Norton Pulse Updates Fail when Malicious Website Protection Enabled

[lmacri]

I use Norton Internet Security (NIS) v. 20.5.0.28 as my antivirus and have encountered a problem where my background NIS Pulse Updates, which should complete in 1 - 2 seconds, will fail to terminate and will run continually (i.e., until re-boot) if MBAM Premium's Malicious Website Protection is enabled.  Here are sample screenshots:

Norton Pulse Update Runs With MBAM Malicious Website Protection Disabled:

Norton Pulse Update Fails With MBAM Malicious Website Protection Enabled:

I first noticed this problem in MBAM Premium v. 2.0.3.  I followed the MBAM clean removal process here to perform a clean re-install of v. 2.0.4 but this has not solved the problem.  I created the recommended exclusions for MBAM executables in NIS  for both scans and realtime protection (see attached screenshot) and also added my entire NIS installation folder (C:\Program Files\Norton Internet Security) in MBAM's malware exclusions but nothing I've tried so far has sovled the problem.

 

 

 

NIS appears to function normally if I enable MBAM's realtime Malware Protection and leave Malicious Website Protection disabled.  Is there some web exclusion for the Norton update servers that I have to create in MBAM in order to get my NIS Pulse Updates to run to completion when MBAM's Malicious Website Protection is enabled?
-------------
32-bit Vista Home Premium SP2 * Firefox 34.0.5 * NIS 2013 v. 20.5.0.28 * MBAM Premium 2.0.4.1028
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[celorbelor]

Hi lmacri,

 

I see you've opened a support case on this issue as well. It'll be best for us to continue working from there, but for others who may need help:

 

Chances are we'll need to add a web exclusion for Norton in Malwarebytes Anti-Malware as well. Since Anti-Malware protects on both malicious files and websites, it'll be best to add the Norton application to the Web Exclusions as well. This will help make sure there isn't any conflict with the Website Protection and NIS. To do, please try these steps:

 

1. Launch Malwarebytes Anti-Malware

2. Click Settings > Web Exclusions

3. Click Add Process

4. Navigate to the folder where NIS is installed

5. Select the NIS executable, and then click Open

6. Repeat steps 3-5 for any other NIS executables

 

This will prevent Malwarebytes Anti-Malware from checking the network traffic that originates from this process, and should hopefully help with the problem.

[lmacri]

I just wanted to report that I upgraded from NIS v. 20.6.0.27 (2013) to NIS v. 21.6.0.32 (2014) and that appears to have solved the problem - my Norton Pulse Updates and Automatic LiveUpdates now run to competion when MBAM v. 2.0.4 Malicious Website Protection is enabled.  I performed a complete wipe of my old NIS installation as follows:

1. Uninstalled NIS 2013 from the Windows Control Panel (Programs and Features) and chose the option "Please remove all user data" to remove all static user files (e.g., .dat, .log, .txt files with saved configuration settings, etc.) and re-booted
2. Ran the Norton Removal Tool (www.norton.com/nrt) and re-booted to wipe orphaned registry and files
3. Installed NIS 2014 using the offline installer from www.norton.com/latestnis
4. Ran manual LiveUpdates untill no further updates were available and re-booted

-------------
32-bit Vista Home Premium SP2 * Firefox 34.0.5 * NIS 2014 v. 21.6.0.32 * MBAM Premium 2.0.4.1028
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[AdvancedSetup]

Great, glad to hear you were able to get the issue resolved and thank you for your follow-up reply.

[lmacri]

I regret to report that I my update to NIS v. 21.6.0.32 (2014) did not permanently solve the problem.  One week after the NIS upgrade my Norton background updates started failing again and the only workaround was to disable MBAM's Malicious Website Protection.

 

Here's a recent screenshot of my Norton Tasks window when MBAM's Malicious Website Protection is enabled:

 

 

I've asked MBAM to re-open my support ticket and I'll post back if we make any progress.

