Stefano Reporter
	Description • 7 years ago

What feature should be changed? Please provide the URL of the feature if possible.
==================================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\""
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\""

What problems would this solve?
===============================
Norton Power Eraser detects these 2 registry keys as dangerous and corrects them apparently without any problem, but these registry keys are set up again at each update. I don't have this problem with 32-bit Firefox.

Who would use this?
===================
Don't know, maybe it is a false positive...

What would users see?
=====================
Nothing.

What would users do? What would happen as a result?
===================================================
If I "correct" them with NPE nothing happen.

Is there anything else we should know?
======================================
It started from the 1st release of Firefox x64, and it's strange that Norton team hasn't corrected it yet, if is a false positive...

	Stefano Reporter
	Comment 1 • 7 years ago

Note that this annoying problem affect only Firefox x64 (on Windows, and until now each 64-bit Firefox release), and the problem does NOT exist in 32-bit versions of Firefox (alwais on Win10 64-bit OS).
I reported this to falsepositives@symantec.com but they reply that mine was an "Invalid submission", "Because Power Eraser analysis is aggressive". Ok, I already known that, but it is still very annoying.

	Stefano Reporter
	Comment 2 • 7 years ago
hide hide-this

*always

	Stefano Reporter
	Comment 3 • 7 years ago
hide hide-this

Me again, I'm so sorry, but I cannot find the way to edit my comments, so a Moderator can censore the e-mail address I just posted by replacing "@" with "[at]" or something else to prevent spambots, and delete this message? Thanks and sorry again!

	Marco Castelluccio [:marco]
	Comment 4 • 7 years ago

Stefano, can you check what is the value of those two keys in the registry?

	Stefano Reporter
	Comment 5 • 7 years ago

You're lucky, just today came the update 58.0.2 (x64) that restored the two regkey deleted by NPE.
They're both REG_SZ with these values:
"C:\Program Files\Mozilla Firefox\firefox.exe"
"C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
And yes, Norton Power Eraser still detect them as dangerous ("Pericoloso" it says, in Italian).
P.S.: are you able to edit my previous posts as I asked?

	Stefano Reporter
	Comment 6 • 7 years ago

Also, now, after the (bad) correction, NPE set those keys to identical values but with the path "Program Files (x86)" instead of "Program Files" (the correct one, considering the 64-bit version of Firefox in use), a path that doesn't exist anymore after the Firefox upgrade from x86 to x64!

	Marco Castelluccio [:marco]
	Comment 7 • 7 years ago

(In reply to Stefano from comment #5)
> You're lucky, just today came the update 58.0.2 (x64) that restored the two
> regkey deleted by NPE.
> They're both REG_SZ with these values:
> "C:\Program Files\Mozilla Firefox\firefox.exe"
> "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
> And yes, Norton Power Eraser still detect them as dangerous ("Pericoloso" it
> says, in Italian).

Is your default browser still Firefox after Norton Power Eraser "corrects" those "pericolose" keys?

> P.S.: are you able to edit my previous posts as I asked?

Unfortunately not, we can only hide them. Don't worry about the email address, it's public anyway.

(In reply to Stefano from comment #6)
> Also, now, after the (bad) correction, NPE set those keys to identical
> values but with the path "Program Files (x86)" instead of "Program Files"
> (the correct one, considering the 64-bit version of Firefox in use), a path
> that doesn't exist anymore after the Firefox upgrade from x86 to x64!

Have you double-checked if "C:\Program Files\Mozilla Firefox" and "C:\Program Files (x86)\Mozilla Firefox" exist?
IIRC for some people we still used the (x86) directory even after the upgrade to x64.

	Stefano Reporter
	Comment 8 • 7 years ago

(In reply to Marco Castelluccio [:marco] from comment #7)
> Is your default browser still Firefox after Norton Power Eraser "corrects"
> those "pericolose" keys?
Yes, but if I type "firefox" or "firefox.exe" on CMD, it return that Firefox is not recognized as a program...

> Have you double-checked if "C:\Program Files\Mozilla Firefox" and
> "C:\Program Files (x86)\Mozilla Firefox" exist?
> IIRC for some people we still used the (x86) directory even after the
> upgrade to x64.
The x86 dir does NOT exist anymore, perhaps because - but I don't remember well - I did a new installation of Firefox x64 after uninstalling (maybe deleting personal data) the x86 version... Probably this could be the problem, the use, in some cases as you said, of "Program Files (x86)" directory for the 64-bit edition, confusing Norton cloud-based engine.

	Marco Castelluccio [:marco]
	Comment 9 • 7 years ago

Thanks for all the info, Stefano. I've contacted Symantec about this.

	Marco Castelluccio [:marco]
	Comment 10 • 6 years ago

Symantec found the root cause and will update Norton Power Eraser to fix the issue.