	KB Home \| Advanced Search \| Glossary \| Ask Question
Knowledge Base

Norton Antivirus is Reporting a Problem

Article Number: 13 | Rating: Unrated | Last Updated: Sun, Feb 21, 2010 at 7:28 PM

Norton Antivirus users

On Dec. 4, 2009 Norton Antivirus started incorrectly reporting that TMS Explorer contains a trojan virus (Infostealer.Banker.C).

This is a False Positive. TMS Explorer DOES NOT CONTAIN ANY VIRUSES

The warning message looks something like this:

Unfortunately, they are not able to reproduce the problem so they cannot resolve this.

Update Jan. 20/2010

The situation is getting worse. Norton is now falsely detecting a 2nd virus (Trojan.Zbot).

They adamantly refuse to admit a problem. Here's a copy of an email they sent me (bold mine):

Robert,
After extensive testing we have managed to reproduce the issue. Our testing has confirmed that this is not a false positive but is in fact a valid detection. The user's computer has apparently been infected with Infostealer.Banker.C (source unknown) which then injects its malicious code into the running TMS process. Our products detect the infected TMS process and quarantine the file responsible for this process - tmse9.exe.
The user should restore the TMS file from quarantine and then run a full scan *while the TMS process is not running*. This will remove the Infostealer.Banker.C threat but will not touch the TMS file, assuming the file itself hasn’t been infected. Once the machine is clean the TMS process can be run without issue.

Sincerely,
Symantec Security Response

This is patently false. If you are receiving the virus warning your pc is NOT INFECTED. All the other major anti-virus products (McAfee, AVG, TrendMicro, Kaspersky, Microsoft, Panda etc. here's a list ) are capable of detecting Infostealer.Banker but ONLY NORTON is causing a problem with TMSE users.

I know of one case where Vista and TMSE were installed onto a brand new hard-drive. So there was no way it could have been infected. When Norton was then installed the problem appeared.