Norton Security Suite Deletes UCCNC.exe!

[epracefan@gmail.com]

I've been running my licensed copy of UCCNC on a WinXP/LinuxCNC dual boot box for a while with no problems. A few days ago I decided to get rid of Linux so reformatted the hard drive and reinstalled WinXP SP3 along with UCCNC and the 2017 screenset. Since this system is connected to the Internet, I also installed Norton Security Suite. I've used the system for a few days with no problems, including this morning when I did some testing.

As I was finishing up this morning, I noticed a notification that updates were available for download from Microsoft (130 of them), which I installed without error.

This afternoon, I fired the system up to do some work with the mill and my UCCNC shortcut gave an error that it could not find UCCNC.exe. I checked the folder and sure enough, it was not there so I reinstalled the application to the same default folder using the same setup program that was used less than a week ago.

Norton Security Suite reported that UCCNC.exe was infected with "Trojan.Gen.8!cloud" and deleted the file! I can't say for sure that Norton was running when UCCNC was installed the last time, but I think it was.

I have no idea what's going on but suspect it has something to do with the XP system updates that were installed this morning.

Has anyone else seen a similar problem and other than removing Norton, how do you suggest I get the program running again? If the file is safe, which I suspect it is, I could disable Norton and install UCCNC, but the first time Norton does a scan, it will probably delete the file again. Maybe a better security suite than Norton would work.

[cncdrive]

Hi,

It can be a false alert which is unfortunately possible with antivirus softwares because they looking for patterns in files which patters can happen even naturally without the file infected.
Or your computer got infected and a virus really infected the UCCNC.exe file. Viruses often target executable files to copy themselves, so they can make sure they can survive even if you delete them they can still run when you run your exe files.

It is sure that the UCCNC installer (as it downloads) and the files which it installs are not infected, because we do deployments in a safe environment in which infection of files is impossible,
because the deployment PC has no internet connection and even running other exe files than Visual Studio and some other development tools we using are disabled.

[cncdrive]

And it is also possible that your antivirus software thinks it is a torjan because the UCCNC making ethernet communication with sending data to ethernet sockets which may be suspicious for antivirus softwares.
It has to send ethernet packets even if you have a USB and not ethernet motion controller, because on the software startup it is looking for any possible ethernet controllers connected.

[CT63]

Avast antivirus started locking out uccnc.exe even after added it to the exclusion list as a false positive. I tried everything and finally uninstalled Avast.

[CT63]

As I was finishing up this morning, I noticed a notification that updates were available for download from Microsoft (130 of them), which I installed without error.

I thought MS stopped supporting XP including updates?

[epracefan@gmail.com]

As I was finishing up this morning, I noticed a notification that updates were available for download from Microsoft (130 of them), which I installed without error.

I thought MS stopped supporting XP including updates?

That's what I thought too, but I've done a few XP installs the past 6 months and they all received updates. I guess it gets brought up to the point where they stopped supporting the product.

[epracefan@gmail.com]

And it is also possible that your antivirus software thinks it is a torjan because the UCCNC making ethernet communication with sending data to ethernet sockets which may be suspicious for antivirus softwares.
It has to send ethernet packets even if you have a USB and not ethernet motion controller, because on the software startup it is looking for any possible ethernet controllers connected.

Thanks for the quick reply.

I'm convinced the file is not infected locally because Norton throws the error immediately on completion of program installation. Most likely it's a false positive (wouldn't be the first time for Norton). I think I'll disable virus protection and do the install again, then turn it back on and see if a scan deletes the file. If it does, I'll just remove Norton. If I understand, the system DOES have to be connected to the Internet; is that correct? If it is not required for UCCNC or UC300ETH, I'll just disconnect it.

Ed

[dezsoe]

If I understand, the system DOES have to be connected to the Internet; is that correct? If it is not required for UCCNC or UC300ETH, I'll just disconnect it.

No! There's no need to connect to the internet.

[beefy]

With XP the way I think it works is when you do a fresh install you can still download the updates up to the point where no more were developed. I don't think end of support means they removed the updates from their servers.

Coming from a Mach3 environment I like to keep a minimal Windows environment on my PC and treat it like a dedicated CNC controller. I remove any unnecessary Windows programs and even go as far as disabling various Windows services that would never be needed. One thing I would never have is any controlling background program like antivirus running. All my file transfers are done by USB stick. No internet connections.

Keith.

[A_Camera]

Norton Security is crap. It is just a resource hog and causes more trouble than it have benefits. You don't need any anti virus at all in that machine unless you visit pornographic sites and click on every crap you find on the internet. If you absolutely feel you need an anti virus you should use Microsoft Security Essentials.

But... why at all go to XP? Get a Windows 7 32-bit license if your PC is a weak old one, or even better, buy a better PC and use W10 and be happy with it.