• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Kudos1

What is WS.Reputation.1?


UPDATE FROM SYMANTEC last edited by Tony Weiss on June 02, 2010


Since this has become a lengthy thread, we've updated this first post to provide useful information to new forum members. While we work hard to gather info about as many files and configurations as possible, there are occasionally situations where we may encounter programs that get identified as WS.Reputation.1. We apologize for the inconvenience, and would like your help in improving the service and preventing any re-occurrence.

In the event that a file has been wrongly identified as WS.Reputation.1, please submit it here for review. For a workaround on this issue, please follow the directions in this post. I would also recommend that you review this post for information on why some of your files may be identified as WS.Reputation.1.


I am continually getting a warning that every .rar file has this in it.  This file (Ws.Reputation.1) is quarantined every time I right-click on a .rar file and choose to analyze it with Insight Network Scan.

However, when I run a full system scan, Norton detects only cookies.

It doesn't seem to pick up on the "infected" .rar files unless I right-click on them, and choose Insight Network Scan.

I have Norton Antivirus 2010. Please let me know what this is and how to get it to stop showing up on every .rar file that I have downloaded!

Replies

Kudos0

Re: What is WS.Reputation.1?

The .rar files are not quarantined unless I right-click on them and choose "Insight Network Scan."

When the scan is completed, I am told I had a "WS.Reputation.1," which has been quarantined, thereby deleting the .rar file in question.

Happens with ever .rar file I download to the desktop. Also scanned a few .rar files that were in the recycling bin, and for some reason, those get quarintined too.

However, the .rar files I have stored in a folder on my desktop do not show up as having the ""WS.Reputation.1."

So basically, all recently downloaded .rar files are quarantined if I right-click on them and choose to do a virus scan.

It may also be important to note that it's giving me a warning that "fewer than 10 users in the norton community have used this file" for each .rar.

I've tested this on at least 10-15 .rar files from assorted sources, and the assertion that "fewer than 10 users have used them" just does not seem accurate to me.....

The .rars I am using are custom content for a computer game I have, if that is useful. I have downloaded tons of them in the past successfully, and now suddenly Norton wants to quarantine them if I scan them.

Kudos0

Re: What is WS.Reputation.1?

I think there is a problem right now regarding this which affects both 2010 and 2011-beta versions.

You could search the Community for it . You can do nothing right now except from not clicking on these files to perform Insight Network (Cloud) scan

Kudos0

Re: What is WS.Reputation.1?

I'm running Norton Internet Security V 17.6.0.32 and I'm getting the same crap as above only

It's not just .rar files but ANY files I download and right-click to check with Insight Network Scan

-even a few .Jpg images I pulled off of a few random websites.

Kudos0

Re: What is WS.Reputation.1?

Hi,
I have the same problem not with rar files only but with every file that my IE8 generates! No matter whether it's a download or when I save a HTML page. I did some easy tests on it.

Just right click on the desktop,

select new file

and select new text file.

Rename the extension from txt to htm.

Just to make sure the file is clean, let Norton scan it. It should be OK.

Open that empty file with IE8 and save it as plain html or mht file.

Let Norton scan it and it will complain about that virus and removes the file.

Open the file with notepad and you will find nothing than a regular html header. So if this virus is really there it must be in an alternate data stream hidden behind the visible part of the file (goes for NTFS file system).

Now do the same with another web browser (I used Google Chrome). Voila, nothing to complain here. The same goes for almost any download (msi and exe files are not infected by IE8 which occurs pretty strange to me).

Regards

Cyron

EDIT: I just  let virustotal.com scan such a test file and it couldn't find anything suspicious.

Kudos0

Re: What is WS.Reputation.1?

yeah, i just starting have the same PROBLEM!!!

when i right click a folder of file it detect nothing, when i run full system scan it detect nothing but when i right click a file to scan, it said it have this virus and delete it!!!??

what happeing????

Kudos3

Re: What is WS.Reputation.1?

Thanks for letting us know. The engineering team is looking into this issue.

--Jesse GoughPrincipal Engineer, Security Technology and ResponseSymantec
Kudos0

Re: What is WS.Reputation.1?

Morning;

Having the same problem - a file from a trusted site is giving me a positive for WS.Reputation.1.  I'm figuring that it's just a bug, but I'd like to know for certain. 

-Adam

Kudos1

Re: What is WS.Reputation.1?

A poster in the Norton German forum is having the same problem. I have directed him/her to this thread over here and to jesse_gough's post :-)

Kudos0

Re: What is WS.Reputation.1?

