Norton AntiVirus won't allow Viavoice to load because detects Trojan
I have a Dell Computer with Windows XP Service Pack 2. Just after Service Pack 2 was installed last January, Norton AntiVirus started sporadically detecting and blocking what I considered to be spurious Trojans (RASmin Trojan, Bla Trojan, Extreme Trojan) all referring to the path C:\Program Files\ViaVoice\Bin\smart.exe. I wasn't online when these events happened. Recently the problem has gotten more serious. Now Norton AntiVirus has started actually preventing ViaVoice from loading. As ViaVoice starts to load, one of the above listed Trojans is blocked and ViaVoice is stopped in its tracks. Sometimes ViaVoice manages to load and function normally despite the interference. It doesn't make any difference whether ViaVoice loads during computer startup or later when I click on its icon. Surprisingly, disabling Norton doesn't make any difference either. The path, which goes to setting up the microphone and sound, is always the same.
All of the scans I have done have come up clean. They include Ad-Aware SE Personal, Spybot Search and Destroy, and of course Norton Antivirus. For good measure, I threw in scanning the registry with CCleaner. Has anyone else had a similar problem? Does anyone know what my next step should be in dealing with this? I'm wondering if Norton AntiVirus could be corrupted. It's never given me any trouble before.
Thank you for your attention,
Anne



It's a well-known fact that
It's a well-known fact that Norton anti-virus causes problems with ViaVoice. It has been like this since day one.
There are two things you can do:-
1. Try a complete re-installation.
If that doesn't resolve the problem, then I would suggest a complete clean reinstall.
First of all have a look at these four :
http://www.speechcomputing.com/node/494
http://www.speechcomputing.com/node/312
http://www.speechcomputing.com/node/216
http://www.speechcomputing.com/node/576
You will see that I have detailed how to do a completely clean install.
Not having looked at these for some time, I cannot recall whether I mentioned that you should use a registry cleaner, such as Cclean or RegScrub, to make sure that everything relating to VV has been cleared out.
Then do you your reinstall. When it has finished, do not start it straightaway. Paste your existing speech files into Documents and Settings \ Application Data \ IBM \ ViaVoice \ Users \. Then go to Control Panel \ IBM ViaVoice Options, in the top drop-down box, scroll and find your existing user, and apply. Go through all the tabs and complete your settings.
2. Change from Norton to one of the other good anti-virus programs, such as Grisoft AVG (which I use with ViaVoice) Which has been most successful in preventing any viruses or trojans getting through. It is a free programme, although you can get the professional version for in or around $30 for a two year licence (that's what I have). It updates automatically every day, and on occasions twice a day. This is a programme that does not interfere with any other programmes in a computer (unless they have acquired a virus or trojan!).
Quentin
anneh wrote: I have a Dell
I have a Dell Computer with Windows XP Service Pack 2. Just after Service Pack 2 was installed last January, Norton AntiVirus started sporadically detecting and blocking what I considered to be spurious Trojans (RASmin Trojan, Bla Trojan, Extreme Trojan) all referring to the path C:\Program Files\ViaVoice\Bin\smart.exe. I wasn't online when these events happened. Recently the problem has gotten more serious. Now Norton AntiVirus has started actually preventing ViaVoice from loading. As ViaVoice starts to load, one of the above listed Trojans is blocked and ViaVoice is stopped in its tracks. Sometimes ViaVoice manages to load and function normally despite the interference. It doesn't make any difference whether ViaVoice loads during computer startup or later when I click on its icon. Surprisingly, disabling Norton doesn't make any difference either. The path, which goes to setting up the microphone and sound, is always the same.
All of the scans I have done have come up clean. They include Ad-Aware SE Personal, Spybot Search and Destroy, and of course Norton Antivirus. For good measure, I threw in scanning the registry with CCleaner. Has anyone else had a similar problem? Does anyone know what my next step should be in dealing with this? I'm wondering if Norton AntiVirus could be corrupted. It's never given me any trouble before.
