Saturday, June 23, 2012

Running Afoul of Norton

We just received this email from a reader in Norway:

I add a screen shot of what happens when I try to access your web page. It claims your web page has been known to be fraudulent and does not want me accessing it.

I am a regular reader and have had this program running on my computer for 6 months, this is the first time it has tried to stop me from viewing your webpage.

Can you tell me if you have been hacked, or the page has suffered from a virus? Or is this another attempt at trying to stop people from hearing the other side?

Its really making me a bit paranoid now, but I am wanting to know what this is all about.

I will be hesitant to access your webpage again for the reason that I really don’t wish to have viruses on my computer. Could you tell me if there actually has been a breech of security?

So I asked friends in the USA, Canada, and Denmark to try loading Gates of Vienna. They had no problems.

Then, as soon as I sent off a reply to the Norwegian reader, I received another email, presumably from the United States:

Got this warning when I tried to log onto your site a few minutes ago. I regularly check your site and never got something like this, though I’ve had Norton on my computer for years.

Below are screen shots from the computers in Norway and the USA, respectively:

Norton blocking GoV

I have no idea what is causing this. I asked several people to test it, and some of them use Norton — I even have Norton on one of my machines — and nobody had any problem loading our blog.

I just checked our site meter, and traffic seems to be running normally for a Saturday evening. We are currently entertaining visitors from the USA, Canada, the UK, Australia, Sweden, Brazil, Japan, and other more exotic locales. Business as usual.

If anyone has any ideas about what may have caused these bizarre anomalies, please leave a message in the comments.


Anonymous said...

I'm guessing IP switch. Your site has assumed the IP of a site that was formerly a hack site, and Norton doesn't know the IP is now safe.

Dymphna said...

don't know if it's connected, but both emails came via gmail. Doubt it's relevant though.

Gort said...

No problem here and I use gmail. Why the pop and smtp server I use for mail should have anything to do with where I point my browser is a mystery to me anyway.

You have heard of being "swatted", haven't you?


Anonymous said...

could it just be that norton is pish?

Anonymous said...

An incident of this kind was recently reported at Swedish immigration- and Islam critique website Avpixlat; see Nytt censurangrepp mot Avpixlat.

Did not follow discussion closely but seems Norton keeps a blacklist that gets updated according to user reports .... (Lessening money to waste on fools who now are getting desperate.)

Greetings from Germany!

bewick said...

Here in the UK I use Norton Internet Security 2012, Windows 7, and my browser is firefox.Don't use gmail but I'd seriously doubt if the email provider is of consequence Dymphna.

Never suffered such a message with GoV but have seen it once when accessing a trusted newspaper site.

As I remember I just ran both a Norton scan and an Advanced System Care scan; rebooted and everything fine again. Always a good strategy since trying to pin down a cause is usually much more time consuming than running regular scans. Sometimes just a re-boot fixes many problems. (hope I'm not teaching grandma to suck eggs)

I would highly recommend the FREE version of Advanced System Care by Iobit ( I happen to use the even better paid for version). Clears out loads of rubbish and helps prevent "spikes". Has much reduced calls from friends and neighbours to sort their machines.

My best guess? Some remnant of something was left on your machine, and likely in the registry, and this caused a conflict which confused the otherwise excellent Norton. Hope that helps.

Bob the Ape said...

I observed this also last night (eastern United States). A number of right-of-center political blogs were being blocked by Norton when I tried to access them. This did not happen on my wife's computer, which uses another protection package. Nonpolitical blogs did not seem to be affected.

The phenomenon is no longer occurring.

If, as Anonymous of 5:14am says, Norton relies in part on a user-reported blacklist, it's plausible to suppose that this was an attempt at SWATting.

bewick said...

Reducing calls? Actually since I got them to install and use Advanced System Care I have had almost no calls for help. My source of free bottles of Scotch has totally disasppeared. How I hate Iobit for such a competent program.

Anonymous said...

An interesting suggestion, Bob. It wouldn't surprise me, as cyber-attacks against other sites such as PI are frequent. As GoV reaches more notoriety, I'm certain alternative attack methods will be a growing trend as no known botnet can simply shut google down with a traditional DDoS.

wildiris said...

I've been getting the same blocking screen from Norton since yesterday when I try and log into my own blog on blogspot. It's devoted to homebrew robotics, so there is nothing political about it. Here at the house I have computers running XP and one running Windows 7. They are all running the same copy of Norton. But the one thing I noted is that the blocking screen only comes up on the Windows 7 machine.

wildiris said...

I've been getting the same blocking screen from Norton since yesterday when I try and log into my own blog account on Blogspot. It's devoted to homebrew robotics, so there is nothing political about it. I have several Windows XP machines and one Windows 7 machine. They all run the same copy of Norton, but only the Windows 7 machine gives me the blocking screen.

Anonymous said...

No problem with Norton 360,from Northern-Norway..

Arne said...

No problem with accessing GoV with Norton 360 from Northern-Norway..

You New said...

Change browsers.

Anonymous said...

The same thing happend to Swedish site about a week ago. Reports had it that not only Norton, but also Trend Micro was blocking the site. The next day, the matter was rectified and a spokesperson for Norton contacted and apologized for the incident. In case you don't know the site (though you've posted from it here on GoV), Avpixlat is the site that took over after is one of the top 50 sites in Sweden so I guess maybe it's a bigger deal to block it than some other sites.

I've also seen a couple of other Non-PC sites (E.g Vdare) reporting being blocked by Norton in the last week. Coincidence that large does not exist.

/Jacob (a sometime donor to GoV)

Anonymous said...

Hello, I have norton via comcast and on Friday I went to Give us Liberty 1776.. and got the fraudulent message so I seached "giveusliberty1776" on the net looking for info, nothing on the reason why but the other search results included G.of V... Anti
Mullah..ZionsCry...Tea release your records...Obama ballod challenge...puzo 1 blog...all returned the fraudulent message 2 other web sites I am not 100% sure returned the fraud message are patriot wordpress. my search (xfinity/google) returned only 10 pages you can search for yourself and see the differnt sites and the stories associated. Amazingly! all fraud messages were on sites who's topics were about obama. Shocked,Shocked I say I was! No not really I saw it as deeply desperate, and that made me feel deeply Happy! I've been waiting for someone to report on this and your the first.

Never Surrender!

You New said...

This thread at Free Republic is from way back in 2005. Seems the problem existed way back then.

Anonymous said...

Iobit uses stolen software (Chinese company). I highly recommend you dont use their products (no matter how good they might be).

Dont support their profit on stolen goods. They are untrustworthy and who knows what information they are stealing from you, given the chance.


You New said...

Here is the correct link to replace the bad link I just gave:

It seems that Norton played this game back in 2005 and is giving it another go.

Early Light said...

It's a glitch in the software. Apply all the updates, and it will go away. See discussion on Norton forum.