Search Unity

  1. Good news ✨ We have more Unite Now videos available for you to watch on-demand! Come check them out and ask our experts any questions!
    Dismiss Notice
  2. Ever participated in one our Game Jams? Want pointers on your project? Our Evangelists will be available on Friday to give feedback. Come share your games with us!
    Dismiss Notice

Norton Antivirus reports Unity3D created exe as a Virus

Discussion in 'Editor & General Support' started by amattila, May 24, 2010.

  1. amattila

    amattila

    Joined:
    Sep 18, 2008
    Posts:
    5
    I'm having this very annoying issue with my Unity3D built game and Norton Antivirus 2010. When building windows exe with custom file-icons, Norton AV reports that it behaves like a virus, and guarantines it.

    How to reproduce:

    1) Create empty project and add empty scene to it.

    2) Add icons to it from Player Settings. (Without icons its free from viruses)

    3) Build

    4) Run - And the "norton sonar" pops up, and says that it has taken the exe to guarantine.

    This all works with other antivirus software, like F-Secure and AVG.

    So to get the same results, you must install this trial version of Norton antivirus 2010, install latest updates, and reboot (you have to reboot to get this reproduced, eaven thought that installer does not require it).

    http://www.symantec.com/norton/downloads/trialsoftware/offer.jsp?pvid=nav2010

    I also tried to create exe without icon, and change the icon with two different softwares (XN Resource Editor and Icon Changer), but the results are the same.

    Oh, and one more thing. If you run the exe before you have Norton installed, it all works, because Norton thinks its trusted file since you have already used it, and does not check it. So you must build the exe after having norton installed / run existing exe file first time.

    I think its a bug in Norton Antivirus software. But I thought that it would be good to write this down, if someone else is fighting with the same issue. (I spent a whole day for hunting this down.)

    Or is there any ideas how to prevent this?
     
  2. Dreamora

    Dreamora

    Joined:
    Apr 5, 2008
    Posts:
    26,603
    I'm sorry to say but if you install the only commercially sold virus (with the by far largest false positive rate off all AVs on the market) you have to expect such fictive issues. There is no problem with unity or security at all in this case, just total missbehavior of norton, as usual
     
  3. siggi-gross

    siggi-gross

    Joined:
    Apr 6, 2009
    Posts:
    56
    hi, found the same, the bug is with norton :evil:

    as dreamora said, get a "real" AV solution ;-)

    greets siggi
     
  4. amattila

    amattila

    Joined:
    Sep 18, 2008
    Posts:
    5
    I prefer not to have any "cpu-killer" my self.

    But when selling the game to ordinary people, they tend to have this kind of software pre-installed on their machines.

    And its a big problem when they demand their money back or when they start writing forums that this companys makes viruses.

    I think this issue is something that maybe Unity should negotiate with Norton. If every one of us start complaining to Norton, we all have to go throught the same painfull process, and delay our product launch for a months maybe. (I've heard that there is somekind of white-list system - but its not a real solution to this)

    siggi-gross: Thank you for verifying this!
     
  5. Dreamora

    Dreamora

    Joined:
    Apr 5, 2008
    Posts:
    26,603
    UT can't do anything about Norton being bugged and crapped like S***, nor can you do.
    The one and only solution is reverting what should never have happened in first place: uninstall it.

    You will have to face it the same way as all others: FAQ entries that cover the common "super troublemakers" and consider adding a corresponding note that all your releases are checked through XX (some real antivirus solution)
     
  6. sybixsus2

    sybixsus2

    Joined:
    Feb 16, 2009
    Posts:
    943
    Of course they can. They can (and should) report any false positives to Symantec and have it removed ASAP. All antivirus companies have this facility and Symantec are no different in this regard.

    The original poster can probably do the same thing, but it would be better coming from the actual developer, which in this case is really UT.
     