I am having the same problem - files that I believe to be clean (and from trusted sources) get tagged as "WS.Reputation.1" when I right click on them for a scan before opening.  So far, this has happened with WMV and Excel files.  I can perform a full system scan though and encounter no problems.  This has only started happening recently.  Please advise...

Thanks!

Kudos0

Re: What is WS.Reputation.1?

Same problem here - usually when I do a InsightNetzwerk-Scan of .avi, .srt and .rar files.

Kudos0

Re: What is WS.Reputation.1?

Additional info:

This began yesterday 5/6/10 around 10:00 pm CST.

I have Internet Explorer, I think version 6 or 7.

I uploaded a .rar file that Norton analyzed as infected to VirusTotal, and it detected nothing.

It seems unlikely given the evidence, but could this be an actual virus that is affecting only certain types of files?

Or is it that Norton is incorrectly identifying these files as being "infected"?

That's what I would really like to know!

If this is a virus/threat, I would really like to know what kind. All the Insight Network scan tells me is that it is an "infected file".

So, what kind?  Spyware, malware, virus, worm.....?

And if that were the case, why is it that I can extract and use the "infected" .rar files without any issues? They go straight to my game as they always did, and the game runs normally.

Plus, full system scan never catches or quarantines the .rar files, only the Insight Network scan does.

Does anyone believe this could be an actual virus and/or threat?

Kudos0

Re: What is WS.Reputation.1?

I have noticed the same problem.  Downloads of compressed files from legitimate sources are identified as being infected with WS.Reputation.1 and subsequently deleted.  I typically use "download statusbar" add-on in FireFox 3.6 and have this configured to automatically scan all downloads with NAV17.6.0.32\navw32.exe. As soon as the download is completed, NAV scans the compressed file,  identifies it as infected and deletes the file.  The problem seemed to arise with a program update from 5/5/2010 or 5/6/2010.

My systems are running Windows 7 Ultimate 64-bit using NIS2010 for AV protection.  Other malware programs (Iobit 360, PC Tools Spyware Doctor/Threatfire, VirusTotal) do not identify any type of risk in the same files.

Kudos0

Re: What is WS.Reputation.1?

This would be a very helpful problem to resolve.  I have the same problem only when I initiate the scan and receive the WS.Reputation.1 message and immediately quarantines the files and .RAR bundles.  Retrospectively, I have scanned files that I created and other files that were previously scanned with no issues and are now quarantined.

Please advise.

Kudos0

Re: What is WS.Reputation.1?

I have the same problem with any download from both Firefox and IE8.  Also, I tested it by scanning previously downloaded files.  These files were scanned at the time of the original download and the scan at that time showed no problems.  If I scan them now they are treated as infected with WS.Reputation1 and quarantined.

Kudos0

Re: What is WS.Reputation.1?

As I ave stated in my first post on page 1 this only happens when I use Internet Explorer but not with Google Chrome. So my advice is: try another web browser and let IE alone until this issue is solved by Symantec.

Kudos0

Re: What is WS.Reputation.1?

Well in my case this only happens with .rar files that were downloaded on 5/7 and 5/6.

It appears that .rar files from before these dates come up with a clean slate when Norton individually analyzes them.

Kudos0

Re: What is WS.Reputation.1?

Same problem here.

Just out of curiosity, how many of you have "scan compressed files" as "on" in your settings? Maybe why it picks it up when you do a custom, right-click scan, and not when you do the full scan. I haven't, however, tested this myself.

*edited out spelling error

"The fact that man knows right from wrong proves his intellectual superiority to other creatures; but the fact that he can do wrong proves his moral inferiority to any creature that cannot."- Mark Twain
Kudos0

Re: What is WS.Reputation.1?

Noticed this problem this morning. Any *.zip files downloaded with Firefox 3.6.3 are auto scanned with download statusbar and deleted by Insight.

I'll leave them quarantined until I get a definitive response from the Norton engineers.

Kudos0

Re: What is WS.Reputation.1?

Hi - We've been looking at this issue since it was reported yesterday. Here's what we've found.


The right-click option has an issue where it tries to determine the reputation of downloaded *non-executable* files. This issue is limited only to the right click scan, and only when the file was downloaded.


We are currently working on a solution to this which will be deployed shortly. In the meantime, the best workaround is to avoid right-click Insight scans of non-executable files. There isn't any added benefit of right clicking these files, since Insight protection is already properly applied (without this non-exe/exe issue) when the file is first downloaded.

