Norton Antivirus flagging downloaded .dll as heuristic threat

Question

User-936766376 posted

Hello.

I developed a WebAssembly app and my app's .dll is trying to be cached by the browser (Edge and Opera in my case) and Norton Antivirus is flagging and removing the downloaded .dll. All of the other .dll's and other content is cached without warning.

Has this happened to anyone else?

What's even more strange is that this just started yesterday, after a few days of testing my Blazor app.

Below is the report from Norton. My web site's domain name is replaced with "xxxxx":

Thanks,

Mike

Here's the report:

Filename: BlazorApp1.Client[1].dll
Threat name: Heur.AdvML.CFull Path: C:\Users\Mike\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VKQ29L6M\BlazorApp1.Client[1].dll

____________________________

___________________________

On computers as of 
10/26/2019 at 1:42:32 PM

Last Used 
10/26/2019 at 1:44:33 PM

Startup Item 
No

Launched 
No

Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.

____________________________

BlazorApp1.Client[1].dll Threat name: Heur.AdvML.C
Locate

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.

____________________________

http://blazorapp1.xxxxx.com/_framework/_bin/BlazorApp1.Client.dll
Downloaded File from xxxxx.com
Source: External Media

____________________________

File Actions

File: C:\Users\Mike\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VKQ29L6M\ BlazorApp1.Client[1].dll Removed
____________________________

File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

Answer 1

User-821857111 posted

You should take this up with Norton. Their detection algorithms are at fault. It's not an ASP.NET issue.

Answer 2

User-474980206 posted

Norton doesn't know the dll will run in sandbox. Its checking for code that will change the security level. It may be a false hit, or you included code that could be used to raise security to allow a virus to run (if it wasn't in a sandbox).