Symantec Endpoint Protection trapped TCMD.EXE and said it contained WS.Reputation.1 (Virus?)

Dec 30, 2010
13
0
Sirs,

After I copied my new V23 tcmd.exe I purchased, Symantec on our network said this:

===========================================
Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: WS.Reputation.1
File: c:\install\tcc\v23\tcmd.exe
Location: Deleted or access blocked
Computer: AOKCT30007874
User: MJohnson4
Action taken: Leave Alone succeeded
Date found: Thursday, June 28, 2018 2:05:39 PM
===========================================

And it DELETED my copy. HELP!

--Mark Johnson
 

rconn

Administrator
Staff member
May 14, 2008
11,910
133
Sirs,

After I copied my new V23 tcmd.exe I purchased, Symantec on our network said this:

===========================================
Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: WS.Reputation.1
File: c:\install\tcc\v23\tcmd.exe
Location: Deleted or access blocked
Computer: AOKCT30007874
User: MJohnson4
Action taken: Leave Alone succeeded
Date found: Thursday, June 28, 2018 2:05:39 PM
===========================================

And it DELETED my copy. HELP!

--Mark Johnson
Not sure exactly what help you need from me?
 
Jan 19, 2011
596
14
Norman, OK
When you have Symantec Endpoint Protection running, always wait a couple of days before installing an update to software. This allows Symantec to start seeing it "in the wild". I have this same problem on my work computer. If I update software immediately when it's available, I get the Symantec reputation lockdown.

I've learned to wait about a week before even bothering to try updating.