Symantec Endpoint Protection regularly quarantines the TeamViewer update.exe and complaines about the generic 'WS.Reputation.1' virus. You can check the version of Azure PowerShell that you have installed with the Get-Module azure format-table version command. Endpoint protection - Realtime protection. A lot of legitimate files will match this reputation profile at some point in their lives. It is important to understand that all of that information used to produce the WS.Reputation.1 detection is based completely upon what Symantec calls 'the wisdom of crowds'. While the exact information factored into the reputation analysis is known only to Symantec, we do know that it is not based upon the detection of any specific, known threats, which is likely why it has a high rate of false positives.įor more information about the WS.Reputation.1 category, refer to this page on Symantec's website.įor an official statement by Symantec regarding WS.Reputation.1 detection, false positives, and workarounds, refer to this post on Symantec's forums. Install Symantec Endpoint Protection on an existing VM Before you begin, you need the following: The Azure PowerShell module, version 0.8.2 or later, on your work computer. As you said, that detection is based purely on a files reputation, which can tell you if its particular usage and distribution patterns match those frequently seen with malware. It is a protection technology based solely on the reputation of files (No signature or behavioral analysis is performed by Download Insight). WS.Reputation.1 is not a real virus category, it is just the name that Symantec uses for files that 'have a low reputation score'. It is important to understand that all of that information used to produce the WS.Reputation.1 detection is based completely upon what Symantec calls "the wisdom of crowds". Historical Prevalence: This file has been seen by thousands of Symantec users. WS.Reputation.1 is not a real virus category, it is just the name that Symantec uses for files that "have a low reputation score". Historical Reputation: There is strong evidence that this file is untrustworthy. Customers using a Symantec or Norton product will occasionally run into an issue where "WS.Reputation.1" is detected when one of our installers is executed (Symantec Endpoint Protection, in particular, is well-known for doing this).
0 Comments
Leave a Reply. |