  7. Dreamora

    Dreamora

    Joined:
    Apr 5, 2008
    Posts:
    26,603
    That though doesn't change anything to the problem.
    It might work as a temporal solution to have one specific version of Unity being "white listed".
    It could and would only work if it is caused by the exe itself none of the assemblies though


    Norton has likely hundreds to thousands of provided "Unity virus finds" in their DB and as we see their architects go through and are incapable to correctly whitelist software thats known to be virus and malware free, as its commonly done.

    Reporting false positive to a AV creator is something required for niche software, not for something where the editor side has been downloaded over a hundred thousand times and where the compiled games likely have been executed on hundreds of thousands to millions of machines.
     
  8. OutCyder

    OutCyder

    Joined:
    Mar 19, 2009
    Posts:
    2,176
    Solution -> trash Norton.
     
  9. Guru

    Guru

    Joined:
    Apr 30, 2010
    Posts:
    118
    I agree with this guy (and everyone else who said it). As for having the developer (Unity) speak to Norton and get it removed from being flagged as a virus....good luck with that. At a previous employer they went that route and it was never changed on Norton's end.
     
  10. thomasrh

    thomasrh

    Joined:
    May 12, 2010
    Posts:
    5
    Have to say that all the Norton hate is getting a bit old. It's not been a CPU-hog for ages. It's been running amazingly smooth on my computer for 4+ years now and I've had zero, zip, nada, none problems with it at all.

    I don't even notice it's there unless I tell it to do something. Or if I go idle for the 5 minutes I've set it up to. I often look at it's logs and it says it's been doing this and that 50 seconds ago or 5 minutes ago, and I didn't notice it doing anything at all. Even while playing online games I never notice it.

    I've also seen 1 single false-positive that annoyed med in 4+ years, and it was fixed within 12 hours.

    I'm sorry, but every time I hear people talk like this about Norton, they've usually not tried it since the 1990s.
     
  11. Ramen Sama

    Ramen Sama

    Joined:
    Mar 28, 2009
    Posts:
    561
    If other programs are reporting it as a virus, maybe it is infected? but it doesn't come from the factory loaded with a virus.


    Get Nod32 it's 100% assembly code. doesn't get faster then that. by far the best AV i've used.
     
  12. amattila

    amattila

    Joined:
    Sep 18, 2008
    Posts:
    5
    This is not about what Antivirus software I use, or you use, or what AV is recommended.

    This is a issue that affects all developers when distributing our games. When selling casual games, end users just get pissed if bought game does not work and they blaim you. They dont send you an email saing "this games is virus, what do I do?". They mark it zero or one star, and write review that "ITS A VIRUS, DONT DOWNLOAD IT AND AVOID ALL PRODUCTS FROM THIS COMPANY IN FUTURE!!".

    I really hope that Unity staff will pick this up and resolve this issue with norton. There is something in Unity code, that makes Norton to alert. And that is something that we dont get to see.

    Guru: Thank you for sharing this about white-listing. So we should not have high hopes on that route.
     
  13. lion-gv

    lion-gv

    Joined:
    Nov 12, 2007
    Posts:
    117
    I am going to fill out this form as a Unity representative:

    https://submit.symantec.com/dispute/

    I encourage any users who own norton antivirus, or who are somehow affected by this to also fill out the form. If they get enough volume perhaps they can sort this out.
     
  14. OutCyder

    OutCyder

    Joined:
    Mar 19, 2009
    Posts:
    2,176
    I wouldn't transform this thread into a AV battle but... I must say that I abandoned Norton in 2002 after understanding that it was an octopus eating my machine.
    After that, it became more and more price unfriendly with no reason: there were free valid alternatives around.
    And now there are MORE free good alternatives. Or almost free.
    Why spend so much for Norton? Also most of what you pay is for their marketing office...
     
  15. birvin

    birvin

    Joined:
    Jan 14, 2008
    Posts:
    264
    wrong buy a mac solution to any problem. Also i wouldnt put it past most of these well known anti virus companies to work with MS to make damn viruses. I use avg ive scaned my puter which is xp. nuthing is seen stop looking at porn and maybe things wont show up as a virus ive used unity for quite a while. I havent made anything but ive used it and not one time has it showed up as a virus. Calm down format reinstall back up and scan it again without Norton Virus vault.
     
