Norton says OEM install is "malicious script"

Fieldmouse · 12-31-2005, 03:30 PM

I got an unopened, unused MS OEM product, MS Office Pro, with Key, that I was going to install on my computer. I put it in my "D" drive and the box came up to type in the Key, which I did. Immediately a box popped up from Norton saying it was malicious script from D:\autorun.vbs, and told me I should stop the install. I did. The Norton "Threat Alert" log says that it was "Suspicious script," which was blocked, and that the "Suspicious Action" was "Windows Script Host Shell Object: Exec" Now I don't know what to do. Was Norton just doing its job and it's a legitimate script to install MS Office? Should I turn off the Norton Script Blocking? How can I know if it is safe? The CD was unopened, is a "hologram" or whatever you call it CD, and they Key was the typical MS label on the back of the folder. What should I do? I do bookkeeping and I have to have this program. Thanks.

**POADB** · 12-31-2005, 04:53 PM

The Script is Safe, IMO.

Norton is just laying caution. A lot of malicious code can be writtin in Visual Basic. When I was at college, I once wrote a loop wrong in VB which resulted in crashing the computer when run. That in it's self can be considered a virus.

Create a System Restore Point and install the program.

Fieldmouse · 01-01-2006, 10:53 PM

Should I disable the script blocking in Norton or just tell it to let it install? Is it because it is an OEM version that this is happening? Is there any other way to check before trying to install this on my system? I'm a total ignance about this stuff so if it IS bad, I wouldn't have a clue what to do and I'm a bookkeeper and have to have my computer working! Any other suggestions? Thanks.

**jgvernonco** · 01-01-2006, 11:05 PM

As you have more experience with Norton, you will know the best way to use it is to uninstall it.

That being said, Norton will warn you of ALL scripts being installed on your computer, every time.

Your prog won't run right without the scripts, so there is no value in turning them off.

Let the program install. Norton will get used to it.

Fieldmouse · 01-02-2006, 01:31 PM

what I need to know is, is it possible that this IS a malicious CD? My brother told me that these guys can make a CD, shrink wrap it, etc., and make it look totally legitimate and it can be full of trojans, viruses, etc. Is there a way that I can check and make sure this CD isn't truly DOESN'T have malicious code or script on it before turning off my Norton Script Blocking and installing the file? How do I know the CD is safe to install? Also, my Norton is due to expire soon. Do you recommend another that is better? A Tech friend told me to use Trend Micro complete package. What do you recommend? Thanks, Sally

12-31-2005, 03:30 PM	#1 (permalink)
Fieldmouse Registered User Join Date: Nov 2005 Posts: 52 OS: WinXP	Norton says OEM install is "malicious script" I got an unopened, unused MS OEM product, MS Office Pro, with Key, that I was going to install on my computer. I put it in my "D" drive and the box came up to type in the Key, which I did. Immediately a box popped up from Norton saying it was malicious script from D:\autorun.vbs, and told me I should stop the install. I did. The Norton "Threat Alert" log says that it was "Suspicious script," which was blocked, and that the "Suspicious Action" was "Windows Script Host Shell Object: Exec" Now I don't know what to do. Was Norton just doing its job and it's a legitimate script to install MS Office? Should I turn off the Norton Script Blocking? How can I know if it is safe? The CD was unopened, is a "hologram" or whatever you call it CD, and they Key was the typical MS label on the back of the folder. What should I do? I do bookkeeping and I have to have this program. Thanks.

12-31-2005, 04:53 PM	#2 (permalink)
POADB Moderator, Microsoft Support Join Date: Jul 2004 Location: United Kingdom Posts: 6,482 OS: XP SP2	The Script is Safe, IMO. Norton is just laying caution. A lot of malicious code can be writtin in Visual Basic. When I was at college, I once wrote a loop wrong in VB which resulted in crashing the computer when run. That in it's self can be considered a virus. Create a System Restore Point and install the program. __________________

01-01-2006, 10:53 PM	#3 (permalink)
Fieldmouse Registered User Join Date: Nov 2005 Posts: 52 OS: WinXP	Ignore the "malicious code" warning? Should I disable the script blocking in Norton or just tell it to let it install? Is it because it is an OEM version that this is happening? Is there any other way to check before trying to install this on my system? I'm a total ignance about this stuff so if it IS bad, I wouldn't have a clue what to do and I'm a bookkeeper and have to have my computer working! Any other suggestions? Thanks.

01-01-2006, 11:05 PM	#4 (permalink)
jgvernonco Old Timer Join Date: Sep 2003 Location: Northern Arizona Posts: 7,958 OS: Vista Home Premium, SP 27	As you have more experience with Norton, you will know the best way to use it is to uninstall it. That being said, Norton will warn you of ALL scripts being installed on your computer, every time. Your prog won't run right without the scripts, so there is no value in turning them off. Let the program install. Norton will get used to it. __________________ Donations keep TSF moving forward. Please help. http://www.myspace.com/speedbumpthecelt

01-02-2006, 01:31 PM	#5 (permalink)
Fieldmouse Registered User Join Date: Nov 2005 Posts: 52 OS: WinXP	Don't know why my reply didn't post but what I need to know is, is it possible that this IS a malicious CD? My brother told me that these guys can make a CD, shrink wrap it, etc., and make it look totally legitimate and it can be full of trojans, viruses, etc. Is there a way that I can check and make sure this CD isn't truly DOESN'T have malicious code or script on it before turning off my Norton Script Blocking and installing the file? How do I know the CD is safe to install? Also, my Norton is due to expire soon. Do you recommend another that is better? A Tech friend told me to use Trend Micro complete package. What do you recommend? Thanks, Sally