Thank you for your attention,
Anne
Anne,
The problem with antivirus programs, particularly Norton AntiVirus and McAfee, is that they use what are called heuristic algorithms. Heuristic algorithms in antivirus programs are designed to catch behavior that mimics malicious code, such as VBScripts, ActiveX controls, and JavaScripts that tend to mimic the behaviors of a general and very broad range of Trojans , virus, and malicious code. Unlike the virus signatures portions of these programs, the heuristic algorithm is a behavioral pattern analyzer. Regardless of the specific type of Malware that something may be attempting to either install or execute on your system, and which already has a virus signature or code signature, these algorithms run in what is kind of like a pseudo-sandbox. That is, they allow the execution of the code and then analyze the behavior. Inherent in the heuristic algorithm is a set of patterns of behavior that are known to be malicious. When the heuristic algorithm analyzes and applications attempt to access files and folders, low-level Windows controls, or any other aspect of the operating system that may allow a hacker to get in and take control of your system and then compare it to a coefficient of behavioral probability based on typical Malware behavior. I'll use the term Malware or malicious code to simply define all of these because if they are truly malicious, regardless of type, they all exhibit certain types of behavior. In some cases, these programs can be adjusted for the coefficient of probability. I believe McAfee can but I can't remember whether Norton antivirus allows this. Nevertheless, the general default is that if the behavior of certain applications that exhibit these types of tendencies exceeds 85% probability, these applications will block it on the principle of better safe than sorry. Heuristic algorithms are designed to trap and block anything that is not specifically defined in antivirus or Malware signatures, but which does exhibit behavior which is common to these types of malicious code. The end-user can go in and set Windows to prevent these types of malicious code from gaining access to the files, folders, or other low-level Windows controls, but this is a very tedious process and requires a great deal of knowledge about low-level security settings. I used to work for Trend Micro and Finjan, two of the top-of-the-line security software providers and I learned how to get in and make these changes. However, the average user is never going to understand completely how they work. Therefore, programs like Norton AntiVirus and McAfee attempt to do this for you. However, heuristic algorithms take a very broad approach to detecting these types of behaviors and don't always get it right. Nevertheless, if your antivirus software, and I know this is possible in Norton AntiVirus and McAfee antivirus programs, allows for a settings to exclude certain applications (executables and DLLs), then you can add these to the exclusion settings and it will prevent the programs from blocking them. If you're using an Internet security program, such as McAfee Internet security, there are settings that allow you to allow specific executables to proceed without blocking them. In fact, McAfee Internet security 2007 pretty much automatically configure such executables (an executable can either be an ".exe" file or a ".dll" file) as allowed and does and generally block them as in your case.
To sum it up, the problem occurs because of the fact that the heuristic algorithm in Norton AntiVirus sees the behavior of the ViaVoice files as being a fairly high in probability of being malicious code. I would suggest that you look for the settings that allow you to exclude any files that Norton AntiVirus blocks from executing when you launch ViaVoice. This should solve your problem. I would ignore the blanket statement that Norton AntiVirus is a problem generally. Those problems are usually system configuration and user problems rather than the application itself being the source of the problem. No antivirus program or Internet security program is 100% free of being subject to false positives. They all have problems somewhere along the line. However, they all have the capability, as far as I can recall, of setting up the system to exclude certain application executables from being tagged as malicious code/viruses.
I never had a problem with Norton AntiVirus properly configured. However, as the number of viruses and malicious code has increased over the years, updates to the heuristic algorithms and virus signatures in programs like McAfee and Norton antivirus tend to make them more prone to false positives. In addition, remember that heuristic algorithms are designed to trap anything that isn't specifically identified via a specific antivirus or malicious code signature. Therefore, these companies tend to play it safe and their default settings are generally more aggressive.
Chuck Runquist
Former Dragon NaturallySpeaking SDK & Senior Technical Solutions PM for DNS
If computers get too powerful, we can organize them into a committee - that will do them in. - Bradley's Bromide
Quentin and Chuck, Thank you
Quentin and Chuck,
Thank you both, for your rapid and detailed responses to my question.
I decided to try Chuck's suggestion that I look for settings that allow me to exclude any files that Norton blocks from executing when I launch ViaVoice. Using Norton System Works, I clicked Options, Antivirus, and then Autoprotect and typed in the full paths for “smart.exe” and “speechbar.exe” in the Exclusions window. Unfortunately this had no effect on the problem.
