WormGuard_test

[MichaelE]

Need help.
I have today installed the free version of Wormguard.
All worked fine, but now when I in WinXp Home try to open Asseccories =>System restore, to make an Restore point Wormguard comes up with warning:

File:c:\windows\system32\restore\rstui.exe

*> Script Analysis: Security risks detected.
WormGuard Script Analysis:
> Contains suspicious string: startup
> Executes a file(s)
> Accesses the file system.
FILE SCRIPT:
MZ�

I am not a pro on this and need urgent support to solve this matter. I have read something about this but cannot find the discussion on this topic.

MichaelE

[LowWaterMark]

Hi MichaelE,

Are you sure about the filename? Could it actually be "rstrui.exe" - notice the "r" in the middle? If that is the file, then it is really part of XP's System Restore and safe. (This warning just says "suspicious" so that you will check and ensure that you know what the file is and whether you want to trust it or not.)

You can tell Wormguard to "Always Allow" this file and you won't get warnings on it again.

Here is a thread with some similar information:

http://www.wilderssecurity.com/showthread.php?t=9316

I hope this helps,
LowWaterMark

[MichaelE]

Hi LowWaterMark

Thank you for your support.
I am sorry for my misstyping. You are right I missed one r.
I did actually test and run the file despite the warning and it worked all the way through.

Thank´s for the URL. Will read it again.

Regards
Michael

[LowWaterMark]

Well, it certainly looks like the valid system restore program then. Let us know if you have any other questions. :)

Best Wishes,
LowWaterMark