WS.Reputation.1 Details

I understand WS.Reputation.1 and the fact that it's based on the Norton Community... number of users that have used the file, etc. But I have two questions...

(1) I excluded WS.Reputation.1 security risks so they are ignored by both risk and sonar scans. I no longer receive the Orange WS.Reputation.1 alerts, but I still receive the Red WS.Reputation.1 alerts. Why is that?

(1) I realize Orange means medium threat and Red means high threat, but since this is solely based on the Norton Community, what factors actually determine whether the alert is Orange or Red? Seems to me that a Red alert is serious (i.e. a virus), but I can't see how that could be based on the limited factors used.

Thanks

Dave