United3dArtists Archive

I was on Primitive itch's site and noticed they were giving away primal particles
version 1.7.2 for tS 5, not sure if it is a demo, but I thought I'd d/l and see as I could definately use the plug-in. Now normally I scan any file with Norton after d/l and then shut off norton to install programs, however this time I forgot to shut down norton, so when I went to install Primal Particles Norton STOPPED it quickly and quarantined the Primal exe saying Norton SONAR found suspicious behavior (basically). It didnt give a virus name but said something to the effect of suspicious maleware behavior.

Anyone run into this? or have any info? Could this be a false alarm/ kind of scared to chance it now.

kind regards
Rob

kinda weird.. i never saw any warning, i'm using zonealarm and avira ..

Prodigy wrote:kinda weird.. i never saw any warning, i'm using zonealarm and avira ..

nope...neither did I, zonealarm said nothing...only norton Sonar.

kind regards
Rob

Probably a false positive.

SONAR is based on heuristics (rules, patterns) and reports when suspicious activity is detected. Some legitimate programs do things that viruses might do and sometimes look suspicious.

If you set SONAR advanced mode Off then low certainty suspicions won't be detected. I would usually set advanced mode to automatic.

You can look at the history log. There might be details about how serious or certain the possible threat is. Otherwise check the Norton website for info on the possible threat. It might say if it is a know false positive.

Finis wrote:Probably a false positive.

You can look at the history log. There might be details about how serious or certain the possible threat is. Otherwise check the Norton website for info on the possible threat. It might say if it is a know false positive.

Finis

I forgot to mention specifically that yes, I did scan the file right after d/l, no viruses or threats detected.

ok, I looked in all my logs, it only appeared in 3, they are:

1. 'Resolved Security Risks'
Severity: High
Risk type: File
nothing to click on for more info.

2. 'Quarantine'
nothing here really just saying primal particles was quarantined.
nothing to click on for more info.

3. 'System Activity monitoring'
Primal particles [version etc, etc] accessed the system resources listed above. (this resource is a .tmp file in a subfolder in 'my documents and settings folder that I cant delete because always says its in use by another program.)
Severity: low

I decided to attempt a reinstall to see what messages I could get to be specific, but nothing....little norton box pops up down near the clock area of task bar and says:

Norton antivirus, etc, etc, etc detected a security risk, primal particles1.7.2-ts5-setup.exe. risks resolved, etc, etc

Thats it. cant find anyother info, what the threat is exactly, nothing. [shrug]

kind regards
Rob

The .tmp file access probably seems suspicious to SONAR. Assuming you got the plug-in from a good source then this is probably not a real virus or threat. You could look on Norton's website for info about that file just in case.

I wouldn't worry since the scan you did found nothing.

If Norton's actions are preventing you from installing the plug-in then turn SONAR off while installing or choose to allow the action if Norton gives an option for that when the warning appears.

Otherwise I'd use it with advanced mode automatic on, not aggressive mode, and the removal settings so there is no removal without asking.

I seem to recall another person reporting this very same problem, with primalparticles, some time ago.
But the final result was, primalparticles does not have a virus in it.

Cayenne (PaulA) created a backup of the Caligari forum. I had that bookmarked in Virginia, but don't have it here.
Perhaps the bookmark is still on my home PC. The thread regarding this issue may reside on those backed-up forums.
Anyone have the link readily accessible?

Froo

Of course!

http://www.awportals.com/archives/trues ... d.php?b=25"

I use Norton 360 and to help you I downloaded Primal Particles 1.7.2 from Primitive Itch.
I installed the program with no warnings at all.

Steinie wrote:I use Norton 360 and to help you I downloaded Primal Particles 1.7.2 from Primitive Itch.
I installed the program with no warnings at all.

I'm kind of leaning to the notion that it dont, maybe norton just doesnt like something it sees, so marks it as it did. well better safe than sorry I guess. I shouldn't complain.

I'll 'disable' norton for the install and just try it. BTW, Primitive itch's site doesnt say, but anyone know if PP 1.7.2 works for both tS 5.1 and tS 7.6?

Finally I installed tS 7.6 about 20 mins ago. Looks amazing...now I just have to learn all the new stuff and my way around the program. Quite the difference from 5.1 sp2.

kind regards
Rob

For the sake of completeness and to finalize this thread, I disabled Norton AV, installed Primal Particles, re-enabled Norton and then ran a full system scan with norton: No threats found.

I also ran a full scan with Spybot search & Destroy: No threats found.

So yeah, evidently Norton Sonar just didnt like something it seen when I tried to install the first time around when I left Norton active by accident.

case closed

kind regards
Rob