Hello!
Long time reader, first time caller : )
The Issue In Brief :
Automatically-generated PDF’s of Wikipedia articles ( presumably a SAFE site ) are suddenly being regularly flagged by Norton 360 as containing Phishing Malware. Is this realistic, or could it be a false positive…?
The Issue In Detail :
For many years now, we have at times downloaded articles as .pdf’s from Wikipedia,
via that website’s “Tools > Download as .PDF” option
(which is available at the Top-Right corner of any article page at that site.)
Here are two examples :
articles :
https:// en.wikipedia .org/wiki/Knight_Bachelor
https:// en.wikipedia .org/wiki/Braess’s_paradox
while their respective ‘pdf download’ pages are at :
https:// en.wikipedia .org/w/index.php?title=Special:DownloadAsPdf&page=Knight_Bachelor&action=show-download-screen
https:// en.wikipedia .org/w/index.php?title=Special:DownloadAsPdf&page=Braess%27s_paradox&action=show-download-screen
(tech note : two blank spaces have been added to each of the above url’s to avoid them turning into hyperlinks, in case it causes problems to this post - remove the spaces to go to the relevant pages)
Lately, MANY such downloaded articles have begun to be flagged as
[L] PDF:MalwareX-gen [Phish] (0)
by Norton 360 scans
(current version : 26.2.10802, with latest definitions, etc…
but we have noted this problem in ALL earlier versions going back at least 6 months now.)
Such files are flagged during scans IF they have been downloaded on another computer,
and are then copied to the machine which has Norton installed on it ;
OR,
if a download attempt is made ON the Norton machine itself,
then one of (at least) two things will happen :
a) the download is aborted and the file cannot be downloaded at all
(see screenshot 1 with notes below)
or :
b) the downloading file is sent to quarantine,
and the event log then describes the file as having been “repaired” (?)
(see screenshot 2 with notes below)
Such .PDF download attempts always get flagged from certain Wikipedia articles,
(even after the articles themselves periodically get altered by editors within Wikipedia itself),
while pdf’s from other articles never seem to get flagged.
We are unsure how a legitimate website such as Wikipedia can be flagged for creating phishing pdf’s…?
Our initial thought was that perhaps certain hyperlinks within them are being regarded as dangerous…
but this is almost certainly NOT the case, because whenever we use the browser’s basic :
Right-Click > ‘Print as PDF’ option
in order to simply have the browser itself create a direct .pdf of the same article
(which creates a resultant file containing essentially the SAME INFORMATION as the downloaded one : namely SAME text + SAME images + SAME hyperlink references, etc…),
Norton does NOT flag these ‘printed’ .pdf’s as containing any threats…(!?)
(see screenshot 3 with notes below)
We know that we can upload the problematic files to support .norton .com
however what we would first like to ask is if other Community Members,
and especially the Norton Administrators here,
could attempt this for themselves with the two articles which we have noted at the top of this post, i.e. if you can test the issue ‘first-hand’, as it were,
and see if any of you are getting the same results :
Since this is happening both during downloading AND with imported files from other machines
(ie with different article versions AND different Norton versions over a period of several months),
this suggests to us that the problem may not be isolated to our OS configuration,
but that it is a wider issue.
Thank you for now, and we will be watching this thread for hopefully any developments!
Kind Regards,
NN
Screen Shots :
-
