Norton File Insight and winbox.exe

Hello all,

For interest, those of you who want to use winbox on machines with Norton Internet Security on them. You might run into issues, I did.

Upon downloading winbox.exe (from the web page hosted on the mikrotik router itself, not the mikrotik main website) Norton File Insight catches it as a medium risk file and deletes it before I get a chance to run it! Normally I wouldn’t go near Norton for fear of catching a bad bad rash. In this case however I wasn’t using a machine under my control.

Norton Internet Security 17.7.0.12

Its not a big deal, i’ll just use another machine. But it was interesting. I wonder why Norton detects it as a threat?

What follows is the output from the Norton File Insight alert window:

c:\users\mcdonalds\downloads\winbox.exe
____________________________
____________________________
On computer as of
1/08/2010 at 6:07:57 p.m.
Last Used:
1/08/2010 at 6:07:57 p.m.
Startup Item: No
Launched: No
____________________________
____________________________
Many Users
Hundreds of users in the Norton Community have used this file.
____________________________
Medium
This file risk is medium.
____________________________
Threat Details
There are many indications that this file is untrustworthy and therefore not safe
____________________________
Origin

Downloaded from  http://vpn.l2.co.nz/winbox/winbox.exe
____________________________
http://vpn.l2.co.nz/winbox/winbox.exe
UNTESTED

Downloaded File:
winbox.exe
____________________________
File Actions
Infected file: c:\users\mcdonalds\downloads\winbox.exe
Removed
____________________________
File Thumbprint:
704e35d73f79fbbcd84bc202d86ae38265d5c45715cec2b2a3dba90f3e0ccf9c
____________________________