locked
Errant Norton WS.Reputation.1 virus detection in WHS? RRS feed

  • Question

  • Hi group!  I thought this might be the best forum to ask this.  I am getting Norton/Symantec virus detection warnings on every file I download from a new Windows Home Server installation.  THe server has been online literally less than four hours, and I did install Norton Corporate AV on the server (the warnings on from another version of Norton on my laptop/client).  I would be surprised if this is real, but just wanted to check...

    Is anyone having virus problems, particularly WS.Reputation.1 problems, and even more particularly with Norton Security Suite (my version is 4.1.0.32)?

    As soon as I download files from my Home Server in exe format, Norton reports the following virus and wisks my downloaded file away into the ether:

    • music.exe (WS.Reputation.1)
    • This Insight Network Threat has been removed.
    • Activity:  File C:\users\...\music.exe removed

    I actually just installed Norton Security Suite on my laptop this morning (comes as part of my Comcast ISP subscription), and it looks like Norton Security Suite is acting up.  I saw this post and relaxed a bit:

    http://community.norton.com/t5/Norton-Internet-Security-Norton/What-is-WS-Reputation-1/td-p/228251/page/9;jsessionid=AF17916CB8F6BB1E91E042C5F36B0D14

    Anyone else having this problem?
    Thursday, May 20, 2010 7:22 PM

All replies

  • Well, a file named music.exe sounds strange and should usually not exist on your server. Was it an example or a real file? (Malware tends to use such names to get clicks. Such files are often relatively small in size.)

    What exactly do you mean with downloading from a home server installation? Do you logon locally on the server and use it's Internet Explorer? This is not supported and may expose your server to malware infections, especially as it was not patched up.

    Or do you mean download files from the server shares? What happens, if you zip the exe files, download them, extract them? Are they still determined as infection?

    Norton AV is not available in a version for Windows Home Server. If Antivirus Software is not aware about some special behavior on WHS, it may either not work properly or badly interact with some WHS mechanics. AV Software designed for WHS is not so much available on the market - several people use the package from Avast. So where is Norton running, on the server or on the client?

    Last but least it is always possible (besides a false alert), that you have one or more infected machines in your network (including the router in some cases), which would be capable to spread out this infection to the server as soon, as it appears in your network unpatched.

    Best greetings from Germany
    Olaf

     

    Thursday, May 20, 2010 8:36 PM
    Moderator