Hi all.

For the past few weeks, I keep getting a security alert from Norton Internet Security 2005 every time I run Skype latest version.

The alert says "Norton Internet Worm Protection has detected a remote system that is attempting to access Skype.exe on your computer."

For the life of me, I cannot figure out how to permanently allow this for Skype. Can't find anything in help for Norton, either in the program or on their website.

It must be a Norton issue, not a Skype one. I think.

But before I try and get some help from their support, I wondered if anyone here has had this issue and, if so, how you fixed it.

Thanks.

Yes, read below:

OK here it is....a fair bit to read but it answered my question i raised...with regards to the IP address it is now always a different address connecting.

Hi,

I'm looking into the report that you posted on forum.skype.net concerning the alarming being raised by your copy of NAV anti-virus software.

To understand the situtation better, can you tell me whether your machine was located behind a firewall or network address trnaslation (NAT) device of any kind when the alerting occurred?

Feel free to either reply to me via "PM" on this board or by e-mailing directly to my Skype mailing address, as indicated at the bottom of this message.

Thanks,

Kurt Sauer
Director of Security Operations
Skype Technologies S.A.
kurt@skype.net


My response was "I have Norton AV 2005 and ZoneAlarm Pro...using windows XP Home Edt with SP2."


I then recieved the following:

Hi, yes I understand the software configuration. However, another factor for us to consider is whether you are behind a network address translation (NAT) device of some kind.

Is the computer experiencing this problem located behind a NAT, such as a physical firewall box or a wireless router?

If you're not certain how to check for this, I'd be happy to provide you with steps that will help you tell. Please let me know.

Meanwhile, we are in touch with several AV vendors to help ensure that our legitimate communications are not being misidentified as illicit activity, which is the type of misidentification that appears to be happening in your case.


My response was "i am not behind a physical firewall or wireless router."

OK - it appears that the situation that caused the alarm by your AV product is due to the normal functioning of Skype. Part of what makes Skype work is that each member can help users communicate by occasionally carrying a small amount of traffic between pairs of users who are behind NAT boxes.

So, let's say users A and B want to send IM's between themselves. If both A and B are behind a NAT or a restrictive firewall, then A can't directly connect to B and B can't directly connect to A. So what happens is that the directory services select a few nearly users who can pass just a small portion of the message traffic between A and B. These hosts are (like you) not behind a NAT or a restrictive firewall.

In this case, A connects to you and B connects to you, just briefly, to exchange messages. These hosts then disconnect and spread the load across a number of computers.

In your case it appears that the port that Skype used happened to also have been used at some point in the past by a worm. As a result, we're now in contact with some AV vendors to help them understand why these connections should not be alerted as a potential worm.

We apologize for this and are now in the process of helping the AV vendor develop a solution or workaround.

I hope that helps, at least insofar as the problem description is concerned.

Best regards,

Kurt Sauer



I hope this helps out all the people experiencing this issue..

Hey as6670!
Good work. Great post. Very informative.

it would be nice for the right person to recive the credit for that post

http://forum.skype.com/viewtopic.php?t=13463

(This post has been corrected, thanks for your pointer as6670!

Thanks,

Bill

Gladiator, many thanks for that explanation!

Gladiator, many thanks for that explanation!

Pleasure. Happy SKYPING

Hi all.

For the past few weeks, I keep getting a security alert from Norton Internet Security 2005 every time I run Skype latest version.

The alert says \"Norton Internet Worm Protection has detected a remote system that is attempting to access Skype.exe on your computer.\"

For the life of me, I cannot figure out how to permanently allow this for Skype. Can't find anything in help for Norton, either in the program or on their website.

It must be a Norton issue, not a Skype one. I think.

But before I try and get some help from their support, I wondered if anyone here has had this issue and, if so, how you fixed it.

Thanks.

Are you still haveing this problem, if so do the following to resolve the problem.

1. Open Norton/options/internet worm protection/program control.

2. Find Skype click on it then click remove

3. then click OK

4. return Norton to its normal state before you did these alterations.

You will find that you get the worm warning again this time click on permit then OK and you will not have the problem again.

You will have to do this every time you update skype or remove the program and re install it.

Hope this helps let me know.

Hey GLADIATOR!

