Installer seen as virus to Norton and Chrome.

iarp · 9th March 2012, 16:38

I have an installer that's almost done, I've been doing hundreds of tests on my vmimages that don't have anti-virus and when i run it on my machine with Avast it runs fine.

Norton sees it as a virus and auto-deletes it. Chrome won't let me download it without "malicious" messages..etc

I'm not sure what i can do to change this so they don't see it as such.

According to virustotal.com Kaspersky sees it as "HEUR:Trojan-Downloader.Win32.Generic" and one other sees "W32/Downloader" but the rest only show "-"

Anders · 9th March 2012, 16:53

https://submit.symantec.com/false_positive/
and for Chrome, maybe http://code.google.com/apis/safebrow...#ReportingData

iarp · 10th March 2012, 21:32

Ya I had thought about doing that, but I have to change and update the program so often that it wouldn't matter.

I changed from NSISdl to inetc and only kaspersky complains according to virustotal.com and norton no longer auto-deletes the file upon download.

LoRd_MuldeR · 11th March 2012, 13:29

The best you can do here is to inform your users!

Tell them that FALSE POSITIVES can occur and that this is a FAILURE in the specific a/v software, so only the a/v developer can fix it...

(If only more users reported false positives or dump buggy a/v software, the developers would have take more care)

9th March 2012, 16:38	#1
iarp Junior Member Join Date: Mar 2012 Posts: 2	Installer seen as virus to Norton and Chrome. I have an installer that's almost done, I've been doing hundreds of tests on my vmimages that don't have anti-virus and when i run it on my machine with Avast it runs fine. Norton sees it as a virus and auto-deletes it. Chrome won't let me download it without "malicious" messages..etc I'm not sure what i can do to change this so they don't see it as such. According to virustotal.com Kaspersky sees it as "HEUR:Trojan-Downloader.Win32.Generic" and one other sees "W32/Downloader" but the rest only show "-"

9th March 2012, 16:53	#2
Anders Moderator Join Date: Jun 2002 Location: ${NSISDIR} Posts: 5,449	https://submit.symantec.com/false_positive/ and for Chrome, maybe http://code.google.com/apis/safebrow...#ReportingData IntOp $PostCount $PostCount + 1

11th March 2012, 13:29	#4
LoRd_MuldeR Major Dude Join Date: Sep 2005 Location: Somewhere over the Slaughterhouse Posts: 797	The best you can do here is to inform your users! Tell them that FALSE POSITIVES can occur and that this is a FAILURE in the specific a/v software, so only the a/v developer can fix it... (If only more users reported false positives or dump buggy a/v software, the developers would have take more care) My Plugins: StdUtils \| NSISList \| CPUFeatures \| ExecTimeout \| KillProc My source of inspiration: http://youtu.be/lCwY4_0W1YI

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

10th March 2012, 21:32	#3
iarp Junior Member Join Date: Mar 2012 Posts: 2	Ya I had thought about doing that, but I have to change and update the program so often that it wouldn't matter. I changed from NSISdl to inetc and only kaspersky complains according to virustotal.com and norton no longer auto-deletes the file upon download.