WS.Reputation.1 - is this the best they can come with?

I just found out that Norton labels any new sofware as WS.Reputation.1 VIRUS and deletes it after the download.

 

Please can some here answer these questions?

 

1. How Norton users will get to a perfectly fine new file if it is labeled as virus and deleted? 

2. Why Norton ruins businesses by labeling perfectly fine new version of software as virus?

3. Why is Norton LYING to his paying customers and robs them from ability to try and use perfectly fine software?

4. Is that the best they can think of?  Taking customers money for nothing is that the new Norton business model? 

5. Do you pretend to have reputation by scaring people with nonsense and lying about other vendor files and labeling them WS.Reputation.1 ?

 

They have invented this name WS.Reputation.1 to sound like a virus. On their own qweb site they explain they use that label when they DO NOT KNOW ANYTHING ABOUT THE FILE! How can you label file as virus if you acknowledge you do not know anything about it?  Are you running a little scam here?

 

The file in question is posted here:

http://rcflightsim.com/download.html

and NORTON lsten, this file DOES NOT HAVE A VIRYS!

 

PLEASE FIX this right away.

 

I just found out that Norton labels any new sofware as WS.Reputation.1 VIRUS and deletes it after the download.

 

Please can some here answer these questions?

 

1. How Norton users will get to a perfectly fine new file if it is labeled as virus and deleted? 

2. Why Norton ruins businesses by labeling perfectly fine new version of software as virus?

3. Why is Norton LYING to his paying customers and robs them from ability to try and use perfectly fine software?

4. Is that the best they can think of?  Taking customers money for nothing is that the new Norton business model? 

5. Do you pretend to have reputation by scaring people with nonsense and lying about other vendor files and labeling them WS.Reputation.1 ?

 

They have invented this name WS.Reputation.1 to sound like a virus. On their own qweb site they explain they use that label when they DO NOT KNOW ANYTHING ABOUT THE FILE! How can you label file as virus if you acknowledge you do not know anything about it?  Are you running a little scam here?

 

The file in question is posted here:

http://rcflightsim.com/download.html

and NORTON lsten, this file DOES NOT HAVE A VIRYS!

 

PLEASE FIX this right away.

 

Hi skirtz:

 

Welcome to the Norton Community.

 

In addition to PapauZ's post, I would like to also suggest that you read the following -

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/Clarification-on-WS-Reputation-1-detection/td-p/232155

 

Let us know if this helps you.

 

Thanks,

 

Atomic_Blast :)

Hi skirtz:

 

As Papauz mentioned, false positives for legimate software shouldn't happen very often - I've only seen two in the four years I've had NIS installed on my computer.

 

Forum administrator Tony Weiss has posted an excellent article here titled Clarification on WS.Reputation.1 Detection which includes:

  • A link here where software developers can submit a Software White-Listing Request to ensure software is tested and white-listed prior to release
  • A link here where home users can submit a report for Detection of a Suspected Clean FIle (False Positive) if they believe their download is safe and would like the file tested and added to the whitelist
  • Instructions for recovering quarantined files and/or creating a scan exclusion in your configuration settings (Settings | Computer Settings | AntiVirus and SONAR Exclusions) if you are certain your file is safe and don't want to wait a few days for the results of a False Positive report.

You may be having problems with the ClearView RC Flight Simulator download either because the software developers neglected to submit their file to Symantec for verification, or because you are one of the first users in the Norton communtiy to download this file, which triggered Norton Insight to flag this file as "untrusted" due to the lack of information about its safety.  As more users in the community download this file, the background Norton Insight task that runs automatically during system idles should automatically update the application rating from "untrusted" to "trusted" and allow the download to go through. You can also perform a manual update of your trust ratings at any time at Performance | Application Ratings.

 

If you don't want to wait for the application trust rating to be updated, you can always file a False Positive report or simply create a scan exclusion for this particular file as PapauZ already suggested.

---------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 8.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

>As more users in the community download this file, the background Norton Insight task that runs automatically during system idles should automatically update the application rating from "untrusted" to "trusted"he hell ao re they t

 

How can more users download the new program version if the download is deleted? How STUPID this can be?

 

Why the hell I have to whitelist my programs with Symantec? Is this some form of corporate racket? Are you guys hired here to spread more of these lies? You have not respondet to a single of my questions. 

