• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

WS.Reputation.1 *!!!??!@@@!?!!!

Lately this warning has been coming up more and more frequently, to the point where I'm getting these stupid false positives several times a day. So I added "WS.Reputation.!" to my Signature Exclusions list, but I'm still getting these damn warnings! When is Norton going to fix this problem? If something isn't done soon, I'm just going to uninstall this crapware and get some other anti-virus program.

Replies

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Please review: WS.Reputation.1 detection.
https://community.norton.com/en/forums/clarification-wsreputation1-detection
Files reported as WS.Reputation.1 may not necessarily be malicious, and may be a false positive detection. Should you be uncertain whether a file has been reported correctly, you may submit file to https://www.virustotal.com  for second opinion scan with multiple antivirus engines.
If you believe a file has been mistakenly detected by WS.Reputation.1, you may submit a dispute at https://submit.symantec.com/false_positive/.

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Yada, yada, yada. This must be an automated response, because it does not address the question asked.

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

dfkettle:

Yada, yada, yada. This must be an automated response, because it does not address the question asked.

Yep, macro response....although, I did bump your concern, upstairs.
So, you're sure you've excluded WS.Reputation.1 signature (is there still a WS.Reputation.2)

Please tell us what Norton is telling you regarding this event.
For information regarding this event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste here.

Lets hear from Community

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Yes, I double-checked. The exclusion is still there (for WS.Reputation.1). I don't think I've seen any cases of WS.Reputation.2 or .3 (I think 3 was listed when I scrolled through the list).

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Okay.  IIRC....there was WS.Reputation.1 & .2 awhile back. 

https://www.symantec.com/security_response/landing/azlisting.jsp?azid=W

Please tell us what Norton is telling you regarding this event.
For information regarding this event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste here.

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

I'll have to wait until it happens again, won't I? In the meantime, maybe someone can tell me why the exclusion isn't working.

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

For information regarding this event > from Norton pop-up > View Details > Copy to Clipboard &or from Norton history > More Options > Copy to Clipboard > paste here.

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Why do I get the feeling that I'm talking to myself?

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

I hear ya'.   Your WS.Reputation.1 event should be with your Norton history. 

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Found it. Any idea what this file (c:\Windows\System32\ RDCP1121.CPL) is? Is it a legitimate Windows system file? If I remember correctly, it's always the same file that Norton complains about. I zipped it and attached it below.

Filename: WS.Reputation.1
Full Path: Not Available

____________________________

____________________________


On computers as of 
Not Available

Last Used 
9/28/2017 at 12:54:20 PM

Startup Item 
No

Launched 
No

Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe


____________________________


WS.Reputation.1
Locate


Unknown
It is unknown how many users in the Norton Community have used this file.

Unknown
This file release is currently not known.

Medium
This file risk is medium.


____________________________


Source: External Media


____________________________

File Actions

File: c:\Windows\System32\ RDCP1121.CPL Excluded
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available
 

[Admin Edit: File attachment removed]

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

dfkettle:

Found it. Any idea what this file (c:\Windows\System32\ RDCP1121.CPL) is? Is it a legitimate Windows system file? If I remember correctly, it's always the same file that Norton complains about. I zipped it and attached it below.

Filename: WS.Reputation.1
Full Path: Not Available
On computers as of 
Not Available
Last Used 
9/28/2017 at 12:54:20 PM
Startup Item 
No
Launched 
No
Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe
WS.Reputation.1
Locate
Unknown
It is unknown how many users in the Norton Community have used this file.
Unknown
This file release is currently not known.
Medium
This file risk is medium.
Source: External Media
File Actions
File: c:\Windows\System32\ RDCP1121.CPL Excluded
File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

Hmm, I was expecting a downloaded executable, like a setup file for a program.  Head scratch.File: RDCP1121.CPL
File size: 623 KB (637,952 bytes)
MD5 checksum: 9875E67A18EB2B96A954986667A769BE
SHA256 checksum: A93769D173EB4C33307FABB23B0FCD1D4091C3E756873DDB7496FF05FA751897

File name: RDCP1121.CPL
Detection ratio: 0 / 64
Analysis date: 2017-09-28 23:57:14 UTC ( 0 minutes ago )


https://submit.symantec.com/false_positive/


CONFIRMATION
Your submission has been sent Thu Sep 28 17:07:39 PDT 2017. To make another submission, click here.
Sincerely,
Symantec Security Response

Kudos1 Stats

Re: WS.Reputation.1 *!!!??!@@@!?!!!

In relation to submission 51804.
Upon further analysis and investigation we have verified your submission and, as such, the detection(s) for the following file(s) will be removed from our products:

File name: RDCP1121.CPL
MD5: 9875e67a18eb2b96a954986667a769be
SHA256: a93769d173eb4c33307fabb23b0fcd1d4091c3e756873ddb7496ff05fa751897
Note: Whitelisting may take up to 24 hours to take effect via Live Update

Decisions made by Symantec are subject to change if alterations to the Software are made over time or as classification criteria and/or the policy employed by Symantec changes over time to address the evolving landscape.
Sincerely,
Symantec Security Response

@dfkettle

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

So it was a Microsoft WIndows file? And it is harmless? Hard to believe that none of your other customers reported this for "whitelisting".

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

dfkettle:

So it was a Microsoft WIndows file? And it is harmless? Hard to believe that none of your other customers reported this for "whitelisting".

If you believe a file has been mistakenly detected, you may submit a dispute at https://submit.symantec.com/false_positive/.


From this distance all I know is what the hash tells me.

Um, not my customers. 

Regards w Respect

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Thanks for the obfuscation, I don't have a clue what you're saying but I assume it's some kind of veiled insult. And I'm still waiting to hear why the exclusion wasn't working.

Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

dfkettle:

Thanks for the obfuscation, I don't have a clue what you're saying but I assume it's some kind of veiled insult. And I'm still waiting to hear why the exclusion wasn't working.

Hmm, no insult meant, veiled or otherwise.  I'm also waiting to hear why the exclusion wasn't working.
I'll try ping, again. 
Thanks
You may always Chat with Official Norton Support.

Kudos1 Stats

Re: WS.Reputation.1 *!!!??!@@@!?!!!

Hi @dfkettle,

Sorry for the inconvenience caused. Could you please try removing existing Signature " WS.Reputation.1" from exclusion list and add it again and let us know if issue reoccurs again? Please provide below details for further investigation? 

- Norton Product name and version number installed

- Operating System

Thanks @bjm_ for submitting file for False positive report. 

Sunil_GA | Norton Forums Administrator | Symantec Corporation
Kudos0

Re: WS.Reputation.1 *!!!??!@@@!?!!!

What would be the point of doing that, if the file has already been "whitelisted", as stated in an earlier reply from @bjm_?

This thread is closed from further comment. Please visit the forum to start a new thread.