• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Application marked with WS.Reputation.1 as bad. How to remove?

I want to remove WS.Reputation.1 BAD from my software but cannot find a way until now.

There seems to be no link on norton.com to do this (existing dispute links lead "not found" on norton.com!)

Some explanations:

A user can download software from my site "https://www.boyans.net" as .zip file.

Site is marked with OK by Norton SafeWeb.

The software name is Dual-boot Repair tool for Windows 10 (version 1.3).

The executable file "DualBootRepair.exe" when viewed with "Norton File Insight" gives this:

=======================================================================

Filename: DualBootRepair.exe
Full Path: C:\Users\.....\Downloads\dbr-1.3.0.0\DualBootRepair.exe

____________________________

____________________________


Developers 
Not Available

Version 
1.3.0.0

Identified 
16/01/03 at 15:49:34

Last Used 
Not Available

Startup Item 
No


____________________________


Few Users
Hundreds of users in the Norton Community have used this file.

Mature
This file was released 6 months ago.

Bad
There are many indications that this file is untrustworthy.


____________________________


Source File:
dualbootrepair.exe

____________________________

Performance

____________________________

Avg. Resource Usage: Moderate
Avg. CPU Usage: Low
Avg. Memory Usage: Moderate

____________________________


File Thumbprint - SHA:
aa820b3a47222722f91fa240da07d8ba64d2ceb681c7e5d536d865c3c81b745f
File Thumbprint - MD5:
26f40ceb192b1974ad70f45af91f3923
 

=======================================================================

Already chatted twice with support.

During first chat I had to do some operations with enabling/disabling Firewall, check that operation of DualBootRepair.exe is OK e.t.c.

After that I was assured that "BAD" mark from Norton File Insight will be removed.

I was happy.

Later saw that nothing has happened with Norton mark = "BAD".

Chatted a second time and was advised to check my site with Norton Safe Web.

BUT! My site is marked "OK" from Norton Safe Web since 2014.

What to do next? I don't want to chat again for nothing!

There is no ACTUAL link on norton.com where you can submit request for reconsideration of results from Norton File Insight.

Moreover this whole thing with "Community wisdom" seems problematic as individuals or a group of individuals can mark any software as BAD just for fun or any other reason. This way Norton has opened the door for manipulating the reputation of any software product!

Is Norton AntiVirus really not capable of scanning a software application and give a definitive answer if it contains traits or not ???

How can I remove WS.Reputation.1 BAD for my software?

Thanks.

boyans.net

Replies

Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Windows 10 x64 1909
Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Thanks for fast response.

I think I have supplied data through this link already but did it again.

Lets hope this will solve issue with WS.Reputation.1

Will mark answer as helpful only if I see change in reputation or receive feedback from norton.com.

Interesting is that Chrome browser displays this same page "https://community.norton.com/en/forums/application-marked-wsreputation1-..."

and https is marked with red strike-through and lock symbol is marked with red x.

I am concerned with security on norton.com - what is wrong with security on norton.com?

The message is that the page includes unsecure resources which can be viewed by others and allow an attacker to change the behaviour of the page. Is this a joke or what?

boyans.net
Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Bo Yans: I want to remove WS.Reputation.1 BAD from my software but cannot find a way......

Software Whitelisting Request
Our software whitelisting program offers software authors and vendors the opportunity to periodically submit software for inclusion in the Symantec whitelist of known good software in order to reduce the possibility of false positives.
Important information
• Whitelisting is file/version specific. Future versions will not be whitelisted by default.
• New versions of your software should be submitted for whitelisting as they become available.
• For identity verification, a corporate email address is mandatory. Requests from free email domains will not be processed.

https://submit.symantec.com/whitelist/ 

DualBootRepair.exe > Detection ratio: 2 / 56   Analysis date: 2016-01-06 

Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

From VirusTotal link given in previous post:

Antivirus     Result    Update

ViRobot   Trojan.Win32.A.Downloader.217600.JB[h]   20160106

Zillya   Trojan.Kryptik.Win32.808101   20160106

ViRobot leads to "http://www.hauri.net/" which does not respond at all?

-------------------------------------------------------------------------------------

This page can’t be displayed

  • Make sure the web address http://www.hauri.net is correct.
  • Look for the page with your search engine.
  • Refresh the page in a few minutes.

--------------------------------------------------------------------------------------

Seems a reliable site and virus scanner - ha-ha

Zillya - another kid on the block?

All major antivirus providers report file as safe. Even Norton.

The problem is not with viruses - it is with "Community wisdom" which is an engine for manipulation of software reputation. Anybody can register and vote.

It's possible to pay 10 people to register with Norton and vote down any product!! Correct?

Is Norton antivirus software really not capable of giving a definitive answer to the question "is a software safe or not safe" but has to ask "The Community"?

I even don't use Norton products but was notified that "Norton thinks that dbr is bad".

boyans.net
Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

To prevent false positive detections we strongly recommend that you digitally sign your software with a class 3 digital certificate.

Code signing from a recognized and trusted Certificate Authority provides explicit third-party confirmation of the publisher’s identity.

It also helps ensure the integrity of the application since it indicates that code has not been tampered with since the initial digital signature.

Our Symantec whitepaper discusses the topic further and includes details surrounding best practices for digitally signing your software.

https://submit.symantec.com/whitelist/ + False Positive
http://www.symantec.com/content/en/us/enterprise/white_papers/b-to_increase_downloads-instill_trust_first_WP.en-us.pdf


Symantec WS.Reputation.1
http://www.symantec.com/security_response/writeup

Clarification on WS.Reputation.1 detection
https://community.norton.com/forums/clarification-wsreputation1-detection

Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

I think all responses lead to the same:

1. Small companies or individual developers are neglected in favor of big corporations (not everybody can pay $300 a year for a Symantec Certificate)

2. If you don't have a corporate email address (which individual developers don't have) you are neglected and YOU ARE NOBODY AND CANNOT WHITELIST YOUR PRODUCT.

Thank you Norton, thank you Symantec - ha-ha

Thread is closed for me without resolution due to Norton/Symantec corporate politic.

Not everything is money and corporations!!!

=============================

PS:

Fix at least https://community.norton.com as Chrome flags this site as insecure(red x on lock and red strike-through on https!) What a joke! 

boyans.net
Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Update:

Received mail from "falsepositives@symantec.com":

======================================

In relation to submission [3894672].

Upon further analysis and investigation we have verified your submission and, as such, the detection(s) for the following file(s) will be removed from our products:

        Filename: DualBootRepair.exe
        MD5: 26F40CEB192B1974AD70F45AF91F3923
        SHA256: AA820B3A47222722F91FA240DA07D8BA64D2CEB681C7E5D536D865C3C81B745F
        Result:         Whitelisting for above file is taking effect from now on.

========================================================

Upon checking that WS.Reputation.1 BAD has really disappeared this time I will have to admit that small companies and individual developers are not completely lost with Norton.com/Symantec regarding their product reputation update.

BUT: (from EMEA /UK http://www.symantec.com/en/uk/code-signing/ )

EV Code Signing :  1 Year: $795.00

Code Signing Certificates for Microsoft Authenticode: 1 Year: $499

(discounts available for 2 and 3 years certificates)

Code signing is necessary for pro active whitelisting of new software products/versions if developer/company don't want to go the way I am going now.

Seems a little too much especially for free products!

What do you think?

boyans.net
Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Update:

This was posted on a user forum:

Thank you Norton, you help me gaining users!

============================================================

Download of zip from site - OK. Unzipping OK. Checking file:

This is from my computer checked on 6.Jan 2016 at 17:45 (UTC+2).

So have to wait maybe 24 hours? Or more?

boyans.net
Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Bo Yans:  What do you think?

happy to read F/P submission sorts....."
Yes, after re-analyze submission sorts....wait for database update.  
Note: whitelist is file specific.  New/updated file needs new submission. 

Kudos0

Re: Application marked with WS.Reputation.1 as bad. How to remove?

Update: (after 24 hours and update of NIS definitions)

This problem solved!

Just a few more questions:

1. I am using a trial version of NIS. After the trial period ends how would I check if one of the applications posted on my web site for download is not reported with WS.Reputation.1 bad or some other bad mark by Norton?

2. Is there a free version of File Insight? Free Online File Insight?

3. What exactly does File Insight regard as "bad" - is there any tutorial/guide for developers what a program should not do from the viewpoint of Norton (e.g write to certain areas in registry, write to certain places in file system, whatever interaction with resources) to avoid WS.Reputation or another bad mark from Norton?

There are too much antivirus solutions. There are too much false positives.

If every antivirus software company is going to include some reputation or whatever classification of software products, a developer will have to spend days if not weeks just to find out if one the antivirus companies has marked his software as bad. (I have not used more than 5 antivirus products during the last 20 years - now I see 54 antivirus scanners listed on VirusTotal, tomorrow they will be maybe 100?) 

boyans.net

This thread is closed from further comment. Please visit the forum to start a new thread.