?), leaving open any required ports for normal activity, and this should stop Vectorworks from poking around and triggering the virus alert.

Also you may like to avoid this problem, saving some money in the process, and investigate switching to Clam if it has the features you want: http://www.clamwin.com/ That's about all the advice I can offer unfortunately.

[G_Hannigan]

Erich,

The setup MW is using is a Peer to Peer network. I assume that there is no server involved. His problem was not in accessing, or running VW, but how to stop Norton from reacting with intrusion warnings. There were several suggestions to Block VW in Norton.

MW, have you tried this?

George

[ErichR]

Christian,

I don't work with Michael.

We are having Norton worm warnings on a number of machines and with the VW machine being cut off from the server. But, this morniong I have yet to fire up VW, and have yet to be cut off from the server. Maybe getting warm?

George H., The only thing I can think to do is install the VW .exe file on the server so that it can recognize it. The server can't access my program file folder over the network, because of an apparent Windows inability to share the Programs file folder over the network. This suggestion hasn't been mentioned, so I don't know how otherwise to block VW (if that is, indeed, the problem).

I'll keep you posted.

[ 04-04-2006, 12:03 PM: Message edited by: ErichR ]

[Guest]

One other thing you can check in Norton is to accept all internal communication.

If you still have problems after setting a rule to ignore VW and this step, please contact Norton. If you need help creating a rule in Norton, please contact Norton.

[ErichR]

I can confirm that it is VW that is causing the server to block access, at least on our system. But, with all due respect, you could say that Norton is causing it.

This apparantly all started with a new virus definition that somehow defines VWs pings as an internet worm.

You can put a copy of the VW.exe file anywhere on the network server, and ask Norton to permit it, and the blocking and internet worm messages go away (knock on wood).

Let's hope that Nemetscheck doesn't regard this as a license violation.

[ 04-04-2006, 08:05 PM: Message edited by: ErichR ]

[Christiaan]

quote:

---

Originally posted by ErichR:

Let's hope that Nemetscheck doesn't regard this as a license violation.

---

I was under the impression that Nemetschek could actually be the one in a precarious position here as they are using unauthorised bandwidth on your network. It would be interesting to see this go to the courts in some countries.

Certainly Nemetschek, nor any other company, have any say over how you control your own network.

[ErichR]

I spoke too soon. The .exe file resident on the server seemed to be working, but didn't.

A call to VW tech support was of little value, except to acknowledge that there is a conflict between Norton Antivirus and VW. A chat with Norton ended by having me do a three-hour online scan, which proved nothing.

Two rules to permit VW did nothing.

It seems that if VW is aware of the issue, then it would be wise for them to share with us users the workaround. Otherwise, we must stop using either VW or Norton, and you can guess that it is unlikely that Norton will be one abandoned.

Assistance would be very much appreciated.

[Guest]

This problem was caused by a recent patch from Norton. Norton is blocking access to VectorWorks users because it does not recognise VectorWorks as an authorized program on the network.

To fix this problem follow these two simple steps:

1) Install VectorWorks on your server.

2) Go into Norton Antivirus and set and exception for VectorWorks.

Norton will not be able to recognize VectorWorks until VectorWorks is registered as a program on the local system, so VectorWorks will not appear in the list of programs that you are allowed to set an exception for. This is why you must install VectorWorks on the server.

This rule might be pushed down to your client computers depending on your setup. If the exception is not pushed to the clients you will need to setup this exception on each client computer.

If you are not using a Norton server you will only need to setup an exception for VectorWorks within Norton AntiVirus.

This problem may occur with other programs that access the network or internet that Norton does not recognize.

These instructions are for Norton AntiVirus. For more information on creating an exception within Norton AntiVirus please refer to www.norton.com.

[ErichR]

Nate,

If only it were as 'simple' as that.

Installed VW on the server.

Set Antivirus to permit VW.

Still, the server blocks my computer.

[ 04-06-2006, 09:35 AM: Message edited by: ErichR ]

[Guest]

Did you set a rule on both the server AND the local computer?

[ErichR]

Yes, Identical 'fixes' were done on both the server and on the Vectorworks computer. And I spent several hours with Norton chat, and just got off the phone, live.

Verdict: Turn off internet worm protection. There is no fix.

An option is to get different antivirus protection, which, if it's doing its job, would behave as Norton does.

Another is to stop the VectdorWorks network pinging.

The latter seems to be the most expedient solution.

[ 04-06-2006, 03:12 PM: Message edited by: ErichR ]

[ErichR]

Is it possible that the people I've been in contact with at Symantec are wrong?

Has anyone actually found a fix, or are they assumptons that we are hearing in this discussion group?

How prevalent is the problem?

Is it limited to

Norton Antivirus 2006 and some recent virus definition,

XP server, and

VW v12.0.1?

I would assume that the Nemetschek people are very concerned with this, since each app sold, and expecially each new sale, may be unable to work on a network that has antivirus protection.

[ 04-06-2006, 04:42 PM: Message edited by: ErichR ]

[Guest]

Erich,

Try this....