 

This is GARBAGE \and IT STINKS.  Norton is lame piece of garbage and that is why they invented WS.Reputation.1 

 

Instead of a simple warrning that the file is new they lie it is a virus!  Why don't just warn the user the file is new?

Because your have run out of ideas how to make good security software and now you make CORPORATE GARBAGE.

 

Microsoft Security Essentials and AVG are free and work better than the demented software you shill around. 

Your lame Norton software should be deleted because it is  WS.Security.Scum.Bag.#1

 


skirtz wrote:

Microsoft Security Essentials and AVG are free and work better than the demented software you shill around.


Microsoft also employs reputation based security in MSE and Internet Explorer 9:

 

http://blogs.technet.com/b/mmpc/archive/2011/03/23/building-reputation-with-microsoft-security-essentials.aspx

 

http://blogs.msdn.com/b/ie/archive/2011/05/17/smartscreen-174-application-reputation-in-ie9.aspx

 

 http://blogs.msdn.com/b/ie/archive/2011/03/22/smartscreen-174-application-reputation-building-reputation.aspx


 skirtz wrote

    How can more users download the new program version if the download is deleted? How STUPID this can be?...

 

   Are you guys hired here to spread more of these lies? You have not respondet to a single of my questions.

 

 


 

Hi skirtz:

I'm not sure if you're really interested, but here goes:

Norton products include a feature called Norton Community Watch (NCW) that sends regular reports back to Symantec about installed applications, threat detections, etc. that will flag if a new application receives a high number of download blocks so that Symantec can take the appropriate action.  Users can disable NCW if they don't want this type of feedback automatically sent to the Symantec servers.

 

Usernames for Symantec employees are displayed in bold red font when they post in the forum.  The rest of us are regular (and definitely unpaid) users.

 

If you're unhappy with your Norton product and recently purchased a subscription you could try contacting Norton Customer Support and asking them for a refund.  Contact information can be found here at the bottom of the web page.

---------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 8.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

 

Microsoft actually detects "bad" application by flagging unwanted or suspicious behavior AFTER analysing and tracing the application. Norton, on the other hand states (on its ow n web site) that if an application is new, it gets assigned WS.Reputation.1 and users are blocked from using the application. In other words, you block ANY new application as a virus!

 

The first is a scientific based approach and the second is LAME attempt to badmouth ALL new programs just because they are new. The next step you can take is to disable Windows from installing ANY program - that will make it safe, based on your demented logic. In that case, what is the Norton value to the users who pay for it? - NONE!

 

The fact is, when you label an application with WS.Reputation.1 you DO NOT KNOW anything about the application, because it is new and your lame software CAN NOT TEST it properly. Application is either GOOD or BAD (malicious). You do not have the technology to tell if it is good or bad, so you tell IT IS BAD (malicious) BECAUSE it is NEW. This reasoning shows:

 

1. Poor judgement, because you label good apps as viruses.
2. Bad technology because you can't really tell good from bad application
3. Bad corporate moral when you libel other perfectly fine products as viruses.

 

 

Hi stirtz:

 

Everything has been nicely explained to you.

Your points have been noted and logged.

 

I would like to suggest that you post your ideas here.

Your opinion would be more highly valued if you refrained from questionable language.

 

Happy Holidays!

 

Atomic_Blast :)

It will be responsible if you can report here of CONCRETE steps taken to remove this QUESTIONABLE behavior. You can not pretend to be "defender" from viruses if your own application acts as a virus.  WS.Reputation.1 is a CORPORATE LIE designed to trick users you are doing something of value for them, while you are deploying poor logic and represent to the user ANY new application as a virus.  You may not like my language, but I speak the truth. Norton actions related tpo invented WS.Reputation.1  are despicable, and I do not see here any attempt to fix this. I hope some other company sue you for libel and gets your questionable shop closed for good. 

skirtz-

 

I'm sure you would get much more help that you want if you would stop being mean and rude to the people who are trying to help you. all your saying is that you hate nortons because it detects your software as a virus and people are trying to help you out and tell you how you can fix then but you just want to be mad. nortons doesn't detect anything new as a virus. there are tons of other things that is basis the decision on. im sure you could get help to fix the problem so you dont have to deal with it again if you would start welcoming peoples help with a more friendly additude. were all volunteers here and want to help people out. dont get mad at us for trying to make things better for the people who have you're software. ;]


whiplash wrote:

skirtz-

 

. nortons doesn't detect anything new as a virus.


