The problem I had has been solved. See here.
This is the conversation I’ve just had, after I’d been getting a false alert.
Lakshmi: You are being transferred to Lakshmi.
Lakshmi: Welcome to Norton Support, my name is Lakshmikanth, Can I please have a minute to go through the information you have provided?
Lakshmi: Thank you for the time. Could you please elaborate the issue for me?
Mr. Timothy Barton : Norton is giving a false-hit Trojan for a registry entry. In “Exclusions” I can add folders, but I can’t work out how to add a registry entry.
Lakshmi: Thanks, your case number is 4953182**, please write this down.
Lakshmi: If we get disconnected for any reason, we’ll call you back within 30 minutes. Can I check that the phone number you have provided is the best number to call you on?
Mr. Timothy Barton : In the “risk details” it says “HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp PathsTO3000.exe”
Mr. Timothy Barton : Yes, sure.
Mr. Timothy Barton : The best number is 93 721 00**
Lakshmi: Okay. Thank you for the information.
Mr. Timothy Barton : +34 93 721 00**
Lakshmi: Could you please confirm me if you are getting any messages or pop ups showing Trojans or some thing like that?
Mr. Timothy Barton : Yes, I’m getting a Trojan alert.
Mr. Timothy Barton : I want to add an exception so I don’t get the alert.
Mr. Timothy Barton : Because it’s a false alert.
Mr. Timothy Barton : Is it possible to add a registry folder as an exception?
Lakshmi: Timothy, It seems that your computer is infected with Trojans. What I can do is I will transfer this chat to the Virus Removal Team who are trained in these issues. I am sure they will surely assist you in this Issue. Is this okay with you?
Mr. Timothy Barton : No, it’s not a Trojan.
Mr. Timothy Barton : It’s legitimate softwarte
Mr. Timothy Barton : Even when I reinstall the software, I still get the messages.
Mr. Timothy Barton : Please, all I want to know is how to add an exclusion for a registry entry.
Lakshmi: I wish I could have helped you better but the you can get better assistance regarding this.
Lakshmi: It will just take 2 to 3 minutes time to connect.
Mr. Timothy Barton : Is it possible to add a registry entry as an exclusion?
Lakshmi: You cannot add a registry entry in to the exclusion list.
Mr. Timothy Barton : In that case, I think I’ll have to switch to another anti-virus program, because there seems to be no way of stopping this false alert.
Lakshmi: I assure you that the Virus Removal team will help you in this issue.
Lakshmi: They will help you in all possible ways as I am not trained in these type of issues.
Mr. Timothy Barton : That”s a subscription service isn’t it? How much does it cost? If it turns out it’s not a virus (which I’m convinced it’s not), do I get the service for free?
Lakshmi: They will check that and inform you about that. They will only proceed after your confirmation only.
Mr. Timothy Barton : So they check it for free, and only charge me once I give confirmation? How much do they charge?
Lakshmi: Yes.If if requires money charge they will let you know before it self. I wish I could tell you but it depends on the issue.
Mr. Timothy Barton : OK, well I’ll let them have a look then.
Lakshmi: I am not sure of the charges.
Lakshmi: Okay.
Lakshmi: Can I put you on hold for 2 or 3 minutes while I update the records for you?
Mr. Timothy Barton : yes
Lakshmi: I am now transferring this chat to Virus removal team. Thank you for contacting Norton Support.
{ Your issue is being escalated. }
Binumon: Welcome to NortonLive Spyware & Virus Removal Service.
Is this the first time you are contacting us?
Mr. Timothy Barton : yes
Binumon: Are you connected from the computer which has this particular issue?
Mr. Timothy Barton : Yes
Mr. Timothy Barton : Started having the problem the other day. It was saying TO3000.exe was a Trojan. The same thing happened when I reinstalled it (and it is definitely legitimate software).
Binumon: Are you connected from the computer which has this particular issue?
Binumon: I am sorry.
Mr. Timothy Barton : I excluded the folder, but now it comes up with a registry entry. I don’t know how to exclude registry entries.
Mr. Timothy Barton : yes
Binumon: Timothy, dont worry. Let me try and see how we can work this out
Binumon: Is your computer on a network or it is a stand alone PC?
Mr. Timothy Barton : Connected to a Wi-Fi router, but it’s stand-alone.
Binumon: Please tell me which country you are connected from.
Mr. Timothy Barton : Spain
Binumon: Please confirm your email address is timtra****@gmail.com and direct phone number is +349372100**. Is that correct?