-------------
32-bit Vista Home Premium SP2 * Firefox 36.0.4 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.4
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[AdvancedSetup]

Okay, please do. Thank you again for the update

[lmacri]

I've now updated to NIS v21.7.0 and MBAM v2.1.6 (both clean reinstalls) and Norton Pulse Updates and Automatic LiveUpdates (ALUs) continue to fail to run to completion when MBAM's Malicious Website Protection is enabled.  Norton Quick Scans are only scheduled to run during system idles after virus definitions are updated by an ALU, so these ALU failures also prevent my Quick Scans from running throughout the day.

 

I requested to have my original support ticket re-opened but received the following response from Malwarebytes Support:

"Unfortunately it will not be possible to reopen the old case you had with Malwarebytes Support as we have migrated to a different helpdesk system since that time. We would like to ask you to gather some logs again in order to proceed."

After resubmitting new diagnostic logs and repeating the same troubleshooting steps I tried for the original support ticket I'm no closer to a solution.  I haven't heard back from Support for over a week now and no one has been able to answer my question <here> about delaying the loading of MBAM services at bootup so I'm just going to leave MBAM's Malicious Website Protection disabled for now until someone comes up with a better solution.
-------------
32-bit Vista Home Premium SP2 * Firefox 37.0.2 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.6.1022
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[lmacri]

Just another update to let folks know that Norton Customer Support has re-established contact with me and has decided to escalate my support ticket to Malwarebytes QA and the Software Development team to see if they can reproduce the problem.

 

While we were troubleshooting the issue of MBAM's Malicious Website Protection (MWP) causing my Norton Pulse Updates and Automatic LiveUpdates to fail, we uncovered a few additional problems on my system that also seem related to blocked connections to the backend Symantec servers when MWP is enabled.  Namely, Norton's Download Insight is unable to check the trust rating / reputation of new (updated) executables when MWP is enabled.  If I disable MWP, re-boot my computer and re-download the same file from the same download site, Download Insight is able to retrieve the file's trust rating.

 

 

Also, if I run trace routes to the Norton LiveUpdate servers from the command prompt when MWP is enabled (i.e.,tracert liveupdate.symantecliveupdate.com, tracert liveupdate.symantec.com, tracert update.symantec.com), two of these three traces consistently end in a general failure, even when these domains are added to my MBAM web exclusions.  If I disable MWP and re-boot my computer all three traces result in a successful connection.

 

-------------
32-bit Vista Home Premium SP2 * Firefox 38.0.1 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.6
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

 

[lmacri]

MBAM Premium has updated to v2.1.8.1057 and NIS (2014) v21.7.0.11 Pulse Updates and Automatic LiveUpdates still fail to run to completion when MBAM's Malicious Website Protection is enabled.

 

 

The QA team at Malwarebytes was unable to reproduce the problem and when they last contacted me on 04-Jun-2015 I was told they were going to investigate if my issue is related to my location (Canada) and the content delivery network (CDN) that Symantec uses to distribute updates to customers outside the US.

-------------
32-bit Vista Home Premium SP2 * Firefox 38.0.5 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[daledoc1]

Hi:

 

I cannot speak to the specific, longstanding issue with Norton Pulse and MBAM Malicious Website Protection.

 

However, over the past 24 hours or so, there *was* an issue with MBAM's Canadian cdn.

See here

Needless to say, this would not directly impact Symantec's cdn.

 

I am not qualified to say whether the problems are related.

However, the updating issue does seem to be resolved for the other Canadian users who have reported in the past hour or so.

 

Hope this helps,

[lmacri]

However, over the past 24 hours or so, there *was* an issue with MBAM's Canadian cdn.  See here

 

Hi daledoc1:

 

Thanks for the reply, but I don't know if the two issues are related.  I'm not having problems updating MBAM, so MBAM's Canadian CDN seems to be working fine for me and what is described in that thread sounds like a temporary connection problem.

 

My problem is that I can't update Norton Internet Security (NIS) when MBAM's Malicious Website Protection is enabled, and this has been going on for over six months now.  My current thinking is that MBAM blocks the connection to Symantec's Canadian CDN because the geolocation / IP address (Toronto, ON, Canada) is different from the "expected" geolocation / IP address for their main servers in the USA (San Franciso, CA, USA).  As soon as I disable MBAM's Malicious Website Protection my NIS updates immediately resume running again.

