11–20 of 45 posts
Earlier quoted context omitted.
Signing doesn't always solve the problem.
Signing should allow reputation from previous versions to apply to updates, if implemented correctly by the antivirus vendor.
First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight")
This goes directly to the team and they should have your programs whitelisted within a few business days.
Second: sign your executables. This goes a long way. And no, it doesn't have to be Verisign.
Third: don't change domains. This wiped out your known reputation. (Would have been acceptable if your binaries were signed)
Symantec is not out to squish the little guy. Sometimes you do have a few more hoops that you are required to hop through. Symantec should have better transparency on how this process works, it's something I pushed for pretty heavily but never had the power to get done.
Don't worry, you're not alone. Example: We weren't able to get Mozilla to sign their beta or developer builds that are shared on multiple mirrors (domains not related to mozilla). We'd get lots of angry (understandably) reports of reputation issues on these builds.
If anybody has any questions within reason, I'll be glad to answer them.
I've had issues with multiple AV companies that pertained to binary-string signatures in my code. The AV companies I've dealth with all seem to have online ticketing systems that allowed for rapid correction of these situations.
A few months ago, I found that a command-line screen-capture tool that I publish was flagged as malware by multiple AV products due to behavioral characteristics.
In ScreenKap, I was experimenting with obfuscation of text-strings used by the code. I removed the obfuscation from the code and resubmitted to VirScan.org. I received a clean bill of health.
Note that I did not formally pursue this with any of the AV companies as the string obfuscation was an experiment and was nothing that needed to remain an integral part of my product. If my assumption is correct ( please note that it is an assumption ), we might be restricted to coding in the way the AV companies think we should code.
I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…
In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because you're the ones who added this reputation system that's causing users grief. Record known-good SHA or MD5 sums of unsigned apps like Firefox that you know are okay, for example. Or just not default this feature on.
When I used to write Windows software, Authenticode signing solved this sort of issue. Does that no longer work?
I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…
This is the reason I dropped Norton 360, a product I was given for free from work. I'm just using MS security essentials now which is free and less robust but it actually allows me to run programs on my computer, which is a nice feature.
I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…
What about the user, how can they run an untrusted executable? I never figured this out when I ran into this problem. This is the reason I dropped Norton 360, a product I was given for free from work. I'm just using MS security essentials now which is free and less robust but it actually allows me to run programs on my computer, which is a nice feature.