topic Re: What is WS.Reputation.1? in Norton Internet Security / Norton AntiVirus

What is WS.Reputation.1?

vicky22 — Thu, 03 Jun 2010 19:34:08 GMT

UPDATE FROM SYMANTEC last edited by Tony Weiss on June 02, 2010

Since this has become a lengthy thread, we've updated this first post to provide useful information to new forum members. While we work hard to gather info about as many files and configurations as possible, there are occasionally situations where we may encounter programs that get identified as WS.Reputation.1. We apologize for the inconvenience, and would like your help in improving the service and preventing any re-occurrence.

In the event that a file has been wrongly identified as WS.Reputation.1, please submit it here for review. For a workaround on this issue, please follow the directions in this post. I would also recommend that you review this post for information on why some of your files may be identified as WS.Reputation.1.

I am continually getting a warning that every .rar file has this in it. This file (Ws.Reputation.1) is quarantined every time I right-click on a .rar file and choose to analyze it with Insight Network Scan.

However, when I run a full system scan, Norton detects only cookies.

It doesn't seem to pick up on the "infected" .rar files unless I right-click on them, and choose Insight Network Scan.

I have Norton Antivirus 2010. Please let me know what this is and how to get it to stop showing up on every .rar file that I have downloaded!

Re: What is WS.Reputation.1?

cgoldman — Fri, 07 May 2010 04:15:05 GMT

Can I just be clear are you saying every rar file is quarantined?

Re: What is WS.Reputation.1?

vicky22 — Fri, 07 May 2010 04:41:27 GMT

The .rar files are not quarantined unless I right-click on them and choose "Insight Network Scan."

When the scan is completed, I am told I had a "WS.Reputation.1," which has been quarantined, thereby deleting the .rar file in question.

Happens with ever .rar file I download to the desktop. Also scanned a few .rar files that were in the recycling bin, and for some reason, those get quarintined too.

However, the .rar files I have stored in a folder on my desktop do not show up as having the ""WS.Reputation.1."

So basically, all recently downloaded .rar files are quarantined if I right-click on them and choose to do a virus scan.

It may also be important to note that it's giving me a warning that "fewer than 10 users in the norton community have used this file" for each .rar.

I've tested this on at least 10-15 .rar files from assorted sources, and the assertion that "fewer than 10 users have used them" just does not seem accurate to me.....

The .rars I am using are custom content for a computer game I have, if that is useful. I have downloaded tons of them in the past successfully, and now suddenly Norton wants to quarantine them if I scan them.

Re: What is WS.Reputation.1?

3play — Fri, 07 May 2010 06:13:09 GMT

I think there is a problem right now regarding this which affects both 2010 and 2011-beta versions.

You could search the Community for it . You can do nothing right now except from not clicking on these files to perform Insight Network (Cloud) scan

Re: What is WS.Reputation.1?

negat1ve — Fri, 07 May 2010 06:41:26 GMT

I'm running Norton Internet Security V 17.6.0.32 and I'm getting the same crap as above only

It's not just .rar files but ANY files I download and right-click to check with Insight Network Scan

-even a few .Jpg images I pulled off of a few random websites.

Re: What is WS.Reputation.1?

Cyron — Fri, 07 May 2010 09:52:44 GMT

Hi,
I have the same problem not with rar files only but with every file that my IE8 generates! No matter whether it's a download or when I save a HTML page. I did some easy tests on it.

Just right click on the desktop,

select new file

and select new text file.

Rename the extension from txt to htm.

Just to make sure the file is clean, let Norton scan it. It should be OK.

Open that empty file with IE8 and save it as plain html or mht file.

Let Norton scan it and it will complain about that virus and removes the file.

Open the file with notepad and you will find nothing than a regular html header. So if this virus is really there it must be in an alternate data stream hidden behind the visible part of the file (goes for NTFS file system).

Now do the same with another web browser (I used Google Chrome). Voila, nothing to complain here. The same goes for almost any download (msi and exe files are not infected by IE8 which occurs pretty strange to me).

Regards

Cyron

EDIT: I just let virustotal.com scan such a test file and it couldn't find anything suspicious.

Re: What is WS.Reputation.1?

dumpav — Fri, 07 May 2010 10:22:38 GMT

yeah, i just starting have the same PROBLEM!!!

when i right click a folder of file it detect nothing, when i run full system scan it detect nothing but when i right click a file to scan, it said it have this virus and delete it!!!??

what happeing????

Re: What is WS.Reputation.1?

jesse_gough — Fri, 07 May 2010 11:58:40 GMT

Thanks for letting us know. The engineering team is looking into this issue.

Re: What is WS.Reputation.1?