-------------

32-bit Vista Home Premium SP2 * Firefox 38.0.5 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8

HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[daledoc1]

Indeed.

Likely purely a coincidence.

Or, as we say, "True, true and unrelated."

 

I hope you get your issue resolved.

Does seem strange that the QA Team can't replicate the problem and that no other users report it.

One of those quirky computer things, I suppose.

 

Good luck,

[AdvancedSetup]

Please double check and make sure that NIS does not have the same Web Protection (I think it does) as some users with other antivirus have said that once they disabled that within their antivirus other updates worked fine.

 

If that works you're then left to decide if you want to user ours or theirs.

 

Thanks

[lmacri]

Does seem strange that the QA Team can't replicate the problem and that no other users report it. One of those quirky computer things, I suppose.

 

Hi daledoc1:

 

It would have been more accurate for me to state that Malwarebytes hasn't been able to replicate the problem using their standard test bed from a location within the USA.  The only official post I could find regarding MBAM compatibility testing was the 2013 blog entry Malwarebytes AV Compatibility Report and the machine specs and Norton 360 software used for that testing are quite diffferent from my system configuration.  They might even be using Norton Security with Backup v22 these days for compatibility testing.

There are multiple threads in the Norton forum related to failed updates, 3048,3 (LiveUpdate) errors and pop-up warnings about out-of-date virus definitions, but I have no idea if any of these users are also running MBAM PRO/Premium in real-time.  I haven't posted my issue in the Norton forum yet because I wanted to give Malwarebytes the opportunity to determine if there was a conflict with MBAM v2.x and Norton (2014) v21.x products, and I know from previous experience that there would be a flood of posts on the Norton forum telling me to disable my MBAM real-time protection.  I contacted Norton Custiomer Support and asked them for the domain names for their LiveUpdate servers so I could run IP trace routes and create web exclusions in MBAM for their backend servers (which Malwarebytes Customer Support eventually helped me with) and Symantec's responded that "It is not suggested to use 2 different Anti virus softwares on one computer since they will always create conflicts with each other."

If the Malwarebytes QA team concludes this is a "quirky computer thing" then I'll just go back to using the free version of the MBAM and stop wasting my time (and theirs) troubleshooting this issue.

-------------

32-bit Vista Home Premium SP2 * Firefox 38.0.5 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8

HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[daledoc1]

Hi, Imacri:

 

I wasn't in any way insinuating anything. :(

I'm really sorry if my post came across that way.

I was really just musing about the sometimes weirdness of computers.

It certainly sounds as if you have gone "above and beyond" with all the various software vendors to try to resolve this.

 

AdvancedSetup's suggestion and any future advice he would provide would be the best bet.

 

Once again, I am truly sorry if my post came across the wrong way.

And I really do hope you get it resolved.

 

Take care,

[lmacri]

Please double check and make sure that NIS does not have the same Web Protection (I think it does) as some users with other antivirus have said that once they disabled that within their antivirus other updates worked fine.

 

Hi AdvancedSetup:

 

Firefox, iTunes and other third-party software updates run normally on my system when MBAM's Malicious Website Protection (MWP) is enabled, so I'm not sure what Norton web protection feature might overlap with MWP and cause my background Norton LiveUpdates to fail - but I'm open to suggestions .  My browser doesn't need to be open in order for Norton LiveUpdates to run so any duplication in browser protection shouldn't be the cause.  Just out of curiosity, I've tested with both Norton Safe Web and Norton Browser Protection disabled and my Norton updates still won't run if MWP is enabled.

Creating web exclusions in MBAM for the domains for Norton's LiveUpdate servers doesn't help either - or at least for the three variations that Malwarebytes Customer Support suggested I add - liveupdate.symantecliveupdate.com, liveupdate.symantec.com and update.symantec.com.  Ditto for IP addresses I've traced for those domains (which wouldn't work anyway, since the LiveUpdate servers have dynamic, not static, IP addresses).  I haven't tried disabling Norton's Smart Firewall and/or Intrusion Prevention to see if Norton LiveUpdates would run while MWP is enabled under those conditions, but that wouldn't be a viable solution even if it did work.

