Norton and Malicious Scripts

Why would my site rsources give a false positive?

[creepychris]

Every once in a while I get an e-mail from a user warning me that some of the education resources I've posted on a site give a 'malicious script' warning. These warnings are only triggered by Norton AntiVirus and Internet Security. I have scanned and rescanned these resources with every antivirus software available. Mcaffee gives me no problem, Dr. Ahns gives me no problem, some other freebess give me no problems, and even Norton gives these resources the A-OK as long as I save them to disk and scan them instead of opening them directly from my browser.

Again, these resources are microsoft word documents and the warning is only triggered by trying to open the 'doc' file in an internet browser with Norton running.

But the problem is huge for me because most Norton users would have very little concept of a 'false positive' and even one such warning would turn them off my site. I feel as though i am being slandered even though the site is a very clean educational site.

Norton (Symantec) has basically said it's my problem, and I am not here to complain about them. I am here to find out why this is happening so I can fix it. Have any other webmasters encountered problems with Norton setting off the alarms in a similar situation.

[encyclo]

The warning may be related to the fact that you are offering Microsoft Word .doc documents for download - and Word files can include macro functions which may contain viruses.

You should consider changing the file format of your downloadable documents to something safer. If the document is for consultation only, then you should be offering the files in the PDF format rather than .doc. If the files are meant to be subsequently editable by the user, then the RTF (Rich Text Format) would be a better choice.

[Lord Majestic]

Perhaps ZIPping documents would do the trick - in my experience Word Documents compress well, so you will have added bonus of saving on bandwidth with improved customer experience.

Sadly this might affect search engines as they might not be able to index documents inside archives.

[creepychris]

You should consider changing the file format of your downloadable documents to something safer. If the document is for consultation only, then you should be offering the files in the PDF format rather than .doc.

A good suggestion and one that I may go with in the end, but the reason I haven't so far is that --as you mentioned-- '.docs' can be edited which allows my users the ability to customize the resources that they download. Also, PDFs tend to generate a lot of lag time and sometimes cause crashes.

I wonder if the problem occurs because some of my documents have a foreign language in the dcument properties section and Norton has an issue with this?

[encyclo]

the ability to customize the resources that they download

In this case, RTF is a much better format than .DOC. In Word, you just do a "Save As" and select Rich Text Format as the filetype. The advantages of RTF are:

No macro functions - therefore much less risk of harbouring unsafe content.

Compatibility - Word documents are sometimes not compatible accross different versions of the same program. Documents created in Word 2003 often cannot be read in Word 97 or 2000, for example.

Cross-platform and multiple program compatibility - RTF is an open document standard - so you don't need Microsoft Word to read the file - RTF files can be read and edited in Word, OpenOffice, Kword, Abiword, on Linux, Windows, FreeBSD, Mac...

[Lord Majestic]

Disadvantage: AFAIK images in RTF are stored as bitmaps so files will be v.big.