  16. ColossalDuck

    ColossalDuck

    Joined:
    Jun 6, 2009
    Posts:
    3,246
    Why would you possibly use Norton? I tried it for a week and vomited with rage. In fact, once I uninstalled it, I noticed an increase in virus gathering straight away.

    %100 true. I use avira antivirus free, and have been free of all viruses for a while now.


    wrong, macs are just as prone to viruses, they just don't have as big of a user base so less viruses are made.
     
  17. rytis

    rytis

    Guest

    Joined:
    Jul 11, 2008
    Posts:
    138
    There is something Norton Sonar does not like about unity executable. It does not depend on having custom icon.

    The funniest thing if you open Norton and choose to scan the same unity player executable it does not find anything.

    I'd think then there is something player code does that Norton does not like, but no... it "detects" something BEFORE any unity player code executes...
     
  18. amattila

    amattila

    Joined:
    Sep 18, 2008
    Posts:
    5
    In our tests, it really requires custom icon. I have tested this with four pc:s, and in all it works without custom icon, but not with it.

    To go eaven further, you can build a "clean" exe without icon and it works, but if you use some external software to add icon to that exe, then sonar detects it as a virus again.
     
  19. rytis

    rytis

    Guest

    Joined:
    Jul 11, 2008
    Posts:
    138
    That would at least make sense. I get same problem if i try to run unity standalone player right as it comes out of Visual Studio build. Same thing.
    I'll be naive and try to get in contact with their support.
     
  20. tonyd

    tonyd

    Joined:
    Jun 2, 2009
    Posts:
    1,224
    Actually, they're not. Unix based OS's are simply more secure.

    Before OSX, Macs did indeed have viruses, even though their market share was smaller than it is today.
     
  21. dbp

    dbp

    Joined:
    Mar 3, 2010
    Posts:
    324
    as a programmer, a mac is not even an option to think about, but because i want to use unity, i can't use linux either.

    i don't know why i would want to use an AV-software, that's more stupid than i am, all it does is preventing me from working properly. i have been using some kind of AV-software for over 10 years, but the one time i actually did act stupid and clicked the wrong link it didn't even help me, so now i'm only using free software that doesn't annoy me so much.
    unfortunately a company like symantec doesn't even need to care about a small group like the unity users who also have norton so i'm not getting my hopes up.
     
  22. tonyd

    tonyd

    Joined:
    Jun 2, 2009
    Posts:
    1,224
    Not sure what you mean by this statement. As a programmer, I wouldn't choose anything else, as it's the only way to (legally) develop for Windows/Linux/OSX on the same machine. Unity is not only available for the Mac, it was once Mac only... and a Mac is still required for iPhone/iPad development.
     
  23. dbp

    dbp

    Joined:
    Mar 3, 2010
    Posts:
    324
    i'd reply to your post, but it would most likely lead to another Mac vs. PC debate that has been held so many times before and it doesn't belong here imo
     
  24. BS-er

    BS-er

    Joined:
    May 24, 2009
    Posts:
    115
    C'mon people! how can any developer think that uninstalling Norton on your own computer is the solution to this very real problem? Will thousands of prospective Windows purchasers somehow overlook the problem if they know that the developer uninstalled Norton?
     
  25. Dreamora

    Dreamora

    Joined:
    Apr 5, 2008
    Posts:
    26,603
    How can any developer considering installing it?

    Only homeuser with barely more knowledge than how to start the pc install it, all other knows that it is the most expensive, legally spread virus on earth. Norton is more persistent to removal than the majority of all annoying worms spread the past 4 years. Even MyLove is easier to get rid of than norton (even if you need to do it manually without a tool!)

    To quote something a fellow dev posted on another board:



    Also its Nortons job to handle the masses of false positive reports they got. If they have still not fixed it, the only thing you can do is take legal steps against them for attacking your business on purpose.
     