LibraryAdam — Fri, 07 May 2010 12:42:19 GMT

Morning;

Having the same problem - a file from a trusted site is giving me a positive for WS.Reputation.1. I'm figuring that it's just a bug, but I'd like to know for certain.

-Adam

Re: What is WS.Reputation.1?

Yaso_Kuuhl — Fri, 07 May 2010 13:46:32 GMT

A poster in the Norton German forum is having the same problem. I have directed him/her to this thread over here and to jesse_gough's post :-)

Re: What is WS.Reputation.1?

IOB_Ernest — Fri, 07 May 2010 13:50:09 GMT

I am having the same problem - files that I believe to be clean (and from trusted sources) get tagged as "WS.Reputation.1" when I right click on them for a scan before opening. So far, this has happened with WMV and Excel files. I can perform a full system scan though and encounter no problems. This has only started happening recently. Please advise...

Thanks!

Re: What is WS.Reputation.1?

Clio — Fri, 07 May 2010 14:48:07 GMT

Same problem here - usually when I do a InsightNetzwerk-Scan of .avi, .srt and .rar files.

Re: What is WS.Reputation.1?

vicky22 — Fri, 07 May 2010 16:08:17 GMT

Additional info:

This began yesterday 5/6/10 around 10:00 pm CST.

I have Internet Explorer, I think version 6 or 7.

I uploaded a .rar file that Norton analyzed as infected to VirusTotal, and it detected nothing.

It seems unlikely given the evidence, but could this be an actual virus that is affecting only certain types of files?

Or is it that Norton is incorrectly identifying these files as being "infected"?

That's what I would really like to know!

If this is a virus/threat, I would really like to know what kind. All the Insight Network scan tells me is that it is an "infected file".

So, what kind? Spyware, malware, virus, worm.....?

And if that were the case, why is it that I can extract and use the "infected" .rar files without any issues? They go straight to my game as they always did, and the game runs normally.

Plus, full system scan never catches or quarantines the .rar files, only the Insight Network scan does.

Does anyone believe this could be an actual virus and/or threat?

Re: What is WS.Reputation.1?

e1scd — Fri, 07 May 2010 15:56:59 GMT

I have noticed the same problem. Downloads of compressed files from legitimate sources are identified as being infected with WS.Reputation.1 and subsequently deleted. I typically use "download statusbar" add-on in FireFox 3.6 and have this configured to automatically scan all downloads with NAV17.6.0.32\navw32.exe. As soon as the download is completed, NAV scans the compressed file, identifies it as infected and deletes the file. The problem seemed to arise with a program update from 5/5/2010 or 5/6/2010.

My systems are running Windows 7 Ultimate 64-bit using NIS2010 for AV protection. Other malware programs (Iobit 360, PC Tools Spyware Doctor/Threatfire, VirusTotal) do not identify any type of risk in the same files.

Re: What is WS.Reputation.1?

u2zoostation — Fri, 07 May 2010 16:02:20 GMT

This would be a very helpful problem to resolve. I have the same problem only when I initiate the scan and receive the WS.Reputation.1 message and immediately quarantines the files and .RAR bundles. Retrospectively, I have scanned files that I created and other files that were previously scanned with no issues and are now quarantined.

Please advise.

Re: What is WS.Reputation.1?

conancpa — Fri, 07 May 2010 16:11:58 GMT

I have the same problem with any download from both Firefox and IE8. Also, I tested it by scanning previously downloaded files. These files were scanned at the time of the original download and the scan at that time showed no problems. If I scan them now they are treated as infected with WS.Reputation1 and quarantined.

Re: What is WS.Reputation.1?

Cyron — Fri, 07 May 2010 16:12:07 GMT

As I ave stated in my first post on page 1 this only happens when I use Internet Explorer but not with Google Chrome. So my advice is: try another web browser and let IE alone until this issue is solved by Symantec.

Re: What is WS.Reputation.1?

vicky22 — Fri, 07 May 2010 17:12:56 GMT

Well in my case this only happens with .rar files that were downloaded on 5/7 and 5/6.

It appears that .rar files from before these dates come up with a clean slate when Norton individually analyzes them.

Re: What is WS.Reputation.1?

mattsegers — Fri, 07 May 2010 16:52:14 GMT

Same problem here.

Just out of curiosity, how many of you have "scan compressed files" as "on" in your settings? Maybe why it picks it up when you do a custom, right-click scan, and not when you do the full scan. I haven't, however, tested this myself.

*edited out spelling error

Re: What is WS.Reputation.1?

mgbmike — Fri, 07 May 2010 16:57:37 GMT

Noticed this problem this morning. Any *.zip files downloaded with Firefox 3.6.3 are auto scanned with download statusbar and deleted by Insight.

I'll leave them quarantined until I get a definitive response from the Norton engineers.