• Welcome to Support Forum: Get Support for Patch My PC Products and Services.
 

Symantec Reporting infected File

Started by icon27, August 20, 2021, 07:28:14 AM

Previous topic - Next topic

icon27

Good day,
Symantec Endpoint Protection has reported an infected file from Patch my PC Malware WS.Reputation.1.
Hash: 4F99744DAB18A2D7613BD0D2A5D9C3B32EFBD962075E3DE928B310975ED668CB


Jake Shackelford (Patch My PC)

Do you know what file caused this scan to alert you?

Cody Mathis (Patch My PC)

Hi there!

What is the specific file that is triggering this?

I suspect this is PatchMyPC-ScriptRunner.exe. This file is updated somewhat regularly and because of this Symantec will trigger on it occasionally. Note the 'Current Reputation' and 'Historical Reputation' that 'There is some evidence that this file is trustworthy'

When we first update this binary we see the occasional customer who will have this flagged. As more customers update and Symantec is aware of the file the alerts stop based n their updated definitions.

For more context, ScriptRunner is our wrapper for doing installations and does have bits of code that can do a lot of tasks as system and can be a trigger to AV. This includes user impersonation and querying various bits of system information.

Are you possibly able to trust a signing certificate?

icon27

Trying to identify the file now and will report once found. I will also look at trusting the cert. First time reporting to PMP...  :D
Thanks for the reply

icon27

It is the ScriptRunner file that is causing the false positive. thank you for all the info.. Have a great day.

markokruger

I love reading this article so beautiful!! great job