Bug Report: Overcoming Norton IS/Finds Virus

[Race]

Hello, I downloaded and tried to install the Gehn shard when Norton found it to be a threat and just wiped it off without asking me what to do, is there a way around it and why is Norton finding something bad in there?

[Boywhith]

Hi Race,

I have had the same experience..
So I could not install it neither. I hope someone who knows a solution, will read this.

Greetings,
Boywhith.

[Branan]

This is unfortunately a very common issue with the big AV companies, and getting support for false positives is very hit or miss. The AV vendors typically don't have a way for small developers like us to work with them to avoid these sorts of problems. My suggestion is to try to figure out how to make your Norton ignore the program (which I can't help with - every version of Norton is different). Another alternative is simply to get a different antivirus program. You probably have access to one through your ISP, and there are a number of very decent free options available.

You can also submit the false positive to Norton, if you'd like: https://submit.symantec.com/false_positive/. Like I said above this is very hit or miss, but it can't hurt.

As for why Norton is finding something bad: I have no idea. Different versions of Norton have different criteria they look at. I'm running Norton Security Suite 4 and it is not flagging Gehn as a bad program, but I've seen other versions of Norton delete simple test programs immediately after I build them just because it's never seen them before.

[Boywhith]

Thank you Branan, for your quick reply.
I will try to to make Norton to react more 'friendly' on the Ghen shard program.

Greetings,
Boywhith.

The solution: simply inactivate Norton. Than you can download the installer. After done that, reactivate Norton again, and... ready!

[Race]

Well I just disabled IS for 15 minutes and it let the program download, I am installing now. Not sure what happens when I switch it back on tho, I will keep this posted!

EDIT: I have it installed but it just hangs at Logging into Uru, please wait....

[semplerfi]

I had Norton burp a file on the setup too. (a ".TMP" file was flagged)

In Norton - look for "Security History", then look for "SONAR Activity", in that list will probably the offending file. Look for "More Details", then look for "Options", then look for 'restore' & 'ignore' file.

If you don't tell Noron the file is Ok it burp it again when restoring Norton.

[gchaser]

I'm trying to download the Gehn Shard installer (I have Norton AV) and Norton blocks the download......WS.Reputation.1 is the reason. Has anyone else experienced this, and how do I get around it....? Thanks......

[johnsojc]

Right click in the Norton icon in the system tray and select "Disable Antivirus Auto Protect" (I usually set it to last until next reboot... you can always turn it back on manually). I recall having to recover the quarantined file and telling it to run anyway or actions similar to that. Read the popups carefully and you should be able to make it work.

The problem is the the way Norton handles new files that run executables... this file appears as a new file with a low count of reports of use in Norton's DB. This makes it suspect by their rules. You can petition Norton to remove this restriction but I'm not sure it's worth the effort.

[Branan]

I've been doing more reading about this, and I think it might be preferable for affected users to try to un-quarantine the file rather than disabling their antivirus during the install. Not only is this safer for you, it will help Norton's system to realize our installer is a useful application with real users.

[johnsojc]

I did try this but it seemed to continue to block me so I was forced to disable my Antivirus (Your experience may differ... )

IIRC, the file came down as something.tmp which was immediately grabbed and deleted (moved to quarantine). I recovered it but I still was forced to try again where it was again blocked even though I said to exclude it from being checked. It was at that point I turned off the Antivirus as a last resort. It was still blocked but I was then able to recover and run it. I was more interested in getting the client installed than figuring out how to bypass Norton which does this to many very new install files.