Microsoft Configuration Manager and Intune (Enterprises/Paid) > Report Publishing/Download/Hash Issues (Enterprises Using ConfigMgr and Intune)

Symantec Reporting infected File

(1/1)

icon27:
Good day,
Symantec Endpoint Protection has reported an infected file from Patch my PC Malware WS.Reputation.1.
Hash: 4F99744DAB18A2D7613BD0D2A5D9C3B32EFBD962075E3DE928B310975ED668CB

Jake Shackelford (Patch My PC):
Do you know what file caused this scan to alert you?

Cody Mathis:
Hi there!

What is the specific file that is triggering this?

I suspect this is PatchMyPC-ScriptRunner.exe. This file is updated somewhat regularly and because of this Symantec will trigger on it occasionally. Note the 'Current Reputation' and 'Historical Reputation' that 'There is some evidence that this file is trustworthy'

When we first update this binary we see the occasional customer who will have this flagged. As more customers update and Symantec is aware of the file the alerts stop based n their updated definitions.

For more context, ScriptRunner is our wrapper for doing installations and does have bits of code that can do a lot of tasks as system and can be a trigger to AV. This includes user impersonation and querying various bits of system information.

Are you possibly able to trust a signing certificate?

icon27:
Trying to identify the file now and will report once found. I will also look at trusting the cert. First time reporting to PMP...  :D
Thanks for the reply

icon27:
It is the ScriptRunner file that is causing the false positive. thank you for all the info.. Have a great day.

Navigation

[0] Message Index

Go to full version