Sorry if I sound cranky, but it took me several weeks just to figure out that MPW was causing my Norton LiveUpdates to fail, not to mention the countless hours I spent testing possible workarounds before I even contacted Malwarebytes Customer Support last December.  I've had Norton and MBAM running together in realtime protection mode since 2009 and never experienced a problem until I upgraded to MBAM Premium v2.x.

-------------

32-bit Vista Home Premium SP2 * Firefox 38.0.5 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8

HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[AdvancedSetup]

Well certainly odd as my own wife's computer runs NIS 2015 and MBAM and hers does not have trouble updating either one.

 

There was a new version of MBAM released today. Can you please try a clean removal of MBAM and download the latest version and install it and see if that corrects the issue or not and let us know.

 

Please uninstall your current version of MBAM and reinstall the latest version using this process. MBAM Clean Removal Process 2x

 

Thanks

 

Ron

 

[lmacri]

There was a new version of MBAM released today. Can you please try a clean removal of MBAM and download the latest version and install it and see if that corrects the issue or not and let us know.

 

Hi AdvancedSetup:

 

A clean reinstall of MBAM Premium v2.1.8 didn't help.  I've also tried clean reinstalls of MBAM Premium v2.0.4, v2.1.4 and v2.1.6 (as well as a clean reinstall of NIS v21.6.0.32 using the Norton Removal Tool in March 2015) and my NIS updates continue to fail if Malicious Website Protection is enabled on my 32-bit Vista system.

On 28-May-2015 I was told by Malwarebytes Customer Support that "it looks like we may have some additional incidents with other users with similar symptoms" and that the problem might be related to my location (Canada).  They were supposed to send instructions to collect further data for the QA Team, but a month has passed and I'm still waiting for those instructions.

I don't want to troubleshoot in the forum at the same time that I have an open support ticket.  As it stands, I can't enable Malicious Website Protection, and I'm getting tired of seeing daily pop-up warnings, a red exclamation mark in my MBAM system tray icon and that goofy red "sad face" emoticon on my dashboard warning me that "Your system is not fully protected.  Fix Now!".  I've decided to revert back to the free version of MBAM v2.1.8 for now and will re-evaluate if I ever hear back from Malwarebytes Customer Support.

-------------

32-bit Vista Home Premium SP2 * Firefox 38.0.5 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8

HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[AdvancedSetup]

Well I'm not sure what your status is on the Helpdesk but if ti's been a month then I'd have to assume they may have overlooked it somehow. I'd be more than happy to help you try to scan your system and see what's going on causing issues. Just let me know.

 

Thanks

 

Ron

[lmacri]

I'd be more than happy to help you try to scan your system and see what's going on causing issues. Just let me know.

 

Hi AdvancedSetup:

 

Thanks for the offer but I've sent DDS (old ticket) or FRST (current ticket) logs on three different occasions since Dec 2014 and there were no signs of an infection on my machine.  I've also sent logs for the MBAM Check Tool a few times and as far as I know CheckResults.txt has never shown a problem with my MBAM installation.

I sent Malwarebytes Customer Support an e-mail on 28-Jun-2015 to let them know that my NIS updates were still failing with Malicious Website Protection enabled in v2.1.8 (and to give them a friendly poke ) and the subject line included my case number so they know where to find me.  I think I'll just stick with the free version of MBAM v2.1.8 for now.

-------------

32-bit Vista Home Premium SP2 * Firefox 38.0.5 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8

HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[lmacri]

After waiting almost four months for instructions for collecting additional diagnostic logs, I finally heard back from the Malwarebytes Help Desk and the news isn't very encouraging.

