Norton Firewall Threat Notifications on Video Downloads following VDH and Companion App Reinstall

[kwalla23]

Your question

Hi! Long time user, but recently ran into a problem after updating the Companion App from v1.63 to 2.0.10 and 2.0.15. Video DownloadHelper is "working" now, but I'm getting firewall threat alerts from Norton 360...

Where Norton blocks the download with a popup stating: "ffprobe.exe does not have a valid digital signature" OR “Suspicious network activity has been detected.” from vdhcoapp.exe. I get one or the other threat alert, but not both when trying to download a video. I can get the download to work if I click quick enough on the Nortion's permission button, but would rather not have to be giving firewall access in this manner. Any chance there is a fix for this?
Thanks!
Dave

Addon & CoApp version and details

Companion App 2.0.15, Firefox v122.0.1 (64-bit), Windows 10 Pro version 22H2 (64-bit), OS build 19045.3930 (Windows Feature Experience Pack 1000.19053.1000.0)

[GrampaWildWilly]

A number of others have had similar problems with other antivirus & firewall applications. It's just a false positive. You should permit everything in your CoApp directory to run. Make an exception for the entire directory in the antivirus & the same whole directory exception in the firewall. Norton will eventually correct their false positive. They might do it sooner if you report this to them. But for the time being, this is what you have to do if you expect to keep using the current versions of VDH & the CoApp. You're lucky. Norton spoke up & said it was interfering with normal processing. Others have simply had mysterious failures, without notifications from the antivirus or firewall, & it's taken us a while to realize we were looking at the antivirus/firewall false positive. You're ahead of the game.

[kwalla23]

Thanks Grampa(/Paul?)! Appreciate your assistance. Not a newbie here, so I completely understand false positives. But I sorta really just wanted to notify VDH about these 2 issues as I saw a similar question/answer about the Companion App on the old Google VDH help site from about 7 years ago where MIG responded that he would contact Norton about getting the App "whitelisted". So, I really was hoping you still took this same approach... Mostly, so users, like me and others (thinking about the newbies here!), didn't have to mess around with accepting firewall "threats". But if that previous policy has changed on how firewall "threats" are handled, that's fine. Last time I saw the Norton "threat", it said _less than 50 Norton users were using the Companion App (yesterday it was <5), so maybe this is not a big concern(?).

Anyway, that still leaves a question about Digital Signatures. ((I understand digital signatures, so no explanation needed.)) Is VDH no longer using Digital Signatures on executables?... If not, that's fine too. Although I always feel better when not receiving antivirus warnings about an executable with no digital signature.

[paulrouget]

@kwalla23 I understand.

Honestly I don't know how to work around all the antivirus out there. The software is signed but it needs to run executables and do TCP connections. Stuff antivirus will block.

And I'm gonna be blunt: the only antivirus that is not a scam is Microsoft Defender. It is is more advanced, it's built in Windows, and it's free. I worked at Mozilla on Firefox for 10+ years, and Avast, Norton and all have just been a pain to deal with, with literally zero benefit for the user compared to the builtin Windows antivirus. Here is another Mozilla developer explaining why all antivirus are bad (except the one built in Windows).

My recommendation: delete your antivirus and make sure to enable windows defender (and it's probably already active).

[kwalla23]

Hi Paul! Thanks for the Antivirus advice and the links! Appreciate it and trust you that the antivirus companies are difficult to deal with. On the consumer side, I've had good success with Norton antivirus/firewall protecting my PC... although their interface could be much better and they are always trying to upsell me with some other option. I do use MS Defender occasionally to double check Norton's AV and will have to look into how to use it more efficiently. As far as I knew, it was only getting virus updates 1x per month with the other windows updates. And, Norton's website customer service (even when logged in!) DOES SUCK as it is like negotiating thru a maze! I logged in to try to report my firewall issue but could not find an easy way to do it; and gave up.

Honestly, I'm not trying to be a pest here... And it appears maybe I don't really understand digital signatures as you refer to them above ("software is signed"). So, I probably could use a little explanation, if you have the time. It was my understanding that I could right-click on a file and, under Properties, select the Digital Signatures tab. I did that with the CompApp files, but didn't find any Digital Signature tab.
Thanks!

[GrampaWildWilly]

Paul actually works for VDH. I don't. I'm just another user. I was on Windows 7 until just a couple of months ago. Then I built a new computer & put W11 on it. An ordeal in every respect. I had been prepared to install the AV I had been running on W7 on W11. But when I saw W11 had an AV already built in, I thought what the hey, let's be lazy. Not exactly a scientifically supportable approach, but that's what I did. After the install, I was kind of worn out. I thought let's give this a chance & see what happens. I haven't had any incidents of the AV complaining about the CoApp. Not only that, but I must get a dozen virus signature updates EVERY DAY! I might consider that annoying but I'd rather they stay on top of the virus signatures than not. So that's not happening only when, as you said, they send out system maintenance. The signature updates are frequent, multiple times per day. The antivirus engine gets updates less often. In the 2 months I've been running W11, I think I've seen one update to the AV engine. There might have been 2. But those are less frequent. Seems to me I saw one & was surprised that after it installed, it did NOT tell me I needed to reboot, which I thought was awfully nice of them. The major system updates always tell you to reboot.

So there's one user's experience to add to the discussion.

[kwalla23]

Thanks for the additional insight on MS Defender. Very helpful!

Likely because Defender is not my primary AV, I never get any obvious notice of any daily/weekly Defender updates on my Win10 PC; so, I had mistakenly assumed I was only getting Defender updates with those monthly Windows updates. After just scrolling down below the “Quick scan” button (in Win10's Settings > Windows Security > Open Windows Security > Virus & threat protection), I now see the time of the last update, which is much more recent than my last months’ Windows security update. So, it does appear that Defender is either updating in the background, or at least whenever I run it. And after scrolling down on that same Settings’ “Virus & threat protection” page, I also found the “check for updates” option!... I previously didn't know that was there; so that’s good to know, too.

Foolishly, I had assumed that I could only get immediate Defender updates by the much more time-consuming process of selecting “Scan options” (under that same Quick scan button on the “Virus & threat protection” page), which offers 3 more scan options including a “Microsoft Defender Offline scan”, which uses “up-to-date threat definitions” that also requires a reboot and takes “about 15 minutes”.
Thanks again!