Mr. Timothy Barton : yes
Binumon: Please provide me your alternate phone number or mobile number.
Mr. Timothy Barton : +34 616 149 0**, but if my landline doesn’t work it means I’m not in, so I won’t be in front of my computer.
Binumon: Thank you for all the information.
Binumon: I understand that you were transferred to us from our technical support department to diagnose your computer for viruses. Am I correct?
Mr. Timothy Barton : I don’t have any viruses. I’m getting a false alert. All
I want to do is exclude the registry entry, so I don’t get the false alert.Binumon: Are you getting any alert messages like “Virus Alert”, “Your Computer is infected”, “Security Alert” etc?
Mr. Timothy Barton : It says it’s a Trojan Horse.
Mr. Timothy Barton : But I’ve been using the software for four years.
Binumon: Alright.
Binumon: Trojan horses are impostors—files that claim to be something desirable but, in fact, are malicious. A very important distinction between Trojan horse programs and true viruses is that they do not replicate themselves. Trojan horses contain malicious code that when triggered cause loss, or even theft, of data. For a Trojan horse to spread, you must invite these programs onto your computer. For example, by opening an email attachment or downloading and running a file from the Internet, you can activate a Trojan.
Binumon: Are you getting any alert messages like “Virus Alert”, “Your Computer is infected”, “Security Alert” etc?
Mr. Timothy Barton : As I said, I’m getting a Trojan Horse alert
Mr. Timothy Barton : “Trojan Horse has been detected”
Mr. Timothy Barton : I go to Details, and it says it’s the registry entry for TO3000.exe
Binumon: Timothy, please be aware that, once there is an infection on your computer, it will normally try to spread to other files on your hard drive and to other computers/devices connected to your system. Most of the times, it creates or manipulates entries and keys in your windows registry. For these cases we need to manually remove the registry entries and also remove the infected files.
Manipulating the registry is like brain surgery for your computer and is to be done with extreme care, since incorrect changes could mean that the computer’s functioning could be altered potentially unchangeably. It is recommended that only highly skilled individuals make these changes.
Mr. Timothy Barton : But all that the registry entry says is the file path.
Binumon: However you dont worry. We can help you now.
Binumon: If you wish, our expert consultants will do a complete diagnosis of your system, and troubleshoot any malware present on your computer. If required and if your system permits they can connect to your computer remotely and do all this for you directly.
Binumon: Our expert Technicians would provide you the best solutions possible based on their analysis of the threats on your computer. They would also provide you with information to avoid from getting infected in the future. They would advise you based on the specific configuration/settings of your computer and also answer your related concerns and queries.
Mr. Timothy Barton : The data in the registry entry says “C:Program FilesTranslation Office 3000 V8TO3000.exe”. That’s what Norton wants to delete.
Does that look harmful?Mr. Timothy Barton : Please, I just want to know how to stop this alert appearing.
Mr. Timothy Barton : How much do they charge for the diagnosis? What if they don’t find anything wrong?
Binumon: Okay. Our technician will diagnose your computer and will fix the issue for you now.
Binumon: Before we proceed, I would like to inform you that this is a paid consultation service.
Binumon: The Consultation fee for this service would be €99.99.
Binumon: We guarantee to identify any threats that may be on your system. Once we have found them, we will remove them. In addition we guarantee our work for a period of 7 days from the day / time the issue is resolved should you experience any reoccurrence.
Mr. Timothy Barton : This is ridiculous. It’s clearly a false hit. I’m blatantly not going to pay €99.99. What I’d like to know is how to exclude a registry entry, the same way as I excluded a folder.
Mr. Timothy Barton : If you can’t tell me how to do this then I will not be renewing my subscription and will look for a new antivirus solution.
Mr. Timothy Barton : I’m not asking you to do anything to my computer. I just want to know how to do something in the program.
Binumon: Virus and Spyware Solutions is a value added service provided by Norton. Highly trained technicians spend time diagnosing and correcting the problem. As with most highly specialized support, there is a fee involved.
Mr. Timothy Barton : If by removing the software I stop getting any alerts, doesn’t that prove that this is not infecting other parts of my computer? And if by reinstalling legitimate software I still get the alert…
Mr. Timothy Barton : … it means the problem is with the virus definitions in Norton.
Binumon: Norton is protecting you from tens of thousands of existing malwares and from the hundreds of new threats released every single day. It provides among the best security that is available for your computer.
This particular infection could have been caused while subscribing or downloading from free websites or when you download/transfer files such as movies, songs, screensavers, games, etc. from other computers, such as in a P2P system, or from insecure websites.