Kudos0

Re: What is WS.Reputation.1?


mgbmike wrote:

Noticed this problem this morning. Any *.zip files downloaded with Firefox 3.6.3 are auto scanned with download statusbar and deleted by Insight.

I'll leave them quarantined until I get a definitive response from the Norton engineers.


mgbmike,

Can you confirm that you are not right clicking these, but they are being automatically quarantined?  Can you give a link to an example .zip you're downloading?

Are you using any firefox download managers, or just default firefox 3.6.3?

Kudos0

Re: What is WS.Reputation.1?

I may not be Mike (boo on me!), but I can confirm that the files are auto-scanning and auto-quarantining in Firefox 3.6.3.  Only addons are the Norton IPS service, .Net Framework Assistant, Java Console & Quickstarter, and Adblock Plus with the Element Hiding Helper.  I can also confirm that the file is clean (scanned with two other AVG programs on other systems, from a trusted, password-protected site with tech support that I've spoken to).

-Adam

Kudos0

Re: What is WS.Reputation.1?

Note that we are seeing a separate issue regarding FireFox - sorry, I missed mgbmike's post. We're working on this one - there is a separate thread going here:

http://community.norton.com/t5/Norton-360/ws-reputation-1-detections-on-Firefox-DEV-builds/m-p/228217#U228217

-Adam

Kudos0

Re: What is WS.Reputation.1?


abro wrote:

Hi - We've been looking at this issue since it was reported yesterday. Here's what we've found.


The right-click option has an issue where it tries to determine the reputation of downloaded *non-executable* files. This issue is limited only to the right click scan, and only when the file was downloaded.


We are currently working on a solution to this which will be deployed shortly. In the meantime, the best workaround is to avoid right-click Insight scans of non-executable files. There isn't any added benefit of right clicking these files, since Insight protection is already properly applied (without this non-exe/exe issue) when the file is first downloaded.


I'm not right clicking any file downloaded. Firefox is setup to auto scan every file downloaded and Insight still quarantines files when scanning.

Kudos0

Re: What is WS.Reputation.1?


UPDATE FROM SYMANTEC last edited by Tony Weiss on June 02, 2010


Since this has become a lengthy thread, we've updated this first post to provide useful information to new forum members. While we work hard to gather info about as many files and configurations as possible, there are occasionally situations where we may encounter programs that get identified as WS.Reputation.1. We apologize for the inconvenience, and would like your help in improving the service and preventing any re-occurrence.

In the event that a file has been wrongly identified as WS.Reputation.1, please submit it here for review. For a workaround on this issue, please follow the directions in this post. I would also recommend that you review this post for information on why some of your files may be identified as WS.Reputation.1.


I am continually getting a warning that every .rar file has this in it.  This file (Ws.Reputation.1) is quarantined every time I right-click on a .rar file and choose to analyze it with Insight Network Scan.

However, when I run a full system scan, Norton detects only cookies.

It doesn't seem to pick up on the "infected" .rar files unless I right-click on them, and choose Insight Network Scan.

I have Norton Antivirus 2010. Please let me know what this is and how to get it to stop showing up on every .rar file that I have downloaded!

Kudos0

Re: What is WS.Reputation.1?


bwoirhaye wrote:

mgbmike wrote:

Noticed this problem this morning. Any *.zip files downloaded with Firefox 3.6.3 are auto scanned with download statusbar and deleted by Insight.

I'll leave them quarantined until I get a definitive response from the Norton engineers.


mgbmike,

Can you confirm that you are not right clicking these, but they are being automatically quarantined?  Can you give a link to an example .zip you're downloading?

Are you using any firefox download managers, or just default firefox 3.6.3?


No right clicking. Yes, automatically quarantined.

I'm using an addon called Download Statusbar.

Example zip(s) I've D/Led can be found at Flightsim.com

Kudos0

Re: What is WS.Reputation.1?

mgbmike - We've tried out download status bar but aren't seeing this issue - have you configured it to automatically run an Insight scan on download (there's a feature in the options that seems to allow you to do this)?

Any more details is definitely appreciated - we want to solve this ASAP.

Kudos0

Re: What is WS.Reputation.1?

Further attempts: tried downloading using IE8, no addons, and getting the same result.  NAV 2010 is automatically quarantining the file as soon as it finishes downloading.  

I realize that I could probably just get around this by closing the software for a few minutes, but I really don't want to get my new program installed and then find out that I'm still getting false positives from it.

-Adam 

Kudos0

Re: What is WS.Reputation.1?

