wrsssdk.exe [3968] was blocked from terminating Smms

[EEEEE]

Started by "c:\windows\system32\services.exe" [572]
[EXECUTION] Commandline - [ "c:\program files\webroot\spy sweeper\wrsssdk.exe" ]
Tue 26 - 21:32:36 [TERMINATE] c:\program files\webroot\spy sweeper\wrsssdk.exe [3968] was blocked from terminating c:\windows\system32\smss.exe [444]


why ????

[EEEEEEEEE]

im using sygate firewall

[Bubba]

This may or may not still hold true....but in a recent thread Gavin commented simply allow it

Found here---> Webroot Spysweeper 4.0 and ProcessGuard (http://www.wilderssecurity.com/showthread.php?t=80461)

[eeeeeeeee]

thank you :)


why there is no learing mode for driver or service instialltion?
because if I need to install new software some time it need to install driver , the instialltion will damege and i need to stop BLOCK ROOTKIT INSTALLITION and install again
if learing mode allow driver instialltion it will be better :)
or they use differnet level of learing mode
like first learing mode allow every thing exept global protection option
and the second learing mode allow every thing + driver instialltion
.....learing mode allow every thing + global protection option

[Pilli]

SpySweeper also needs to install a service/driver and as Bubba has said allow the .exe as it is a part of a trusted program.
A few security programs show this type of behaviour and it is usually the program just checking to make sure it can terminate a process as this may be necessary to stop malware.

HTH Pilli

[EEEEE]

-{ Quote: "SpySweeper also needs to install a service/driver and as Bubba has said allow the .exe as it is a part of a trusted program.
A few security programs show this type of behaviour and it is usually the program just checking to make sure it can terminate a process as this may be necessary to stop malware.

HTH Pilli" }-


its really clear why spysweeper try to checking to make sure it can terminate a process

thank you very much

[eeeeeeeeeeeee]

please

is it ok to give SPYSWEEPER and KAV terminate protected application ?

[Pilli]

See above, they both may need to and they are trusted programs :)