Good work. Great post. Very informative

Thanks,

Bill

it would be nice for the right person to recive the credit for that post

http://forum.skype.com/viewtopic.php?t=13463

Hey GLADIATOR!

Good work. Great post. Very informative

Thanks,

Bill

it would be nice for the right person to recive the credit for that post
http://forum.skype.com/viewtopic.php?t=13463

Since I left the names of the original posters, I never bothered to add/credit anyone. In other posts I always mention/credit who originally posted the patch ect.

Hey as6670!

I corrected my post above.

Thank you for pointing that out. I didn't see your name mentioned in the text G had posted.

Regards,

Bill

rocketman, many thanks indeed for this solution.

It works perfectly!

I know some other Skype users who also have Norton Antivirus 2005 with this same problem. They will also be delighted to learn of this solution!

Thanks again.

Just a quick update on the worm warning from Norton AV.

From: kurt
To: as6670
Posted: Mon Mar 07, 2005 9:17 am
Subject: Re: Posting about "worm warning" - Skype
as6670 wrote:
Thanks Kurt....that seems to have answered my problem.....i will go ahead and allow skype permission through my AV software.

Will it be ok with you if i posted your reply on the forum?


Hi there -

Boy, I'm sorry about missing your e-mail to me via this forum. Somehow I marked it as "read" even though I hadn't read it. In cleaning up my mailbox I saw it here, unread.

I think that the response got posted, which is fine. I did want to let you know that Symantec formally responded to the issue with a fix in their software.

Again, apologies for not responding to your most recent e-mail.

Kurt Sauer

Hopefully no more warnings from Norton AV now that symantec have fixed this issue in their software.

as6670:D

Thanks the update. Appreciated and used to help a lot of people. Once again thanks

Just wanted to say that I am so glad this forum exists. I have been having the same problem with Norton for weeks and it has been driving me insane. I have found other solutions to different problems simply by googling my query and hitting this forum -- where I inevitably find the answer I was looking for. Thank god I don't have to look at that damn norton alarm all the time anymore!!! Thanks a million!

Gretchen

Thaks very much rocketman for the information!!

Hi, GLADIATOR,

My machine is behind the firewall/NAT/Router. I am getting Norton alert such as the connection from:
Direction: Inbound
Local Address: All local network adaptors
Local Port 45280
Remote Address: 172.145..172.58
Remote Port: aol (5190)
Protocl: UDP

Is this normal? Should I permit it or block it?

Thanks a lot

Action

Hi, GLADIATOR,

My machine is behind the firewall/NAT/Router. I am getting Norton alert such as the connection from:
Direction: Inbound
Local Address: All local network adaptors
Local Port 45280
Remote Address: 172.145..172.58
Remote Port: aol (5190)
Protocl: UDP

Is this normal? Should I permit it or block it?

Thanks a lot

Action

Pretty sure its ok to permit. But the decision is yours

Pretty sure its ok to permit. But the decision is yours

I'm now reading this thread because after a reboot yesterday I am now plagued with continuous prompts from NAV to "permit" Skype inbound traffic and it's now many months since this was first reported. Odd, but until yesterday I never had this problem.

I have a wirelss router on a high-speed cable connection. No NAT but i do use McAfee firewall but it's NAV that's complaining.

What to do? If I block this, will my Skype out be affected?

I'm now reading this thread because after a reboot yesterday I am now plagued with continuous prompts from NAV to "permit" Skype inbound traffic and it's now many months since this was first reported. Odd, but until yesterday I never had this problem.

I have a wirelss router on a high-speed cable connection. No NAT but i do use McAfee firewall but it's NAV that's complaining.

What to do? If I block this, will my Skype out be affected?

I can assure you its OK to accept SKYPE.

I can assure you its OK to accept SKYPE.

Yes, I do understand that. But, it's most annoying. This morning I had six accept/block windows pop-up and they pop-up throughout the day.

I've taken Skype offline for now. Don't know what else to do. Maybe a new version that will provide some options?

_bob

Yes, I do understand that. But, it's most annoying. This morning I had six accept/block windows pop-up and they pop-up throughout the day.

I've taken Skype offline for now. Don't know what else to do. Maybe a new version that will provide some options?

_bob

Please follow instructions in this post.