Symantec Reporting infected File

[icon27]

Good day,
Symantec Endpoint Protection has reported an infected file from Patch my PC Malware WS.Reputation.1.
Hash: 4F99744DAB18A2D7613BD0D2A5D9C3B32EFBD962075E3DE928B310975ED668CB

[Jake Shackelford (Patch My PC)]

Do you know what file caused this scan to alert you?

[Cody Mathis (Patch My PC)]

Hi there!

What is the specific file that is triggering this?

I suspect this is PatchMyPC-ScriptRunner.exe. This file is updated somewhat regularly and because of this Symantec will trigger on it occasionally. Note the 'Current Reputation' and 'Historical Reputation' that 'There is some evidence that this file is trustworthy'

When we first update this binary we see the occasional customer who will have this flagged. As more customers update and Symantec is aware of the file the alerts stop based n their updated definitions.

For more context, ScriptRunner is our wrapper for doing installations and does have bits of code that can do a lot of tasks as system and can be a trigger to AV. This includes user impersonation and querying various bits of system information.

Are you possibly able to trust a signing certificate?

[icon27]

Trying to identify the file now and will report once found. I will also look at trusting the cert. First time reporting to PMP... 
Thanks for the reply

[icon27]

It is the ScriptRunner file that is causing the false positive. thank you for all the info.. Have a great day.

[markokruger]

I love reading this article so beautiful!! great job