1) Turn off worm protection

2) Start VectorWorks

3) do a live update

4) Restart the computer

5) Turn worm protection back on

I was browsing the Norton site and they posted this fix on their website.

Norton AV has taken protection to a new level with the last patch they released, by blocking ALL computers that are generating non-recognized network traffic. Most AV programs only scan the files coming into the local computer, and are not concerned with what program is generating that traffic. Blocking of network traffic by non-recognized programs is usually handled by a firewall.

To my knowledge this is the only AV program to ever regulate network traffic. Usually the same company that sells the AV software also will try to sell you on a firewall package (thus Norton Internet Security).

If by chance you are running Norton IS you will also have to create a rule within the firewall part of the program to allow VectorWorks access to the network. This is true for all personal firewalls.

This problem pertains to any version of Norton that is capable of getting updates. The patch that brought this issue to the surface was released on March 15th. The problem has nothing to do with what operating system you are runing.

I will continue to plug away at this! Hang in there!

[Christiaan]

quote:

---

Originally posted by ErichR:

Otherwise, we must stop using either VW or Norton, and you can guess that it is unlikely that Norton will be one abandoned.

---

You're prudent to value virus protection in a Windows environment but I wouldn't be so quick to value Norton ahead of anything, let alone the application that you actually make your money with.

quote:

---

An option is to get different antivirus protection, which, if it's doing its job, would behave as Norton does.

---

As Nate points out most virus protection aims at preventing infection by checking incoming files. Norton appears to be gearing their application towards blocking actual infections, which seems a bit odd to me considering their application is meant to prevent infection.

I think you should give http://www.clamwin.com/ a trial (if you're happy with it you'll have solved your immediate problem (in that you can get rid of Norton) and you'll have saved yourself a few bucks in the process).

[ErichR]

Nate,

Thanks. This suggestion doesn't seem to work after trying the fix at the local and at the server level. (You didn't say if both locations needed to be addressed.)

Also, I assume There is a missing step four: Turn off VW.

We do not have Norton Internet Security installed.

I would still like to know if this issue has been replicated within your tech group, or are we just testing others' suggestions who aren't VW users.

[ErichR]

OK. We trashed Norton at the server-level, in favor of Trend Micro PC Cillin. Cost is 0 for 30 days. Then it's $30 +/-.

This has ended our issue, but I'll bet that Nemetschek will be struggling with this unless they can get Norton to address the problem.

We decided against freeware, thinking that an actual company would have the best commitment to the updating of virus protection.

[ 04-07-2006, 04:32 PM: Message edited by: ErichR ]

[Christiaan]

quote:

---

Originally posted by ErichR:

We decided against freeware, thinking that an actual company would have the best commitment to the updating of virus protection.

---

That's an incorrect assumption Erich. Like many open source projects Clam's virus database is kept up to date with the help of a large community of people who have a direct interest in ensuring the database is always up to date. Go to http://lurker.clamav.net/list/clamav-virusdb.html to see their response times to new threats. You can also see in this example (the Sober worm) for which Clam AV was the first to update their database, and 4 hours before Trend Micro. You'll also find this article of interest.

Also of note is that Apple Computer chose ClamAV as their mail services virus protection in Mac OS X Server: http://www.apple.com/server/macosx/features/mailservices.html

And then there's the argument that profit-driven virus protection isn't necessarily in the interests of those who don't want viruses. Whatever the merit of this argument clearly Clam AV developers have no financial conflict of interest in there being ever more viruses.

[ErichR]

Obvious antiestablishmentarian logic notwithstanding, I have no love of Symantec, but other logic would tell me that $ motivate, and the more $ the more motivation. Very capitalistic and very American.

MW: Clam, Norton, or otherwise, have you tried an antivairus fix? Have you contacted Nate at NNA directly?

[ErichR]

But what's their motivation to stay in 'business?'

[michael john williams]

Sorry not got back to you all but you all seem to be having fun without me. I have not resolved the problem but like a lot of problems you have to live with it and earn some money.

Yes I do work with payne.

The best I have got is to turn the vw programe on in the host peer to peer network first before the other computer and then this avoids the Norton virus messages coming up in either computer.

[Christiaan]

Well, contrary to the received truth Erich, monetary profit is not a prerequisite for innovation and production.

Their "motivation to stay in business" is satisfaction and status from innovation and production and a requirement to fullfill their own need for virus protection.

What's even better, because of the way the copyright licencing works, is that if the current developers stop producing the goods there's absolutely nothing stopping someone else from carrying on where they left off. There's also nothing stopping you (except from an obvious lack of expertise) from improving the product yourself for your own ends. All this is impossible with proprietary software because the source code is a closely guarded secret.

[ 04-11-2006, 12:51 PM: Message edited by: Christiaan ]

[Christiaan]

quote:

---

Originally posted by ErichR:

Obvious antiestablishmentarian logic notwithstanding, I have no love of Symantec, but other logic would tell me that $ motivate, and the more $ the more motivation. Very capitalistic and very American.

---

Well whatever the "other logic" is I'd recommend you disregard it and instead go with the facts.

quote:

---

Very capitalistic and very American.

---

Ideology doesn't always make for rational decisions.