Endpoint Protection Small Business Edition

 View Only
Expand all | Collapse all

Reputation check timed out

ℬrίαη

ℬrίαηNov 21, 2013 03:00 PM

  • 1.  Reputation check timed out

    Posted Nov 19, 2013 10:12 AM

    Hello all,

    One of our clients running SEP 12.1.3 has been receiving a notice that "Reputation check timed out during unproven file evaluation, likely due to network delays."  Searching showed an article about defwatch and I disabled that but we still receive this notice during the scheduled daily scans.

    Our traffic logs indicate no bandwidth or network connectivity issues around tha ttime.  Event logs are clean. We have several clients running SEP and this is the only one it's happening to.  It started happening before the latest round of MS patches.  I've gone back to the first time it started happening and can't find any files/programs added to the server on that day that might have triggered this.

    Any ideas on what else I can check before I open a support ticket?

    Thank you for your time.



  • 2.  RE: Reputation check timed out

    Posted Nov 19, 2013 10:16 AM

    Does this happen during every scan? Does it happen only on a certain file or for the entire scan. If a file, which one? Same one all the time? Does the scan continue on after the timeout happens?



  • 3.  RE: Reputation check timed out

    Posted Nov 19, 2013 10:35 AM

    Thank you for the quick response.

    Every scheduled scan it occurs.  I just ran a manual active scan and got no alert.  It had been happening with every defwatch scan until I stopped those from running.  The scan typically continues after the timeout.

    One thing that has me a little confused now that I look more into it is that when I ran the manual active scan just now it scanned about 900 items.  The daily scan at 12:30 AM is supposed to be an active scan as well but the log says it is scanning 300,000+ files.  Last night it scanned nearly 700,000 items.

    Maybe I just need to update to 12.1.4 and then remove/re-add the daily scheduled scan from SEPM?  Could be something glitched with it perhaps?  None of the other clients that report in are having this issue, just the servers client itself.



  • 4.  RE: Reputation check timed out

    Posted Nov 19, 2013 10:38 AM

    Try momving to 12.1.4 and see if that fixes it. Otherwise you may need to contact support.



  • 5.  RE: Reputation check timed out

    Posted Nov 20, 2013 09:30 AM

    Upgrading to 12.1.4 did not resolve the issue.  I've removed the daily job from SEPM and recreated it.  Will see if that resolves the issue.  Next step would be to remove the local client and reinstall I imagine.



  • 6.  RE: Reputation check timed out
    Best Answer

    Trusted Advisor
    Posted Nov 20, 2013 09:34 AM

    Hello,

    This happens when the SEP client file reputation check operation is timing out as the external firewall blocks access to https://ent-shasta-rrs.symantec.com/mrclean

    Try the following workaround:

    On the Symantec Endpoint Protection Manager (SEPM):

    1) Go to Policies > Virus and spyware protection > right click and edit the policy > Under Windows settings > protection technology > Download protection

    2) Uncheck "Enable download insight to detect potential risk in downloaded files based on file reputation"

    Hope that helps!!



  • 7.  RE: Reputation check timed out

    Posted Nov 20, 2013 09:43 AM

    I'll give that a try if all else fails.

    Thanks all for the recommendations.  I appreciate it!



  • 8.  RE: Reputation check timed out

    Posted Nov 21, 2013 10:42 AM

    This seems to have done the trick.  I'll look into the firewall issue when I get a chance but in the interim no more annoying messages every morning.  Thanks!



  • 9.  RE: Reputation check timed out

    Posted Nov 21, 2013 10:50 AM

    You do know that by turning off Download Insight, you're removing a layer of protection for your client(s)?

    Have you tried just turning off the notification? On Notifications tab, uncheck "Display a notification message on the infected computer"



  • 10.  RE: Reputation check timed out

    Posted Nov 21, 2013 01:56 PM

    Doesn't the error message indicate it's not working anyways?  

    Disabling the notification would just disable the popup on the target computer.  What I'm more concerned about is the log entry of the reputation check timeout.  Until I'm able to make changes to the firewall we'll keep getting these notices.

    If it won't work anyways until I can fix the firewall issue then I'd rather not have it running.  If I'm mistaken and it's still working just not able to do this one thing then I guess I could just pretend the error message isn't coming in.



  • 11.  RE: Reputation check timed out

    Posted Nov 21, 2013 02:05 PM

    I guess I'm just confused. So you need to allow this check out thru your firewall? It wasn't mentioned previously, unless I missed it.



  • 12.  RE: Reputation check timed out

    Posted Nov 21, 2013 02:57 PM

    Above, MIthun says the error is most likely the firewall blocking the reputation check which is causing the error.  I don't have access to the firewall at this time (our client has that service contracted out to a different company for a few more weeks).

    In the interim I have insight disabled. If Insight can't do reputation checks, what's the point of having it running until I can fix the firewall issue yeah?



  • 13.  RE: Reputation check timed out

    Posted Nov 21, 2013 03:00 PM

    if that's the case than yeah



  • 14.  RE: Reputation check timed out

    Posted Nov 21, 2013 03:04 PM

    Thanks Brian.  ^_^

    It makes sense though as they are the only client having this issue and they're also the only one I don't have firewall access to.



  • 15.  RE: Reputation check timed out

    Posted Nov 21, 2013 03:07 PM

    Yea it does, just didn't know you hadn't already made the change to the fw