  26. vander

    vander

    Joined:
    Jul 14, 2010
    Posts:
    1
    Your problem is not so big as you think it is. from my own experience I know that sometimes the antivirus recognize your game crack as a virus but this problem can be solved immediately if you change your antivirus by a new one
     
  27. rytis

    rytis

    Guest

    Joined:
    Jul 11, 2008
    Posts:
    138
    Me and my coworker send inquiries to Norton about this, and yesterday we got responses that something was done about the issue (no idea what) and that fix should come with virus database update. Can someone who had this issue confirm if it is fixed?
     
  28. Vert

    Vert

    Joined:
    Mar 23, 2010
    Posts:
    1,093
    I suggest using ZoneAlarmfirewall and AVG antivirus or Comodo Internet Security. I am using Comodo currently. I like its customization options and it doesn't bog my computer down.

    My family had Norton once and then renewed it once. Then I found free AV options for us and found out that Norton was junk. That was back when we had just gotten our PC and we were not computer savvy. Norton is a resource hog that Virus makers target as it's installed on a large user base.
     
  29. Undead

    Undead

    Joined:
    Nov 13, 2009
    Posts:
    49
    Sadly no, it still complains and thinks it's a virus (tested with an exe built from unity 3 b5)
     
  30. allarddijk

    allarddijk

    Joined:
    Aug 21, 2010
    Posts:
    8
    Unity3 b7 is reported as virus :-(
     
  31. minevr

    minevr

    Joined:
    Mar 4, 2008
    Posts:
    1,015
    No...Kill my game~~ S***..
     
  32. Tudor-Nita

    Tudor-Nita

    Joined:
    Dec 10, 2009
    Posts:
    351
    Heuristic scanning usually produces a stuff-load of false positives (whatever the company).

    Since I've worked for Softpedia for quite a while I can only advise you guys to contact the AV vendors that get false positives only when you hit a stable version and to do it through "official" channels.

    Also, they appear to produce FPs on anything that uses non-standard archiving or file packing/ injection. Maybe that's why they only detect it when you add an icon to your executable.

    Alas, the state of Heuristic scanning is deplorable and should either be dropped until it's mature enough or be deactivated by default. Right now it's only purpose seems to be hurting small-time/ open-source developers.

    Also, some companies (Symantec being one of them) still employ some sick stuff like suspecting any executables or dynamic libraries packed or compiled with a certain tool that was also used to pack malware. It's like they've learned nothing from the old WinRar disasters of 2005.
     
  33. minevr

    minevr

    Joined:
    Mar 4, 2008
    Posts:
    1,015
    I hack the icon....Nortom is bad!!

    now..I used winrar sfx..temp. :?
     
  34. novello_io

    novello_io

    Joined:
    Nov 22, 2009
    Posts:
    293
    I'm hoping the reason they're not dealing with this is because they're busting their asses off to get Unity 3 out the door and changes within the builds could cause Norton to flag it again (just guessing)

    But bottom line, I hope its fixed in the next couple of months. I personally don't like Norton because it's expensive for what I feel it provides. However my desires aren't important, I have to cater to the customer.

    I'm making a casual game targeted at people who probably dont spend as much time as I (or likely a lot of us here) to think about the best AV program. Norton has brand presence and it's used a lot.

    I would hate to have to do damage control after I release my game to unhappy customers because they think I'm giving them a virus.

    How is this handled with Unity games released on Steam already like Guns of Icarus and Max and the Magic Marker? Does it give a Norton flag with those as well?
     
  35. BS-er

    BS-er

    Joined:
    May 24, 2009
    Posts:
    115
    Unity 3.0 f1 exes are also rudely removed by Norton, even if using the default icon (build by a mac anyway).

    Maybe we should all start a class-action lawsuit 8).

    Anyone suggesting a solution like "stop using Norton" needs to be slapped hard so that we can get their brains working again and thinking like a developer.
     
  36. Dreamora

    Dreamora

    Joined:
    Apr 5, 2008
    Posts:
    26,603
    I won't suggesting that you should stop using norton. Its your decision if you pay a hefty yearly fee to install a virus thats worse than any worm, more persistant than even root kit level worms and eats more performance than even the worst virus and spam bot I've ever seen.

    and all that to blame software makers in the end on faults done by norton on their broken threat detection engine.

