• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Norton File Insight reports display only application as "Bad"!

I have developed a small application which is displaying a simple form with a grid.

(can be downloaded from https://www.boyans.net/ArcPaths/ArcPaths.htm)

The application has no viruses, no file writes, no registry writes. Pure display only application.

The application simply reads some Windows system data and displays it in a table/grid.

The only thing a user can do besides looking on application form is to select a row and copy its content to clipboard.

I was really astonished to see this 4 year old application marked as bad!

This is completely unacceptable from the viewpoint of a developer who does not have a Norton product installed and cannot know that Norton has given a "Bad" mark for his application. There is no place on the internet where such information is available.

I have the impression that Norton is trying to gain more customers through this File Insight reputation thing in two directions - first developers are somehow forced to buy a Norton antivirus solution, second to buy a Symantec Code signing certificate. 

--------------------------------------------------------------------

At the moment I am using the latest trial version of NIS.

What should a developer like me do when the trial expires?

How would I check if Norton has not flagged any of my applications/versions as bad?

I see as possible solution a free version of File Insight (either downloadable or online).

What do you think?

boyans.net

Replies

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

Software developers who want to accelerate the reputation building process for their new software applications should submit new applications to the Symantec white-listing program. Details of that program can be found here.

Bo Yans: I was really astonished to see this 4 year old application marked as bad!

Few Users: Fewer than 100 users in the Norton Community have used this file.
Mature: This file was released 3 years 9 months ago.
Good: Norton has given this file a good rating.
File Created: arcpaths.exe
File Thumbprint - SHA:
907560240f6faddddd3b4c576539c4dec3a0753e11ad9057229d187c2c8376fa
File Thumbprint - MD5:
aa7c544390ec83cb74c10feea7f60ded


related: Permalink

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

Bo Yans:  How would I check if Norton has not flagged any of my applications/versions as bad?

If you believe a file has been mistakenly detected, you can submit a dispute at https://submit.symantec.com/false_positive/.  This page is monitored 24 hours a day.  Symantec will email you their finding.  By my experience....turn around < one-two days.


For second opinion choose File and / or Search hash at VirusTotal or upload file to VirSCAN  and/or Jotti and/or submit to Symantec for review analysis > see > How to report false positives

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

@bjm,

The problem is not reporting/whitelisting - this was already solved in my previous thread.

Thank you.

This is a DISPLAY ONLY APPLICATION! And it is marked as "Bad"???

("There are many indications that this file is untrustworthy" - WHAT? Please specify what exactly is UNTRUSTWORTHY in a DISPLAY ONLY APP! Are we speaking the same language?)

If Norton File Insight(NFI) cannot classify a DISPLAY ONLY application as safe than NFI is completely UNTRUSTWORTHY!)

This is first and major problem - for Norton File Insight.

-------------------------------

Second problem is how would a developer know that one of his application/version is marked as "Bad" if he does not have Norton antivirus/NIS?

Are we obliged to buy Norton products? Since when?

Norton is only ONE OF MANY existing AV solutions.

There are at least 10 major AV products available.

Do you get the problem?

(there is kaspersky, avg, bitdefender, avast, panda, malwarebytes, comodo even Microsoft own defender and others!)

And on top of all this is Google as omnipresent King of the Internet with their own site AV check.

If I understand right you/Norton propose following solution:

"Just submit EVERY app and version to Norton for whitelisting"

QUESTION:

HOW TO CHECK THAT APP IS REALLY NOT MARKED AS BAD IF SOMEBODY DOESN'T HAVE NIS EVEN HE HAS SUBMITTED APP TO NORTON FOR WHITELISTING? 

(Or does submission for whitelisting automaGically mark app as "Good"? This would be a complete nonsense!)

boyans.net
Kudos0

Re: Norton File Insight reports display only application as "Bad"!

For second opinion choose File and / or Search hash at VirusTotal or upload file to VirSCAN and/or Jotti  and/or submit to Symantec for review analysis > see > How to report false positives

VirusTotal and VirScan aggregate results include Symantec.  IMO there is no prohibition that deters developer from submitting work product to Symantec for review analysis.
FWIW ~ I've run beta's that were updated frequently..., somehow developers manage to satisfy Norton.  IMO regardless of developer diligence....all files require end user scrutiny. 