LibraryAdam - What kinds of files are you downloading? Are your downloads always being made over SSL (https address)?

Thanks for your help.

Kudos0

Re: What is WS.Reputation.1?


abro wrote:

mgbmike - We've tried out download status bar but aren't seeing this issue - have you configured it to automatically run an Insight scan on download (there's a feature in the options that seems to allow you to do this)?

Any more details is definitely appreciated - we want to solve this ASAP.


My setup for download statusbar (version 0.9.6.8) is as follows on the virus scan tab:

Program location is C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\navw32.exe

Arguments is %1

No other virus setup options I see with this version.

Insight runs automatically once D/l finishes.

Thank you for getting on top of this problem. I have to go out for a while but will check back in later.

Kudos0

Re: What is WS.Reputation.1?

It's a self-extracting *.zip of some cataloguing software that I'd like to try.  Standard HTTP, not HTTPS.  

Just downloaded Chrome and saved the file successfully.  Firefox 3.6.3 doesn't work, and IE8 doesn't work.  Through trial and error (and safe-modes), I've definately narrowed the problem down to the Norton browser plugin, although this may have been obvious to everyone else from the beginning.  I'm not having the sharpest of days...

-Adam

Kudos0

Re: What is WS.Reputation.1?

I am getting the WS.Reputation1 result when I downloaded a file (a jpg file in this instance) when I do the right click Insight Network Scan and also if I do a custom scan on the file.  This does not seem to happen with other jpg files that I have not downloaded, for example, files transfered from my digital camera.

Will await a solution.

Kudos1

Re: What is WS.Reputation.1?

Alcyhmyst - see my reply above - we understand the right click/custom scan issue you're seeing and are working on a fix.

http://community.norton.com/t5/Norton-Internet-Security-Norton/What-is-WS-Reputation-1/m-p/228465

LibraryAdam - yours is a separate issue, since you're downloading an executable file. This file has a low reputation so it is being flagged. I've sent you a PM to get this resolved for you.

Thanks for everyone's patience while we've worked on these two issues. 

-Adam

Kudos0

Re: What is WS.Reputation.1?

I am using Norton Internet Security 2010 and have all downloads automatically scanned by NAV via download status bar add on to FIrefox.  I cannot download pdf's, emails (eml) or anything else.  Everything is scanned and deleted as WS.Reputation.1.  I will disable the auto scan feature until this matter is resolved but would appreciate knowing when it is resolved via email.  I thought only McAfee messed up like this!

Kudos0

Re: What is WS.Reputation.1?


mgbmike wrote:

My setup for download statusbar (version 0.9.6.8) is as follows on the virus scan tab:

Program location is C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\navw32.exe

Arguments is %1

No other virus setup options I see with this version.

Insight runs automatically once D/l finishes.

Thank you for getting on top of this problem. I have to go out for a while but will check back in later.


Hi Mgbmike.  I'm a developer on the Insight team and have been looking into your issue.  It turns out that your configuration of 'Download Statusbar' is running into the same right click bug that Abro pointed out earlier in the thread - http://community.norton.com/t5/Norton-Internet-Security-Norton/What-is-WS-Reputation-1/m-p/228465

Until the right click issue is fixed, can you disable the 'Manually Scan Completed Downloads' checkbox under the Virus Scan options in the Download Statusbar plugin?  Norton already integrates with Firefox to scan all of your downloads using the appropriate Insight logic, so this secondary scan by Download Statusbar is unnecessary.  Disabling this scan will not reduce your protection in any way, and you can be confident that Norton is still protecting you.

Kudos0

Re: What is WS.Reputation.1?


gerrika wrote:

I am using Norton Internet Security 2010 and have all downloads automatically scanned by NAV via download status bar add on to FIrefox.  I cannot download pdf's, emails (eml) or anything else.  Everything is scanned and deleted as WS.Reputation.1.  I will disable the auto scan feature until this matter is resolved but would appreciate knowing when it is resolved via email.  I thought only McAfee messed up like this!


Hi Gerrika.  It looks like you are running into the same issue as mgbmike (see my post above).  Please leave Download Statusbar's autoscan feature disabled until a fix is available.  Just to re-iterate, this does not disable Norton's built-in Firefox scanning and does not reduce your system's security.

Kudos0

Re: What is WS.Reputation.1?

I am using Firefox without any download helper, and I am trying to download a .msi file and it gets flaged and quarantined. I have no problems with .exe also I've not tried any other file types.

Kudos0

Re: What is WS.Reputation.1?