    Never had any problem with Nod32 but unlike norton and mcafee it runs fast, on low cpu usage and catches every worm and virus and in 36 months I had a single false positive.
    norton needs 1h for that
     
  37. BS-er

    BS-er

    Joined:
    May 24, 2009
    Posts:
    115
    Aimed at any Unity devs: I know Norton sucks, but is there anything that the Unity folks can do? This will affect all of us who aim to sell software. I know we can each hassle Norton on our own, but we have to repeat that step every time we release? I will file a grievance with Norton, but I suspect it'll be like slamming my head on a brick wall.
     
  38. andeeeee

    andeeeee

    Joined:
    Jul 19, 2005
    Posts:
    8,768
    The QA team have been reminded of this as recently as today (possibly by you ;-) ). It's likely that the issue lies with Norton but Unity will, of course, keep looking at alternative ways around this problem.
     
  39. marinius

    marinius

    Joined:
    Apr 27, 2009
    Posts:
    81
    Norton and anti virus in general blows. Too many false positives now days.. Working on a support desk myself, you'd be amazed how often the root of a problem is due to antivirus updating and re-screwing something.

    Anything with .exe (such as unity.exe) is a high chance of giving a false positive. Unfortunately the only way I work now days is to just constantly add exceptions left right and center for stuff I know is fine. I use AVG and it seems to be reasonably OK. "Best of the worst" for me so far anyhow.
     
  40. caldepen

    caldepen

    Guest

    ignore above post! Norton is worse than the virus's and malware they pretend to guard against. On top of that they seek out and advertise themselves on forums such as this. Almost impossible to remove from your computer once installed. These guys are bad, bad.

    edit - the post has been removed.
     
    Last edited by a moderator: Dec 8, 2010
  41. AdamDived

    AdamDived

    Joined:
    Aug 8, 2010
    Posts:
    2
    If i can tell what i think, the problem remain unsolved because ammattila's post did not concern about what AV system was better than another... From the point of view of the developer, that's completely irrelevant.

    Any developer should think at FIRTS a series of questions: "What kind of system generally runs the PC of my potential customers? What kind of graphic card they do have? A good one? A S*** one? What about the memory amount? They have commercial AV or a free one? What the statistics tells me about it? Is Norton threating my game as a false positive? No? Yes? If Yes, this is something i can face or this is a MONSTROUS problem that will bring me to fill bankruptcy?" These are all kind of questions that every developer should put on scratch before starting any scripting skill.

    What happened to ammattila happen also to me. Before setting up custom icons, the game was running beautifully... after setting up custom icons, Norton just quarantinated my game without telling me nothing. So the problem is: if i sell or distribute my game in any way, i can use custom icons? The Norton AV installed in the PC of my potential user will threat my game as a false positive? Well, if you use custom icons, statistics for now says YES, it does. So, how i solve the problem? Avoid custom icons? I'll tell to my customer that they have to put my game in the trusted list? C'mon, no one would... first because the 90% of computer's users don't know anything about firewalls or any other advanced security setup. I say it for experience becuase i do home lessons for people who want to learn just how to create a new folder! They don't even know where the trusted list is located in the Norton setup! They just install things and claim a full working application without speding a single second to fix it. The application won't run? They blame you... as simple as it is...

    The general mindset is: "Norton is a HUGE company... who the hell are you? My Norton says your game has viruses and of course I TRUST Norton, not you... so give my money back moron!" This is what a customer told me just yesterday because of this problem.

    So, this is my point of view. How can we solve this? Not just speaking about it.

    p.s. I apologize for my unfairly grammar... i write from Italy.
     
  42. OutCyder

    OutCyder

    Joined:
    Mar 19, 2009
    Posts:
    2,176
    Well, I'd just contact Norton reporting this problem and hopefully it would be fixed in a week or so... I did this once with AVAST and the day after they fixed it.
     
unityunity