IE Bar add-on quarantined by Notron Anti-virus 2010

Add-in Express™ Support Service
That's what is more important than anything else

IE Bar add-on quarantined by Notron Anti-virus 2010
My IE Bar add-on and the AdvancedSearch IE Bar sample were both suspected of containing a threat (WS.Reputation.1) and were quarantined. 
mgentile




Posts: 2
 Joined: 2008-03-06
The report below is from Notron Anti-virus 2010
---------------------------------------------------------

Threat: advancedsearch.dll (WS.Reputation.1)

c:\users\mgentile\appdata\local\microsoft\windows\temporary internet files\virtualized\c\users\mgentile\appdata\local\assembly\dl3\6gv4z5e0.3xh\oh94dt6g.xeg\bab6fb1d\12f2dc17_1ef9ca01\advancedsearch.dll
____________________________
____________________________
On computer as of
5/21/2010 at 3:45:04 PM
Last Used:
5/26/2010 at 11:28:09 AM
Startup Item: No
Launched: No
____________________________
____________________________
Very Few Users
Fewer than 10 users in the Norton Community have used this file.
____________________________
Medium
This file risk is medium.
____________________________
Threat Details
There are many indications that this file is untrustworthy and therefore not safe
____________________________
Origin

Downloaded from Not Available
____________________________
URL Not Available
UNTESTED

Source
advancedsearch.dll
____________________________
File Actions
Loaded process: c:\users\mgentile\appdata\local\microsoft\windows\temporary internet files\virtualized\c\users\mgentile\appdata\local\assembly\dl3\6gv4z5e0.3xh\oh94dt6g.xeg\bab6fb1d\12f2dc17_1ef9ca01\advancedsearch.dll
Repaired
____________________________
File Thumbprint:
Not Available
____________________________
Posted 26 May, 2010 17:29:40 Top
Sergey Grischenko


Add-in Express team


Posts: 7233
 Joined: 2004-07-05
Hello.

We can't reproduce it in our environment. But you can try to sign all files of your add-on with a digital signature. I think it should help.
Posted 27 May, 2010 04:52:07 Top
Andrei Smolin


Add-in Express team


Posts: 18830
 Joined: 2006-05-11
Mark,

We've never got such reports.

Can you please send us two assemblies: your add-on and the advancedsearch.dll built on your PC? We will check them with both Kaspersky and Norton. Also we will send the files to Norton. Currently we assume that this is a false positive. Also, this may be caused by something on your PC.

Find our support e-mail address in readme.txt. Please make sure your e-mail contains a link to this topic.


Andrei Smolin
Add-in Express Team Leader
Posted 27 May, 2010 07:03:13 Top
Andrei Smolin


Add-in Express team


Posts: 18830
 Joined: 2006-05-11
Mark,

1. Kaspersky didn't find anything in those files; they claim they detect more viruses and threats than any other avtivirus software.

2. It looks like Symantec accepts suspected files from their customers only. I suggest that you send the files at http://www.symantec.com/business/security_response/submitsamples.jsp.

3. I've found http://community.norton.com/t5/Norton-Internet-Security-Norton/What-is-WS-Reputation-1/m-p/228592. It looks like the "WS.Reputat​ion.1" issue is caused by a problem in Norton. I have an impression that it is solved so you can try updating your antivirus and re-check the files.

May I ask you to keep us informed on the issue?


Andrei Smolin
Add-in Express Team Leader
Posted 28 May, 2010 08:30:14 Top
mgentile




Posts: 2
 Joined: 2008-03-06
Andrei,

Thank you for looking into this. I agree. It looks like a Symantec issue. I will submit the assemblies to Symantec and keep you informed.

Best regards,
Mark Gentile
Posted 28 May, 2010 11:42:24 Top