Jeff,

Earlier today, I reported the WS.Reputation.1 problem and have had a similar problem when I right click and run an Insight Scan.  However, as a point of clarification that is perhaps different from what has been described, when I scan documents I create they are quarantined or when I download a safe document and copy it the original is quarantined and the copy is deemed safe (no risk). 

Hope this clarifies or adds some additional details to the ongoing problem.

Regards,

Zoo

Kudos0

Re: What is WS.Reputation.1?

My scans started showing the ws.reputation.1 message about 6:00 p.m. last night.  I know that I have not downloaded any .rar files from an unknown source, only sites I have used for a very long time.  I am not downloading any more .rar files or scanning existing. rar files until this problem is resolved.  I certainly hope that it will resolved very soon.  This is really aggravating -

Kudos0

Re: What is WS.Reputation.1?


JohnS4582 wrote:

I am using Firefox without any download helper, and I am trying to download a .msi file and it gets flagged and quarantined. I have no problems with .exe also I've not tried any other file types.


It appears that my current issue with downloading .msi file is fixed. I noticed that I received update at 4:55 ET and the problem went away. Thanks "I think".
Kudos0

Re: What is WS.Reputation.1?


jeffw wrote:
Hi Mgbmike.  I'm a developer on the Insight team and have been looking into your issue.  It turns out that your configuration of 'Download Statusbar' is running into the same right click bug that Abro pointed out earlier in the thread - http://community.norton.com/t5/Norton-Internet-Security-Norton/What-is-WS-Reputation-1/m-p/228465

Until the right click issue is fixed, can you disable the 'Manually Scan Completed Downloads' checkbox under the Virus Scan options in the Download Statusbar plugin?  Norton already integrates with Firefox to scan all of your downloads using the appropriate Insight logic, so this secondary scan by Download Statusbar is unnecessary.  Disabling this scan will not reduce your protection in any way, and you can be confident that Norton is still protecting you.


I will disable the manual download statusbar autoscan right now.

Thanks for staying on top of this and hope the problem everyone is having is resolved soon.

Kudos2

Re: What is WS.Reputation.1?

All - Good news - a fix is coming. It turns out that the command line call of Norton (something we previously haven't seen used often) can have an issue that results in WS.Reputation.1 triggering. This fix should be out shortly - likely by tonight. In the meantime, avoid using the Norton command line, particularly for scanning non-executable files.

-Adam 

Kudos0

Re: What is WS.Reputation.1?

Same here been getting a on a couple of downloads where I have downloaded from before

with no problem and gor this WS.Reputation.1 and was quaranteen.

you have said you looking to fix the problem will it be included in the updates or do we need

to download seperately

Kudos3

Re: What is WS.Reputation.1?

Hi Hawk,

The fix will happen on the back-end, so you don't need to worry about a separate download. 

Thank you to all for bearing with us on this issue.  We are actively working on getting the resolution in place.

Zulfikar

Kudos0

Re: What is WS.Reputation.1?


abro wrote:

All - Good news - a fix is coming. It turns out that the command line call of Norton (something we previously haven't seen used often) can have an issue that results in WS.Reputation.1 triggering. This fix should be out shortly - likely by tonight. In the meantime, avoid using the Norton command line, particularly for scanning non-executable files.

-Adam 


I might be missing something but it obviosly doesn't happen with non-executables only

http://community.norton.com/t5/Norton-Internet-Security-Norton/Again-Repuation-1-detections-for-every-unknown-to-Norton-exe/td-p/227907

Kudos0

Re: What is WS.Reputation.1?

Seems fixed now.

09:28 GMT+2 (UTC+2)

Kudos0

Re: What is WS.Reputation.1?

Seems to me its been fixed as the 2 files I had this trouble with are OK now

Thankyou for fixing quick

Kudos0

Re: What is WS.Reputation.1?

I just did some test downloads with virus autoscan enabled on download statusbar and it appears to be working correctly again.

Kudos0

Re: What is WS.Reputation.1?

Yep, it's fixed. I just did a test. Thanks for the quick fix and the exemplary cooperation. Well done, guys! :-)

Kudos0

Re: What is WS.Reputation.1?

Fixed? So why am I still seeing that running part of Minefield eg plugin-container.exe is again claimed to have this WS.Reputation.1?
Win 7 64U , Firefox , Minefield, IE8, Thunderbird , NIS 2010
Kudos0

Re: What is WS.Reputation.1?

I agree that it is not fixed; I continue to have the problem with downloads from both Firefox and IE8.

Replies are locked for this thread.