Norton flagging and deleting infected files

[TomK 1]

Hi,

I don't know if this is part of the SC4 Devotion  server issues, but I've had Norton flag and delete several downloads from SC4Devotion recently.  This may be unrelated, but if you have virus infected files on a server, odds are you have bigger problems. Attached are two of the infected zips.  

THE ATTACHED FILES ARE INFECTED SOURCE FILES DOWNLOADED FROM SC4 DEVOTION , DO NOT UNZIP!  SCAN W/ NORTON ANTI-VIRUS OR SEND TO NORTON FOR ANALYSIS

Mod Edit: I have removed the attachments. @rsc204

[rsc204 21,866]

14 hours ago, TomK said:

I've had Norton flag and delete several downloads from SC4Devotion recently.

This is likely a phenomenon called "False Positives". Rather than actually scan files and check if they have problems, suites like Norton just flag everything unless it's white-listed. Meaning anyone creating files that are not being used by potentially millions of people, will run afoul of this problem.

This issue has come up more than once and it boils down to, Norton/third parties they work with, want money to add a site to their white-list. By inconveniencing us (blackmail of a sort), they hope to get their cheque some day. But, being a not for profit hobby site, we could never justify paying the fees. So every so often, someone comes by raising the (false) alarm and we have to explain the problem once more.

How can you check if these files are actually infected? Well an independent site, Virustotal.com, was set up just for these situations. Upload the files there, it will test them with every major anti-virus out there and give you the results. Don't be surprised when the "commercial" version of Norton they use, doesn't flag the same false positive, your "personal" version does. But, more importantly, note how many decent AV suites actually check the file, verifying it as safe thereafter.

14 hours ago, TomK said:

This may be unrelated, but if you have virus infected files on a server, odds are you have bigger problems

I will bet you right here and now, Norton doesn't have the slightest clue what it's doing, because it is by design one of the worst anti-virus/security software suites ever made. I understand you may not know why Norton is presenting you with incorrect assumptions, but this statement couldn't be more wrong. The issues at SC4D, which are clearly noted both here and on SC4D, are nothing at all to do with malware.

Honestly, if you'll take my advice, save your $30-$50 a year you are paying for updates, because Norton only makes you feel safe. However, when a real problem comes, it's assumptive thinking fails hard and once a problem is on your computer, it's about as helpful as a slice of toast at removing it. Simply use the free suite as part of Windows, MS Security Essentials / Windows Defender. In all comparison tests I've seen, it's always comes out well and costs nothing. No security suite can provide you with complete protection, just like having a lock and alarm on your front door, won't stop a burglar breaking a window.

Following safe computer practises is the biggest step you can take to keep your machines virus/malware free. Having a safe backup, which is not connected to your computer, will save you in the event of something catastrophic occurring.

Quote

Attached are two of the infected zips.

If these files were "Infected", we wouldn't want them hosted on ST. Also I think our server software would flag up the problem. In addition, re-distributing files is against community rules without explicit permission.

I've removed them from your post. Even though they very likely do not contain a virus, it is best to not attach them.

[Tarkus 6,933]

To further add, a lot of Norton's flagging in more recent versions is "heuristic-based"--that is, rather than actually scanning the file, it uses statistics to "predict" that it *could be* a problem.  They also at one point tried to do that to both SC4D and ST as a whole a couple years ago (and a couple weeks apart, AFAIK), blacklisting the sites, and popping up a warning message anytime someone with Norton visited.  The files that they tried to use as justification of this blacklisting were almost a decade old, and hadn't been updated or modified in any way since.  Even more hilariously, having Norton Security on a couple of my machines at the time, I actually ran the files through, and they came out clean.

Both sites ended up contacting Norton and having an actual human being examine the sites and the files in question, rather than whatever two-bit joke of an algorithm made the determination. Both sites were subsequently un-blacklisted.

-Tarkus

[Tyberius06 12,261]

I used to have similiar problems with the AVG/Avast duo, while I wanted to install *.exe based SC4 files. There is a component in both of these programs something about protection against blackmail viruses etc... I don't know the used english terms of it, because mine is run in Hungarian (how convinient). So this component always flagged and stopped installing the exe based plugins when it came to the part installing the readme and images, because it said: this could be a potential virus because it wants to modify things in my documents folder... It was a real headache when  I started the "extraction from exe installers" project for the LEX. The plugins actually were installed properly (BUT the NAM) only the images were messed up, it changed the extensions from gif/bmp/png/jpg something like $$A. Of course none of these files were infected at all...
But this behaviour has been gone now in the last two months.

- Tyberius