WG problem with Symantec security center

Discussion in 'WormGuard' started by Caratacus, Aug 21, 2004.

Thread Status:
Not open for further replies.
  1. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    WG problem with Symantec security center FIXED

    I have Norton Internet Security installed with the Firewall - not NAV - working (I use KAV for AV).

    While I had WG turned off I had to reinstall NIS, then update. It must have added a new file to symantec shared\security center. Recently I turned WG back on again & now it halts reboot & throws up this warning each reboot:

    ...............

    Warning!
    For security reasons, this file has been temporarily blocked from executing.

    File: C:\program files\common files\symantec shared\security center\usrprmpt.exe

    Reason
    Risk Assessment: Medium

    *> Script Analysis: Security risks detected.
    WormGuard Script Analysis:

    > Contains suspicious string: startup
    > Uses the autostart registry.



    FILE SCRIPT:

    MZ�


    ......................

    I put usrprmpt.exe into the Allowed List but this makes no difference: WG still does the same thing each boot up.

    Any suggestions?
     
    Last edited: Aug 24, 2004
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hmmmmm my advice would be "allow always" like you did, or exclude from scanning, so now i din't know exactly what more can be done.
    Will have to wait for other advices.
     
  3. dog

    dog Guest

    Hi Caratacus, ;)

    The whole path has to be added - C:\program files\common files\symantec shared\security center\usrprmpt.exe

    The easy way to add it ... is to follow Jooske's advice and select "always allow" when you get the next popup warning on your next PC boot.

    I'm using both NPF and WG ... this will resolve the problem.

    dog - *puppy*
     
  4. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    Thanks, Jooske & Dog. Dog, your fix seems to have worked - I entered the whole address (by hand) & rebooted with no popup warning arising, so thank you for that.

    But you wrote:

    "Always allow" was not offered as an option on my popup warning - am I missing something?
     
  5. FanJ

    FanJ Guest

    Hi Caratacus,

    Do you see that path when you open WormGuard and then open the "Allowed-List Editor"?
    See screenshot:
     

    Attached Files:

  6. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    Oh yes FanJ - that's where I put the

    C:\program files\common files\symantec shared\security center\usrprmpt.exe

    reference & it seems to have worked.

    But I was referring to something Dog wrote:

    "The easy way to add it ... is to follow Jooske's advice and select "always allow" when you get the next popup warning on your next PC boot."

    This seemd to imply there should be an "Always allow" option on the original popup warning that came up when I was booting. I do not have such an option in the Warning dialogue box.
     
  7. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
    This one.... highlighted :)

    TAS
     

    Attached Files:

  8. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    OK - I don't have that on my WG. And even though it is registered to me, and says so on the main control dialogue, the warning box says unregistered:
     
    Last edited: Aug 27, 2004
  9. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    As thus:
     

    Attached Files:

    • PS.jpg
      PS.jpg
      File size:
      53.9 KB
      Views:
      885
    Last edited: Aug 22, 2004
  10. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    AND!!!

    The penny just dropped!

    Uncheck "Hide allow button from user"!!


    Sheesssh!

    Thanks all!
     
  11. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
    :D Glad it's sorted!!

    TAS
     
  12. Caratacus

    Caratacus Registered Member

    Joined:
    Jun 27, 2003
    Posts:
    164
    Location:
    Australia
    Thanks Tassie Devils: I apologise to everyone for being rather slow on the uptake with the "Always Allow" issue. Anyway, my original problem with usrprmpt.exe has been solved. Is it always necessary to put the whole path into WG's Allowed List? I solved (or thought I solved) problems with RegRun by simply putting in the file names, without paths, ad discussed in this thread:

    https://www.wilderssecurity.com/showthread.php?t=13722&highlight=regrun
     
  13. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
    I guess putting full path is, since it worked for you, I've never had to 'Always Allow' anything, as all alerts from WG for me were from test files I created.

    TAS :)
     
  14. truant

    truant Guest

    but the point in question is what the hell is usrprmpt.exe and what purpose does it solve? does anyone know?
     
Thread Status:
Not open for further replies.