extensionData\plugins\1.js is detected as Adware.Crossid

Edit Subject

Hello Dennis,

Thank you for reporting the false-positive AV issue.

In general, warnings such as these ARE NOT viruses or worms, they are merely a message that the AV solution generates to say "we consider this software suspicious or suspect" and it MAY (MAY being the operative word) contain viruses. Now, there are many possible reasons why installers MAY be considered suspicious, usually along the lines of the software doesn't have a lot of downloads and is therefore untrusted, or other such reasons. For this reason, AV solution provide a mechanism to add an exception to ignore such incidents, so that installers can run without further warning. The other option is to simply disable the AV solution during the install and when it detects it later, allow the instance and AV solution will automatically create an exception.

To investigate your specific situation, please provide as much of the following information as possible and I will investigate:

1. The extension id


2. Which browser and operating system you are testing on, including version numbers


3. The exact steps for reproducing the problem


4. Any additional useful data, such as download URLs, screenshots, videos, ...

Hi Shlomo,
Thanks for quick reply. I understand that this is obviously not really a virus.

The thing is that I am not even using installer and I do not plan to use when the extension is complete.

This 1.js file is part of crossrider framework. And it is put in Quarantine by Norton as soon as you download the extension as zip in order for it to be added to chrome.

My extension Id is 56381.

The exact steps to reproduce are.
1) Go to extensions IDE in Google chrome: http://crossrider.com/apps/56381/ide
2) Click "Install staging extn"
3) Click green "Download zip" button
4) Open the zip file in WinRar

Result: Norton warning is displayed.

If you ignore the warning and extract the zip and then do the "Load unpacked extension" - everything seems fine: you get the thank you page, the browser button is added and works, etc. It's just that extension.js code is never executed until you restore the 1.js from Quarantine.

Hope this is helpful. Let me know if you need more info.

P.S. I love crossrider framework and sincerely hope these issues will be resolved by the time I finish my extension:)

Hello Dennis,

Thanks for the additional information. I've passed it on the to the AV team to investigate.

Shlomo,

Was there a resolution here? I am running into this and its becoming a showstopper at our end.

Hello Abhishek,

We are working on resolving these issues. Please provide the extension id so that we can check your extension?

Shlomo,

My extension ID is 57360 (staging) and 57361 (production)

Let me know when you have applied the fix.

Thanks,

Abhishek

Hello Abhishek,

Thanks for the information. We are working on the issue and will let you know when it's fixed, but please bear with us as it may take a while.

Shlomo,

How long were you thinking for the fix? I need to update my team.

Abhishek

Hi Shlomo,
Today I received another alert. This time it's "js\api\message.js" and the threat is Adware.Adpopup.

Thanks,
Dennis

Hello Dennis,

Thanks for the additional information. I have forward the information to the AV team.

Any new updates? My client just received this error while installing the as well on Windows OS installing to Chrome.