{"id":479,"date":"2011-05-24T08:09:48","date_gmt":"2011-05-24T13:09:48","guid":{"rendered":"http:\/\/www.mindworkshop.info\/?p=479"},"modified":"2023-07-17T20:41:24","modified_gmt":"2023-07-18T01:41:24","slug":"the-norton-symantec-ws-reputation-1-false-positive","status":"publish","type":"post","link":"https:\/\/blog.mindworkshop.com\/?p=479","title":{"rendered":"The Norton \/ Symantec WS.Reputation.1 False Positive"},"content":{"rendered":"

\"picture\"System security \u2013 keeping your computer adequately defended against viruses, malware and other barbarians at the gate \u2013 is a complex and oftentimes bedeviling problem. Too little security will find you part of a botnet, or providing your credit card information to every hacker in Afghanistan. Too much security will make your computer excessively paranoid, to the point of your not getting anything useful done with it.<\/p>\n

You can render your system wholly impervious to infection by software viruses by the simple expedient of switching it off and leaving it that way \u2013 but this is hardly a workable resolution to the issue for most of us.<\/p>\n

If you use Norton Antivirus to defend your computer against the machinations of cybercretins, you may have encountered a particularly intractable issue upon installing new software or updates, such as the ones made available for our products. Norton might alert you to a threat it refers to as WS.Reputation.1 when you download the installers in question\u2026 and then delete or quarantine your downloads.<\/p>\n

<\/p>\n

In fact, WS.Reputation.1 isn\u2019t a virus. It\u2019s not even a particularly tangible threat. It will, however, likely make you nervous and twitchy, and deny you access to a lot of downloadable products and updates thereto until you come to appreciate what it\u2019s up to.<\/p>\n

You\u2019re Not Going to Believe This…<\/h6>\n

While Symantec isn\u2019t entirely forthcoming as to the details of this feature of its security products, you can find a brief description of it at the Symantec web page<\/a>. Norton appears to keep track of the frequency with which its users install downloadable products. As the number of users who download and install specific products increases, so too does the \u201creputation\u201d of the installers in question.<\/p>\n

When you attempt to download and install software with Norton Antivirus running, your downloaded installer will be compared against Norton\u2019s reputation database. Installers without a sufficient \u201creputation\u201d in this regard will cause Norton to display a warning \u2013 an example of which is illustrated at the beginning of this post \u2013 and remove your download before it can be installed.<\/p>\n

A low reputation score in the eyes of Norton doesn\u2019t indicate that there\u2019s anything potentially nasty about downloaded software… only that it\u2019s sufficiently new as to have been downloaded and installed by relatively few other users.<\/p>\n

It\u2019s important to keep in mind that Norton Antivirus isn\u2019t actually looking at the contents of the software it surveys for its reputation check. It just generates a unique key value for each installer, and counts the number of times the same file is downloaded. As such, it doesn\u2019t appear to know, for example, that our GIF Construction Set Professional software has been around since 1995. As far as it\u2019s concerned, every update of GIF Construction Set is a new product, and on the day it\u2019s released it has a reputation score of zero.<\/p>\n

No Way Out<\/h6>\n

As of this writing, Symantec doesn\u2019t appear to offer a workable avenue for software developers such as ourselves to prevent uncounted thousands of our users from being frightened by spurious WS.Reputation.1 alerts. Upon digging into the issue, we did find a form at the Symantec web site that allows the subjects of unwarranted WS.Reputation.1 alerts to apprise Symantec of their benign nature. However, in our experience it takes about a week for whoever\u2019s reading the postings to this page to respond to them, during which time the installers in question will have attained a sufficient reputation score to shut down Norton\u2019s WS.Reputation.1 alerts\u2026 after having agitated a great many of our users, and scared away lots of potential new customers, of course.<\/p>\n

We invariably receive the following message in response to a submission to Symantec\u2019s WS.Reputation.1 page:<\/p>\n

The Symantec Insight Dispute team has reviewed your recent submission to the Insight Dispute Submission form Webpage form for \"GIF Construction Set Professional 4.\" Our analysts have not been able to reproduce the issue your report. Our test show that the program you submitted has a good reputation. This could be because the status of this program changed automatically between the time you submitted and now. <\/p>\n

We have concluded our research of your submission and will take no further action.<\/code><\/p>\n

This is a somewhat vexing problem, and as far as we\u2019ve been able to determine, one without a solution. It\u2019s been vexing a lot of Norton\u2019s users, too, as can be seen at the Norton support forum<\/a>. This thread runs for miles, and gets progressively more incendiary as users of the Norton Antivirus learn what the WS.Reputation.1 alert represents, and why they\u2019ve been made to jump through so many hoops over so questionable a threat.<\/p>\n

There doesn\u2019t appear to be a way to disable WS.Reputation.1 checking in Norton Antivirus.<\/p>\n

We don\u2019t use Norton Antivirus in house, and as such, we\u2019re unable to provide specific assistance with its operation.<\/p>\n

All the software that\u2019s uploaded to our on-line servers is checked with AVG, which is widely regarded as the \u201cgold standard\u201d in virus-checkers. It\u2019s also an extremely well-designed security application, in that it will permit itself to be configured to disable those of its options you feel are excessively paranoid. <\/p>\n

If you encounter a WS.Reputation.1 alert when you attempt to download something from one of our servers, we recommend that you disable Norton Antivirus, and download the installer again to work around the problem.<\/p>\n

Afterword:<\/strong> Shortly after the initial release of this posting, someone from Symantec contacted us, offering to assist us in resolving the WS.Reputation.1 issue. While this is still something of a work in progress, he offered the following advice for users of Norton Antivirus.<\/p>\n

A couple of options are immediately available to any of our common customers who see the problem. The file is not deleted, but rather stored in quarantine. So the user can restore it from quarantine it. Insight will not attempt to remove it after that. <\/p>\n

To avoid the issue on a download, the technology itself can be turned off. In the UI the technology is called Download Intelligence… knowing that that is the name of the technology, a user can from the main UI easily turn off Insight for the time needed to download a file.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

System security \u2013 keeping your computer adequately defended against viruses, malware and other barbarians at the gate \u2013 is a complex and oftentimes bedeviling problem. Too little security will find you part of a botnet, or providing your credit card information to every hacker in Afghanistan. Too much security will make your computer excessively paranoid, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-479","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=\/wp\/v2\/posts\/479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=479"}],"version-history":[{"count":0,"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=\/wp\/v2\/posts\/479\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mindworkshop.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}