Normally when you download something, it will ask for your permission to open/install, and accept the license agreement.
When you do so, being the administrator/final authority of the computer you are potentially authorizing an override of the security restrictions in place.
Mr. Timothy Barton : I DON’T HAVE A VIRUS. IT’S A FALSE ALERT!
Mr. Timothy Barton : I JUST WANT TO KNOW HOW TO DE-ACTIVATE AN ALERT. I CAN’T BELIEVE NOBODY IS WILLING TO TELL ME HOW TO DE-ACTIVATE AN ALERT.
Binumon: Timothy, you have the traces of the Trojan remains in your computer. Thats why you are getting the alert.
Binumon: So we need to fix it from your computer manually.
Mr. Timothy Barton : Have you accessed my computer?
Mr. Timothy Barton : Shouldn’t the software I bought get rid of it?
Binumon: Please be aware that, once there is an infection on your computer, it will normally try to spread to other files on your hard drive and to other computers/devices connected to your system. Most of the times, it creates or manipulates entries and keys in your windows registry. For these cases we need to manually remove the registry entries and also remove the infected files.
Manipulating the registry is like brain surgery for your computer and is to be done with extreme care, since incorrect changes could mean that the computer’s functioning could be altered potentially unchangeably. It is recommended that only highly skilled individuals make these changes.
Mr. Timothy Barton : You’ve sent me this already
Mr. Timothy Barton : Norton is telling me which registry entry is infected. I can see that it is not.
Mr. Timothy Barton : Please, just say how to exclude a registry entry. If after that my computer gets spoilt, I’ll take full responsibility.
Mr. Timothy Barton : If you can tell me, I’ll renew my subscription. If not, I’ll look for different software.
Binumon: Timothy, the registry editing work can be done only with the help of our technicians. I am not trained to do those type of works.
Mr. Timothy Barton : I don’t want to edit the registry; I want to stop a registry folder from being scanned.
Binumon: Timothy, If you chose to proceed with this Consultation, our expert Technicians will troubleshoot the malware on your computer without any potential loss of personal files or undue risk to your Operating System.
Binumon: So shall we proceed with the consultation and let one of our expert’s diagnose and remove any threat identified to make your computer safe and secured at the earliest?
Mr. Timothy Barton : Do they do the diagnosis free of charge, then charge me for anything they do, or is there a charge even for the diagnosis?
Binumon: Timothy, The technicians do a complete diagnosis of your computer, and if there are malware/threats then they remove them. If required and if your system permits, they connect to your computer remotely, and do all this for you directly. They ensure that any malwares/threats present on the computer are removed.
Please note that due to the nature of viruses/malware, sometimes it requires more than one attempt to remove them, and you might have to contact us again. Should you need to contact any other support teams; the technician will guide you appropriately.
If in the rare circumstance where we are not able to remove the malware present on your computer, despite our best endeavors/efforts, we will transfer your case to our research team, who would provide you with the refund, if necessary.
Mr. Timothy Barton : That doesn’t answer my question…
Mr. Timothy Barton : I take it you’re saying there’s nothing else you can do without me paying. If that’s the case, then I’m afraid it’s goodbye Norton. I don’t have virus or a Trojan horse, and the only annoyance is the false alert.
Binumon: Timothy, we can start the trouble shooting process, only after we complete the transaction.
Mr. Timothy Barton : The only way to get rid of this false alert is to find a new Anti-virus program.
Mr. Timothy Barton : So goodbye Norton.
Binumon: Is there anything else I can help you with?
Mr. Timothy Barton : A shame, as I’ve been pleased with the service I’ve had over the past few years.
Mr. Timothy Barton : no thanks
Binumon: If you need to contact NortonLive Spyware & Virus Removal Service again please visit http://www.symantec.com/vremoval
It has been pleasure assisting you. Thank you for choosing NortonLive. Have a great day.
Hi Tim
I work for Symantec and have spotted your blog. I’d really like to have a customer service agent get in touch and see if we can help you resolve your “false positive” alert. If you could drop me a line with your email address and phone number I’ll try and get this sorted ASAP. Sorry we haven’t been able to assist you to date.
Thanks
Emma
I understand your frustration. The submission site for a false positive is (link is no longer accessible)
In your case use the “additional details” section to describe the problem related to the registry entry.
Matt Phillips
OMG! I’ve had similar problems with the incompetence of symantec employees. I finally dropped my service and now i have avast antivirus free edition. Works great and it doesn’t slow down my computer like the norton software did.