Yes,it does.

create a new exe with any compiler you want. download insight will quarantine it as WS.Reputation.1

whitelisting idea behind reputation-based detection method is respectable but moving files into quarantine is a little bit aggressive decision.:smileywink:

 

Hi H_H_86,

 

Are you talking about files that have been digitally signed?

Hello folks.  Sorry to jump into this thread, but I feel compelled to express my opinion.  I'm sure I'm not alone in being glad the Forum is here and for all the good suggestions and solutions offered by other members and the moderators - your efforts are appreciated.  With that in mind, perhaps this thread should have been closed several replies earlier.  It's one thing to be frustrated over a problem, but quite another to be disrespectful of others and to berate their help and the Norton products.  I do offer one final solutions - go back to your free applications if you feel they're better.  There's no one stopping you from changing.  However, if you truly want to use Norton, calmly give the Forum and Symantec folks a chance to help - you just may be surprised by the results.

 

BC 


SendOfJive wrote:

skirtz wrote:

Microsoft Security Essentials and AVG are free and work better than the demented software you shill around.


Microsoft also employs reputation based security in MSE and Internet Explorer 9:

 

http://blogs.technet.com/b/mmpc/archive/2011/03/23/building-reputation-with-microsoft-security-essentials.aspx

 

http://blogs.msdn.com/b/ie/archive/2011/05/17/smartscreen-174-application-reputation-in-ie9.aspx

 

 http://blogs.msdn.com/b/ie/archive/2011/03/22/smartscreen-174-application-reputation-building-reputation.aspx


Microsoft Internet Explorer 9's SmartScreen Filter doesn't like this file either:

 

IE9 Security Warning - ClearView RC Flight Simulator.PNG

 

Clicking the 'Actions' button on the warning above presents the following options:

 

IE9 Smart Screen Filter - ClearView.png

 

Ideally, skirtz should upload this file to Virus Total and report back the results

 

Current Norton File Insight information below for future comparison with Virus Total results:

 

Full Path: c:\users\public\downloads\clearviewsetup534n2.exe
Threat: WS.Reputation.1
____________________________
____________________________
On computers as of Not Available
Last Used 24/12/2011 at 8:17:47 AM
Startup Item No
Launched No
____________________________
____________________________
Unknown
Number of users in the Norton Community that have used this file: Unknown
____________________________
Unknown
This file release is currently not known.
____________________________
Medium
This file risk is medium.
____________________________
Threat Details
Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe
____________________________
http ://s3.ama(URL removed)
____________________________
File Actions
File: c:\users\public\downloads\clearviewsetup534n2.exe
Removed
____________________________
File Thumbprint - SHA:
c5e14d0145a9a002dcf788a762e8bbd5c754142b729d9ee512025c9bbc155309
____________________________
File Thumbprint - MD5:
342801359da9e7d628ba5019d2841cf9
____________________________


SendOfJive wrote:

Hi H_H_86,

 

Are you talking about files that have been digitally signed?


Hi SendOfJive ,

 

not exactly. i have some safe VB-Delphi executables . they got WS.Reputation.1 label

another possible SONAR FP appears by using Delay or Sleep commands in compiler:robotlol:

 

Unknown new executables that are not digitally signed are very apt to be detected by reputation-based security.  That does not mean that all new files are blocked, as some are suggesting.

I submit many do not know the algorithms used by Insight.  As such, I offer an anecdotal example:

 

A software vendor offers a program for download.  Due to it being new to the scene, the program is quarantined.  Over time, somehow, the program, (which is updated fairly frequently), was no longer quarantined.  Perhaps out of frustration, one of the quarantines was left encaged and forgotten about. And out of the blue, the encaged file was released unannounced.  Then, a few months later, the program with the same file name and downloaded from the same source, the vendor, regains the Reputation staus and is quarantined again.  Having seen this transpired for this one program through the course of two years , imagine what must be going on, or not, behind the scenes.

 

If as suggested that the vendor submit for whitelisting by Insight, that imposes added workload.  And should other security firms put their whitelisting toll guards in place with their additional digital paperwork, oy vey!!

 

Let's not forget the fable of "The Boy Who Cried Wolf".  I saw a wolf (which sent the village into defcon 0) versus I (the untrained boy) think I saw what looks like a wolf.  Quarantine versus a well-worded warning about a "new" program known only to very few Norton users who bothered to participate in Community Watch.