Issue abstract: Norton deletes latest version of FFMEG
Detailed description: What about FFMPEG is a threat? Is there a safe way to use it?
Product & version number:
OS details:
What is the error message you are seeing?
If you have any supporting screenshots, please add them:
Norton 360 v22.x or v24.x?
Um, is this your FFMPEG?
https://www.ffmpeg.org/download.html
https://www.gyan.dev/ffmpeg/builds/
I’m not familiar with FFMPEG
I’m not familiar with XZ/GZ files
Extract with 7-Zip is asking for Password?
Is download free and publicly available?
Please point me to download source.
Delete on download?
Delete on execution?
Quarantine?
Please tell us what Norton is telling you regarding this event.
Norton may report two detections for same event.
Security History => More Options => Copy to Clipboard => paste here
Is Norton reporting WS.Reputation.1 detection?
Report a suspected incorrect detection to Norton
https://support.norton.com/sp/en/us/home/current/solutions/v126152382
Respond to incorrect Norton alerts that a file is infected or a program or website is suspicious
https://support.norton.com/sp/en/us/home/current/solutions/kb20100222230832EN
Submit a file or URL to Norton
https://support.norton.com/sp/en/ie/home/current/solutions/kb20090602171902EN
False Positive and False Negative Submissions Portal
https://submit.norton.com/?type=URL
I also filled out the false positive form.
It won’t let me include links but I downloaded from teh BtbN/FFmpeg-Builds and downloaded a ZIP file. I extracted the filed. Before execution I scanned FFMPEG.EXE and Norton said it was OK. At first NORTON deleted upon execution and the deleted (or perhaps quarantined all the .exe files.) I grabbed the latest version and tried again.
Category: Resolved Security Risks
Date & Time,Risk,Activity,Status,Recommended Action,Path - Filename
8/18/2024 12:39:02 PM,Medium,ffmpeg.exe (WS.Reputation.1) detected by Download Insight,Quarantined,Resolved - No Action Required,C:\Users\Daddy\ffmpeg\bin\ffmpeg.exe
Here’s the alert for FFMPEG from Security History
Category: Quarantine
Date & Time,Risk,Activity,Status,Recommended Action,Path - Filename
8/18/2024 12:39:02 PM,Medium,ffmpeg.exe (WS.Reputation.1) detected by Download Insight,Quarantined,Resolved - No Action Required,C:\Users\Daddy\ffmpeg\bin\ffmpeg.exe
Category: Download Insight
Date & Time,Risk,Activity,Status,Path - Filename
8/18/2024 12:18:24 PM,Medium,Download Insight analyzed ffmpeg.exe,Removed,c:\Users\Daddy\ffmpeg\bin\ffmpeg.exe
This same action happened for many other files: ffprobe.exe; ffplay.exe; post-proce-58.dll, etc
WS.Reputation.1 as name implies is reputation based detection - new file &or few users.
WS.Reputation.1 usually clears upon Norton gathering more telemetry.
Maybe, upload file to VirusTotal for second opinion.
I’ll try to find source.
Thanks
Um, one of these Zip files?
ffmpeg-master-latest-win64-gpl-shared.zip
ffmpeg-master-latest-win64-gpl.zip
https://github.com/BtbN/FFmpeg-Builds/releases
Um, is this the ffmpeg.exe file
File: ffmpeg.exe
File size: 410 KB (419,840 bytes)
MD5 checksum: E473BE142A6D538AF5D29820F9DD0DCE
SHA256 checksum: 84180A2A4F4AE8B685632DF2E1F407AB030AD48E1DC595A4401459FDADE09A0D
Filename: ffmpeg.exe
Threat name: WS.Reputation.1 Full Path: C:\Users\user\Desktop\ffmpeg-master-latest-win64-gpl-shared\ffmpeg-master-latest-win64-gpl-shared\bin\ffmpeg.exe
On computers as of
8/18/2024 at 6:34:21 PM
Last Used
8/18/2024 at 6:35:24 PM
Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe
ffmpeg.exe Threat name: WS.Reputation.1
Very Few Users
Fewer than 5 users in the Norton Community have used this file.
Very New
This file was released less than 1 week ago.
Medium
This file risk is medium.
https://objects.githubusercontent.com/github-production-release-asset-2e65be/292087234/7c2e621a-b90d-4ed9-91e0-42260747c873?X-Amz-Algorithm=[...]=ffmpeg-master-latest-win64-gpl-shared.zip&response-content-type=application/octet-stream
Downloaded File from githubusercontent.com
Source: External Media
ffmpeg.exe
File Actions
File: C:\Users\user\Desktop\ffmpeg-master-latest-win64-gpl-shared\ffmpeg-master-latest-win64-gpl-shared\bin\ffmpeg.exe Removed
File Thumbprint - SHA:
84180a2a4f4ae8b685632df2e1f407ab030ad48e1dc595a4401459fdade09a0d
File Thumbprint - MD5:
e473be142a6d538af5d29820f9dd0dce
Note: file is not known to VirusTotal…at this time.
https://www.virustotal.com/gui/file/84180a2a4f4ae8b685632df2e1f407ab030ad48e1dc595a4401459fdade09a0d
Thank you bjm. It looks like you copied the same zip file as I did from gpl-shared. The ffmpeg.exe in the not shared is a different size. I will say that Norton-360 moves this file to quarenteen almost as quickly as I can ge properties on it. 
Thanks. I’m hoping your False Positive submission clears all detected files…with this build.