Norton Antivirus Troubleshooting Tips:How to Avoid Two Common Problems

Dan Albrich
Manager, Microcomputer Services
dalbrich@oregon.uoregon.edu

Recently, we’ve seen a couple of problems on campus related to Norton Antivirus software. NAV’s email scanning function caused problems with email settings and SSL security, and network connections were broken when people tried to uninstall NAV 2002.

You can avoid running into either of these snags by taking note of the following tips:

Problem 1: NAV Email Scanning

Because of the problems associated with this feature, it’s always a good idea to turn off NAV’s email scanning.

Historically, this feature has never worked well. In NAV 2001 and earlier, if email scanning was enabled, the POP proxy daemon running on the desktop PC was vulnerable to external attacks.

Email scanning and settings issues. Another thing to watch is that Norton may change the POP settings in your email client software when email scanning is turned on. When you turn email scanning off, be sure to check your email configuration settings for accuracy. (To learn more about this problem, go to http://service1.symantec.com/SUPPORT/nav.nsf/pfdocs/2000020716064206 and open the “NAV 2001” link.)

Here’s an example of settings that changed:

Host: pop3.norton.antivirus
Server Type: POP3
Username: jsmith/mail.uoregon.edu

To fix the problem, change these to:

Host: gladstone.uoregon.edu (or darkwing.uoregon.edu, as appropriate)
Server Type: POP3
Username: jsmith

Each email client looks slightly different. See our email setup pages at http://micro.uoregon.edu/email/ for more information on how to get the correct settings.

Email scanning and SSL issues. Current versions of NAV continue to use a virtual proxy, and so cannot be used with SSL. The basic problem is that you cannot proxy an SSL connection, so NAV doesn’t try to intercept anything but the standard non-SSL port for POP. Likewise, when email scanning is enabled, NAV also fails to protect IMAP connections. (NAV autoprotect does, however, continue to scan all email attachments for possible viruses).

Suffice it to say that turning off NAV email scanning has been, and continues to be, good advice. We have updated our NAV pages at http://micro.uoregon.edu/av/ to reflect this.

Problem 2: Uninstalling Norton Antivirus 2002 Kills Network Connection

If for some reason you want to uninstall NAV 2002, you should be aware that you can lose your network connection in the process. This occurs because NAV 2002 adds an entry to the Windows registry that causes the computer to wait for a certain file to load before obtaining an IP address from the DHCP server. Uninstalling NAV through Add/Remove programs or using the NAV uninstaller removes this file but leaves the entry, so your computer will never obtain an IP address.

Solution: You must edit the registry to remove the entries that were left behind. Please be careful when doing this—removing any other entries could make your system unusable.

To edit the registry:

1. Click Start, then Run. Type regedit and click OK.
2. Navigate to the following subkeys:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCP HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NetBT
3. In the right pane, double-click on DependOnService.
4. Delete any references to SYMTDI or NISDRV.

Exit and save changes.
(See also Cornell’s Troubleshooting site at http://www.cit.cornell.edu/helpdesk/win/nav/navinternet.html)