False Positive from Norton 360

Archive
1

I have a program I need for work that keeps showing up as malware and a trojan horse and gets removed by norton.  I submitted the file for analysis but the status has not changed even though it says "up to 48 hours".  It's submission id aba6800e-04ca-412b-8e85-2efc2cbcbb88.

Thanks

2

Thank you for confirming.

3

the program is running without any new detections from norton.

4

Hi @nycDD, it's too early to say but most likely yes. We'll wait for your confirmation. We have removed the false positive detection and if you do not experience the detection on your side anymore, we'll consider this as resolved. If you still do, please provide the additional info.

5

thank you @tomas_he, i will try installing it again.  does that mean that the program is safe?

 

6

Hi @nycDD,

We have reviewed the chronicler_win.exe sample provided in aba6800e-04ca-412b-8e85-2efc2cbcbb88 and removed the detection from our products on February 1st.

If you still experience the issue, could you please provide a screenshot of the detection and steps to reproduce the detection?

7

24 security vendors and no sandboxes flagged this file as malicious
cf842eba8ecbed5e497d7ee9db6c7e4fc2277578c7ae02e0d484011819cd20a8
Chronicler_1.1.0.exe


https://www.virustotal.com/gui/file/cf842eba8ecbed5e497d7ee9db6c7e4fc2277578c7ae02e0d484011819cd20a8 

8

I deleted the download link for the program from my post as i do not want that publicly available.

 

9

 

Filename: Chronicler_1.1.0.exe

Threat name: Trojan.Gen.MBTFull Path: D:\Downloads\EtyBnvcRiJUWMKoLNgQx_Chronicler_1.1.0\Windows\Chronicler_1.1.0.exe

 

____________________________

 

____________________________

 

On computers as of 

1/30/2024 at 11:48:04 AM

 

Last Used 

1/30/2024 at 11:50:04 AM

 

Startup Item 

No

Launched 

No

Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.

 

____________________________

 

 

Chronicler_1.1.0.exe

Threat name: Trojan.Gen.MBT

Locate

 

 

Very Few Users

Fewer than 5 users in the Norton Community have used this file.

 

Very New

This file was released less than 1 week  ago.

 

High

This file risk is high.

 

 

____________________________

 

 

 

Downloaded File  from amazonaws.com

Source: External Media

 

Chronicler_1.1.0.exe

 

____________________________

 

File Actions

 

File: D:\Downloads\EtyBnvcRiJUWMKoLNgQx_Chronicler_1.1.0\Windows\Chronicler_1.1.0.exeRemoved

 

____________________________

 

 

File Thumbprint - SHA:

cf842eba8ecbed5e497d7ee9db6c7e4fc2277578c7ae02e0d484011819cd20a8

File Thumbprint - MD5:

38f6051d7124b873f5ffe152b15e4b35

10
nycDD:

I have a program I need for work that keeps showing up as malware and a trojan horse and gets removed by norton. 

 

Please tell us what Norton is telling you regarding this event.
For information regarding this event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste here.

For second opinion choose File &/or Search hash at VirusTotal 

 

11

Hello @nycDD
Welcome to Norton Community
`````````````````````````````````````````````

We'll try to call attention:

https://submit.norton.com/?type=CHECK&submission_id=aba6800e-04ca-412b-8e85-2efc2cbcbb88