How to Report Malware or False Positives to Multiple Antivirus Vendors
http://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

@bjm, thanks for the links.

(Will pm an interesting finding when comparing results from VirScan and Jotty - results are completely different from one known AV company for the same file!)

I still think that there are problems with Norton File Insight.

1. Results(reporting) of File Insight are available only to Norton customers. Not everybody is a Norton customer.

2. Reporting of File Insight has impact on reputation of software products. This reporting is not published officially on the Internet.

3. This scheme looks like a black hat technique to impact reputation of software products - some products are whitelisted but others are blacklisted often for unknown reason.

4. Norton is obliged to make results from File Insight publicly available or Norton File Insight can be regarded as a SCAM!

5. Let's use exact terminology for reporting qualities of software programs and report what exactly is wrong (if there is something wrong) - do programs/files contain a specified virus or do they have another specified bad behavior when executed.

Some people report that Microsoft Windows is a big virus. Maybe they are right. Just kidding!

boyans.net
Kudos0

Re: Norton File Insight reports display only application as "Bad"!

@Bo Yans

Thankyou.  PM sent. Lets hear from the Community. 

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

This is an interesting discussion for me, knowing as I do, very little about the technicalities. I have tended to accept Norton's verdicts without question (I have questioned occasionally) but just today I had a file blocked while moving it from one drive to another, which has raised my doubts because it was from IOBIT's Advanced System Care! I have in the past got the impression that some software was being blacklisted simply because it was 'NEW' and consequently had 'few users' --- which did not seem a very sensible approach. And can someone explain what 'repaired' (below) means?

 Filename: asc.exe
Threat name: WS.Reputation.1Full Path: d:\iobit\advanced systemcare\asc.exe______________________________________________________

On computers as of 
18/01/2016 at 12:19:42

Startup Item 
No

Launched 
No

Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe

____________________________

asc.exe Threat name: WS.Reputation.1
Locate


Few Users
Hundreds of users in the Norton Community have used this file.

Mature
This file was released 2 months ago.

Medium
This file risk is medium.

____________________________

Source: External Media

Source File:
explorer.exe

File Created:
asc.exe

____________________________

File Actions

Infected file: d:\IObit\advanced systemcare\ asc.exe      Repaired
____________________________

File Thumbprint - SHA:
481625bb32987100223d8ae7221069d6af445b9c613bb4036fbf2a18a96475ab
File Thumbprint - MD5:
Not available
 

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

Clayto:  Threat name: WS.Reputation.

Symantec WS.Reputation.1
http://www.symantec.com/security_response/writeup

Clarification on WS.Reputation.1 detection
https://community.norton.com/forums/clarification-wsreputation1-detection

You may opt User Trusted / "Trust Now" files that you know as safe and you trust
https://support.norton.com/sp/en/us/norton-security-with-backup/22.5.5.15/solutions/v15472472

For second opinion choose File and / or Search hash at VirusTotal or upload file to VirSCAN and/or Jotti and/or submit to Symantec for review analysis > see > How to report false positives.

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

Interesting links.

My comments are not assertions, rather they are questions from a novice.

Is it not the case that 'the wisdom of crowds' approach is inappropriate for new software (including new versions) or software for which there are other good reasons for  a small user base, such as niche interests?

I am trying to gauge how seriously I should take Norton's warnings. I am only likely to question 'bad' reports when I have some reason to be surprised by them, as was the case with a file from IObit's 'flag ship' product Advanced System Care (Send Anywhere is another example, from a while back.) 

Kudos0

Re: Norton File Insight reports display only application as "Bad"!

Clayto:  Is it not the case that 'the wisdom of crowds' approach is inappropriate for new software (including new versions) or software for which there are other good reasons for a small user base, such as niche interests?

IMO...., regardless of Norton......all files require end user scrutiny.   
FWIW..., I've never had a WS.Reputation.1 flag that stood up to my scrutiny.
Regarding IOBit.  Try the Community search engine for "IOBit".....you'll find IOBit related Topics/messages. 

This thread is closed from further comment. Please visit the forum to start a new thread.