Symantec/Norton Products detecting WS.Reputation.1

Customers using a Symantec or Norton product will occasionally run into an issue where "WS.Reputation.1" is detected when one of our installers is executed (Symantec Endpoint Protection, in particular, is well-known for doing this). This detection is a false positive.

WS.Reputation.1 is not a real virus category, it is just the name that Symantec uses for files that "have a low reputation score". It is important to understand that all of that information used to produce the WS.Reputation.1 detection is based completely upon what Symantec calls "the wisdom of crowds". While the exact information factored into the reputation analysis is known only to Symantec, we do know that it is not based upon the detection of any specific, known threats, which is likely why it has a high rate of false positives.

For more information about the WS.Reputation.1 category, refer to this page on Symantec's website.

For an official statement by Symantec regarding WS.Reputation.1 detection, false positives, and workarounds, refer to this post on Symantec's forums.

We appreciate your feedback.  If you have any questions, comments, or suggestions about this article please contact our support team at kb@nsoftware.com.