There were two remaining things I could try that where more specific to Trojans. One was to decrease the Bloodhounds heuristic level of protection. The second was to remove Trojan Horse Rules. I chose the latter because all three of the Trojans that Norton AntiVirus attributed to ViaVoice files were listed. Success at last! I've had no more trouble with launching ViaVoice since I unchecked the three rules.
Here's what Symantec Help says about removing a Trojan Horse Rule. "By default, Internet Worm protection employs numerous Trojan Horse Rules to protect your computer. If it detects a Trojan horse that matches a rule, Internet Worm Protection issues an alert. These rules are supplied by Symantec and kept current by LiveUpdate.’’
"Remove Trojan Horse Rules when they are no longer necessary or when you believe that the signature has been misidentified as a Trojan horse. You should not change these rules without knowing how your changes will impact your protection."
Are the Trojan Horse Rules heuristic in nature? Could removal have a negative impact on my protection? Or is what I did just what the doctor ordered?
Thanks again.
Anne
Anne, You have uncovered
Anne,
You have uncovered the most important answer that many ViaVoice users, who have Norton anti-virus, have waited for.
Skip, this thread should be specially posted, and highlighted, in the ViaVoice forum where many users can find it easily.
Up to now anyone with these problems had been advised to get rid of Norton and replace it with one of the others. Now that should not be necessary.
Quentin
anneh wrote: Quentin and
Quentin and Chuck,
Thank you both, for your rapid and detailed responses to my question.
I decided to try Chuck's suggestion that I look for settings that allow me to exclude any files that Norton blocks from executing when I launch ViaVoice. Using Norton System Works, I clicked Options, Antivirus, and then Autoprotect and typed in the full paths for “smart.exe” and “speechbar.exe” in the Exclusions window. Unfortunately this had no effect on the problem.
There were two remaining things I could try that where more specific to Trojans. One was to decrease the Bloodhounds heuristic level of protection. The second was to remove Trojan Horse Rules. I chose the latter because all three of the Trojans that Norton AntiVirus attributed to ViaVoice files were listed. Success at last! I've had no more trouble with launching ViaVoice since I unchecked the three rules.
Here's what Symantec Help says about removing a Trojan Horse Rule. "By default, Internet Worm protection employs numerous Trojan Horse Rules to protect your computer. If it detects a Trojan horse that matches a rule, Internet Worm Protection issues an alert. These rules are supplied by Symantec and kept current by LiveUpdate.’’
"Remove Trojan Horse Rules when they are no longer necessary or when you believe that the signature has been misidentified as a Trojan horse. You should not change these rules without knowing how your changes will impact your protection."
Are the Trojan Horse Rules heuristic in nature? Could removal have a negative impact on my protection? Or is what I did just what the doctor ordered?
Thanks again.
Anne
Anne,
Thanks for the update. I currently don't use Norton antivirus 2007. This is something new that they have added.
As to your question, the Trojan Horse Rules are heuristically based, but they are not technically heuristic algorithms. Bloodhound is the heuristic algorithm that Norton AntiVirus users. All Norton has done is provide a basic set of general rules regarding Trojans.
I agree, that this should be posted where it can do the most good.
Chuck Runquist
Former Dragon NaturallySpeaking SDK & Senior Technical Solutions PM for DNS
If computers get too powerful, we can organize them into a committee - that will do them in. - Bradley's Bromide
I've added this thread to
I've added this thread to the ViaVoice Frequently Asked Questions as well as making it sticky at the top of the ViaVoice forum list.
Skip
Anti Virus Software
I've used Avanquest's SystemSuite for several years now and have never had a problem installing ViaVoice. The Anti Virus component of SystemSuite is I believe, licensed from Trend Micro who market their own range of AV software. The versions concerned were ViaVoice 7 (aka Millenium Edition) and Version 9 on Windows 2000 SP4 machines. Hope this of use to someone.
Bill
Slight correction
VV 7 was known as Executive, and some regard it as having been the best version.
VV 8 was known as Millennium.
Quentin