[Added] Norton Security - App-Request

[OLLI_S]

Name of the app:

• Norton Security

File Path:

• C:\Program Files\Norton Security\Engine\22.14.2.13\uistub.exe

Developer:

• Symantec Corporation

Website:

• https://norton.com/

Download Site:

• https://us.norton.com/downloads

App-Icon: in ICO format

Notes:

• Please check the URL and the Download-URL

• In the path there is a sub-folder with the version number, so it can be possible that there is the current version and an older version available at the same time!
  You have to think how to handle this because removal of the older version should be managed by the Norton Updater!

---

Here is the version information extracted from uistub.exe:

File name and path:     C:\Program Files\Norton Security\Engine\22.14.2.13\uistub.exe
Product Name:           Norton Protection Center
Internal Name:          uiStub
Original Filename:      uiStub.exe

File Description:       Norton Protection Center UI Stub
Company:                Symantec Corporation
Legal Copyright:        Copyright (c) 2018 Symantec Corporation. All rights reserved.
Legal Trademarks:       
Comments:               

File Version String:    22.14.2.13
File Version:           22.14.2.13
Product Version String: 22.14
Product Version:        22.14.0.0

[Tom]

How does this version information correspond with what is shown in the app itself?

And what makes you convinced that the uistub.exe is the right file to detect this app on?

[OLLI_S]

Thousands questions you have, thousands answers you will get...

How does this version information correspond with what is shown in the app itself?

This is a wise question and I answer them wisely.
You see the version number displayed in Help > About is equal to the version in the EXE.

---

And what makes you convinced that the uistub.exe is the right file to detect this app on?

This question is worth a master, congratulations!
The answer is simple:

• The Start Menu entry called Norton Security links to:
  "C:\Program Files\Norton Security\Engine\22.14.2.13\uistub.exe" /win8
• An other update manager also uses this file for detection

If you calculate now the probability (but don't forget the earth-radius) then this seems to be the right file.
Or do you have better arguments?

[Tom]

@olli_s Hehehe
No, I don't, except, that the naming of other files suggest that they are more significant than a "uistub", but that may just cheat the eye
I will rely on this and create a rule shortly, based on "uistub", it is never worse than I can change it again later, it is just more fun to get it right the first time.
Btw. perhaps you want to censor the "Seriennummer and "Endgeräte-ID".

[Tom]

@olli_s Rule added

[OLLI_S]

I will test tonight and also exchange the screen shot

[OLLI_S]

VulnDetect shows version 22.14.
In the App the version is 22.14.2.13.
So please display the version is 22.14.2.13.

[OLLI_S]

Version 22.14.2.13 is now displayed, issue solved