It appears that the issue I've encountered with Norton LiveUpdates failing when MBAM's Malicious Website Protection is enabled is specific to 32-bit Vista and related to a problem where Malwarebytes Web Access Control (MWAC) "can act oddly on occasion".  This problem hasn't been widely reported by other Norton/MBAM Premium v2.x users and will be a low priority for the software development team so I have been told that "there is no solution or workaround we can offer for you at the moment."

As such, my only options are to purchase a new computer with a 64-bit OS, purchase different antivirus software when my Norton subscription expires, use MBAM Premium with Malicious Website Protection permanently disabled, or abandon MBAM Premium and try another realtime anti-malware program like SUPERAntiSpyware Pro.

-------------
32-bit Vista Home Premium SP2 * Firefox 41.0 * NIS 2014 v. 21.7.0.11 * MBAM Premium 2.1.8
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[Porthos]

As such, my only options are to purchase a new computer with a 64-bit OS

 

That would be my first recommended choice considering Vista.

[AdvancedSetup]

Unfortunately Vista is no longer supported even by Microsoft. It was made available to the general public back on January 30, 2007 roughly 8 years ago. New hardware and new Operating System would have much better capabilities than anything from that era.

https://en.wikipedia.org/wiki/Windows_Vista

[lmacri]

Just reporting that updating to MBAM Premium v2.2.1.1043 didn't solved this conflict with my Norton Internet Security (NIS).  After performing a clean install of v2.2.1, my Vista machine is still unable to connect to the Norton update servers and download background Pulse Updates or Automatic LiveUpdates when MBAM's Malicious Website Protection in enabled.

Norton Updates Fail with MBAM v2.2.1 Malicious Website Protection Enabled:

Norton Updates Succeed with MBAM v2.2.1 Malicious Website Protection Disabled:

 

I opened a ticket with the Malwarebytes Support Desk on 10-Dec-2014, and it's unfortunate that it took them until 22-Sept-2015 to tell me that my problem would not be escalated to the software development team because "it looks like an issue specific to the 32-bit Vista operating system where MWAC (Malwarebytes Web Access Control) can act oddly on occasion."

I realise that Microsoft is ending extended support for Vista on April 11, 2017.  I am also aware that companies like Apple (iTunes) and Google (Chrome) have already announced that their products will continue to run on Vista but that they will no longer provide security updates or technical support for this OS.  I only wish that Malwarebytes had been just as forthcoming back in 2014 so that I hadn't wasted countless hours running trace routes to Norton servers and submitting new diagnostic logs to their Support Desk every time a product update was released for MBAM or NIS.

Please lock this thread, since I have no expectation that this conflict with my Norton antivirus will be addressed in a future MBAM release.
-------------
32-bit Vista Home Premium SP2 * Firefox v45.0.1 * NIS v.21.7.0.11 * MBAM Premium 2.2.1
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[lmacri]

Since this thread hasn't been locked yet, I'll just post another status update for Vista users.  I was recently required to upgrade from NIS v21.7.0.11 to the latest NIS v22.7.0.76 to patch the vulnerabilities listed in Symantec's security advisory SYM16-010, and the Norton upgrade didn't solve my conflict with MBAM Premium's Malicious Web Protection (MWP).  MBAM's MWP still prevents my NIS v22.7.0.76 background Automatic LiveUpdates from running to completion during system idles on my 32-bit Vista machine.

This was a clean install of NIS v22.7.0.76.  I uninstalled v21.7.0.11 from the Control Panel (selecting "Please remove all user data"), ran the Norton Removal Tool, installed v22.7.0.76 using the latest NIS offline installer from www.norton.com/latestnis, and ran multiple LiveUpdates to ensure v22.7.0.76 was fully patched.  Adding mutual scan exclusions for NIS and MBAM executables as instructed <here> made no difference, so I've had to permanently disable MWP again.

It's fine if forum mods want to lock this thread.  The MBAM Help Desk already looked at my diagnostic logs and trace routes and concluded that a bug fix would be a low priority since this type of problem only occurs for a small number of users.
-------------
32-bit Vista Home Premium SP2 * Firefox v47.0.1 * NIS v.22.7.0.76 * MBAM Premium 2.2.1.1043
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS