• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

I create a new thread because I don't see an existing one concenrning this. I think it is very important.

Ever since I have upgraded my versions of Norton 2010 to 17.5 I noticed that Download Insight no longer reports yellow pop-up to files with Unproven , Untrusted or Poor reputation . This used to be with previous builds (17.0 , 17.1 ...) . Instead of reporting yellow and giving the user the option to decide , it automatically scans and deletes the file - all such files are marked red and deleted Reser.Reputation.1

Although this might be helpful in most cases , this way of working is prone to False Positive Alerts.

One just creates a harmless self-extracting archive and make this SFX into exe . This sfx exe contains a PDF file (harmless one) and it is marked automatically as a threat Reser.Reputation.1

You could try it with random unknown exe with Unproven or ... reputation

Any comments ?

Replies

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

I create a new thread because I don't see an existing one concenrning this. I think it is very important.

Ever since I have upgraded my versions of Norton 2010 to 17.5 I noticed that Download Insight no longer reports yellow pop-up to files with Unproven , Untrusted or Poor reputation . This used to be with previous builds (17.0 , 17.1 ...) . Instead of reporting yellow and giving the user the option to decide , it automatically scans and deletes the file - all such files are marked red and deleted Reser.Reputation.1

Although this might be helpful in most cases , this way of working is prone to False Positive Alerts.

One just creates a harmless self-extracting archive and make this SFX into exe . This sfx exe contains a PDF file (harmless one) and it is marked automatically as a threat Reser.Reputation.1

You could try it with random unknown exe with Unproven or ... reputation

Any comments ?

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Sorry but I do not understand what you are doing to get a problem. I can create an executable zip file containing a pdf and I have no issue.In your case what action are you performing when you have created the exe?

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file


cgoldman wrote:

I can create an executable zip file containing a pdf and I have no issue.In your case what action are you performing when you have created the exe?


After you create this , upload it somewhere and then download it with your browser (IE or Firefox) . This way Download Insight will analyse it and produce a false positive alarm of a threat .

Thy this - it contains just a PDF - a magazine - harmless PDF into sfx exe

http://hotfile.com/dl/25486875/92f250e/Rosi_Ivanova.exe.html?uploadid=25486875&fname=Rosi_Ivanova.exe.html&hash=92f250e&lang=en

http://hotfile.com/get/25486875/4b5be806/3a92a51/Rosi_Ivanova.exe

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Just made an experiment to proove what I am talking about

See the pictures

http://i48.tinypic.com/16a33pg.png  and  http://i48.tinypic.com/14uuoo0.png

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

i restore this File vom Quarantine , Sonar2 detect und delete this File ... are you sure that is Clean ?

http://img64.imageshack.us/img64/751/65522836.jpg

the file have harmful actions, so the reputation detection

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

This file particularly might not be clean but you can test with any other file . I supposed you can create your own exe (example a self-extract one from an archive and fill it with harmless files) , then upload that exe somewhere and attemp to download it.

Check out the result. Obviously there is something wrong with this. Note that it was not like that a few days ago

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file


3play wrote:

This file particularly might not be clean but you can test with any other file . I supposed you can create your own exe (example a self-extract one from an archive and fill it with harmless files) , then upload that exe somewhere and attemp to download it.

Check out the result. Obviously there is something wrong with this. Note that it was not like that a few days ago


I have been able to reproduce the issue you raise. I used winzip 14 to build a zip file (it is necessary to use legacy compression) and then to convert to winzip executable. I uploaded the exe to my own website (using Cuteftp)  and downloaded using http.

The downloaded file is picked up by Norton's and removed in quarantine. The desciption is Reser.Reputation.1

I will try to get a SYmantec employee to look at this and response.

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

I can confirm this as stated by the OP.  Create a sfx file and then download via http and Download Insight graps the file first and then when restored from Quarantine, SONAR2 grabs it also.

Win10 x64; Proud graduate of GeeksToGo
Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Thank you for your confirmation,guys!

Hopefully Symanec notice it and fix - it happens with any executable with unknown status for Download Insight

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Any comment from Symantec ? This is too serious to shrug it off.

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Hey guys,

We are looking into this issue.

Thanks,

Barrett

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file


BarrettBaxter wrote:

Hey guys,

We are looking into this issue.

Thanks,

Barrett


Thank you for letting us know , Barrett!

Very important for us to know you are working 24/7   to improve the greatest security product

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

@Barretbaxter

hxxp://www.sandboxie.com/SandboxieInstall-343-17.exe
hxxp://www.sandboxie.com/SandboxieInstall64-343-17.exe

Two Files false positive Detection , Reser.Reputation.1

[edit: removed direct link to executable files per the Participation Guidelines and Terms of Service. Please refrain from linking directly to these types of files]

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

hxxp://sandboxie.com/SandboxieInstall-343-18.exe

hxxp://sandboxie.com/SandboxieInstall64-343-18.exe

Two Files false positive Detection , Reser.Reputation.1

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file


Varock wrote:

hxxp://sandboxie.com/SandboxieInstall-343-18.exe

hxxp://sandboxie.com/SandboxieInstall64-343-18.exe

Two Files false positive Detection , Reser.Reputation.1


This is not just a false positive on the definitions that can be submitted and fixed with a Live Update (Iron revocation). This is FP based on the technology false positives . Download Insight marks ALL such files as Reser.Reputation.1  and the problem is that they get deleted automatically just because of the reputation. This is it ---

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

I'm also getting this behaviour with Spinrite.exe from GRC.com and I'm sure that Steve Gibson would not be hosting a virus on his site with his reputation for security.

Kudos1 Stats

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Hello guys !

This morning (I live in Europe) I received an update . The problem is fixed , no more Reser.Reputation.1 threat detections based on Unproven status .

Everything is fine !

I would like to say THANK YOU to all Symantec staff envolved into reporting and fixing this !

Have a nice day!

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

This is good news. I was affected by this problem as well and can confirm that the update seems to have fixed the problem.

I think Symantec is doing a very good job and find this forum really helpful. Many other antivirus developers got a lot to learn from Symantec with regards to the support, listening to the customers and fixing bugs. The previous two antivirus software i been using the support was horrible and fixing bugs took ages if ever fixed at all. So i hope Symantec keep up the good work. I also have to add that the Norton Antivirus product since version 2009 is a huge improvment compared to the previous releases.

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Hello,

On 2 pc set with NIS 2010 17.5.0.127 with the latest updates: Download UltraISO
PC1(XP pro SP2) : no detection Reser Reputation 1
PC2 (Windows 7 Ultimate) : detection Reser Reputation 1 and deleted file.

 

Details: the downloaded file on PC1, I analyzed manually on PC2 and Norton does not detect Reser Reputation 1.

 

 Explanation because it becomes very annoying.

Thank you



---------------------------------------------------------------French/English tranlate by Google or/and Bing
Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

I, too, am having this issue.  I tried to download a file that is an exe.  I git the reser.reputation.1 message with file removed.  Norton says that theweb site is safe (i looked at more info).  No issues reported on the site.

I had downloaded the app at work and had it on a thumb drive (no issue detected by ESet).  I copied the exe (downloaded just a few hours ago from the same web site) to my computer.  No report of a problem.  I explicitly scanned the file using Norton and the file comes up clean. 

What good is an anti-virus program that will not allow me to download files that are demonstrably clean?  This is a major PITA.

I am Win7 Home premium and, according to the dashboard, has all of the latest updates.

Please advise.

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Hi dcw119,

Welcome to the community!

Can you let us know the name of the exe file and the Website from which you downloaded.

Thanks,

TomV
Norton Forums Moderator
Symantec Corporation

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Hi all,

I just had this, too.

1) Win 7 home premium x64

2) NAV 2010, 17.5.0.127

3) File downloaded:

"http://3347-mozilla.voxcdn.com/pub/mozilla.org/thunderbird/releases/3.0.4/win32/de/Thunderbird Setup 3.0.4.exe"

Herzlichen Gruß, Andreas
Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Hello!

I just re-tested and the problem described in the thread is not happening . Reser.Reputation.1 are generally legitimate detections and they can happen.

If you believe the file you point is trustworthy and reliable , submit the necessary information to Symantec and it will be correctly very fast . Have a look here : https://submit.symantec.com/dispute/insight/

In this case , it is not necessary for you to do anything because I have submitted the information to Symantec. Will post any further replies from their team

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

Looks like it is my turn to add a new one (4/4/10) to the list.  I just attempted to download the 64 bit version of the Vice Versa software from its company website, but the download was blocked by a report of the Reser.Reputation.1 virus.  I believe this is a reputatable product and am suspecting the kind of problem the others have identified.  Interestingly, the 32 bit version downloaded without a problem.

Kudos0

Re: NEW - Download Insight always report Reser.Reputation.1 to unknown or unproven file

The initail post of this thread was that ALL kind of executables which are unknown to Norton were marked Reser.Reputation.1 and deleted . If you suspect a false positive , report it here :

https://submit.symantec.com/dispute/

https://submit.symantec.com/dispute/insight/

This thread is closed from further comment. Please visit the forum to start a new thread.