WG problem with Symantec security center

WG problem with Symantec security center FIXED

I have Norton Internet Security installed with the Firewall - not NAV - working (I use KAV for AV).

While I had WG turned off I had to reinstall NIS, then update. It must have added a new file to symantec shared\security center. Recently I turned WG back on again & now it halts reboot & throws up this warning each reboot:

...............

Warning!
For security reasons, this file has been temporarily blocked from executing.

File: C:\program files\common files\symantec shared\security center\usrprmpt.exe

Reason
Risk Assessment: Medium

*> Script Analysis: Security risks detected.
WormGuard Script Analysis:

> Contains suspicious string: startup
> Uses the autostart registry.



FILE SCRIPT:

MZ�


......................

I put usrprmpt.exe into the Allowed List but this makes no difference: WG still does the same thing each boot up.

Any suggestions?

 

Hmmmmm my advice would be "allow always" like you did, or exclude from scanning, so now i din't know exactly what more can be done.
Will have to wait for other advices.

 

Hi Caratacus,

The whole path has to be added - C:\program files\common files\symantec shared\security center\usrprmpt.exe

The easy way to add it ... is to follow Jooske's advice and select "always allow" when you get the next popup warning on your next PC boot.

I'm using both NPF and WG ... this will resolve the problem.

dog -

 

Thanks, Jooske & Dog. Dog, your fix seems to have worked - I entered the whole address (by hand) & rebooted with no popup warning arising, so thank you for that.

But you wrote:

"Always allow" was not offered as an option on my popup warning - am I missing something?

 

Hi Caratacus,

Do you see that path when you open WormGuard and then open the "Allowed-List Editor"?
See screenshot:

 

Oh yes FanJ - that's where I put the

C:\program files\common files\symantec shared\security center\usrprmpt.exe

reference & it seems to have worked.

But I was referring to something Dog wrote:

"The easy way to add it ... is to follow Jooske's advice and select "always allow" when you get the next popup warning on your next PC boot."

This seemd to imply there should be an "Always allow" option on the original popup warning that came up when I was booting. I do not have such an option in the Warning dialogue box.

 

This one.... highlighted

TAS

 

OK - I don't have that on my WG. And even though it is registered to me, and says so on the main control dialogue, the warning box says unregistered:

 

As thus:

 

AND!!!

The penny just dropped!

Uncheck "Hide allow button from user"!!


Sheesssh!

Thanks all!

 

Glad it's sorted!!

TAS

 

Thanks Tassie Devils: I apologise to everyone for being rather slow on the uptake with the "Always Allow" issue. Anyway, my original problem with usrprmpt.exe has been solved. Is it always necessary to put the whole path into WG's Allowed List? I solved (or thought I solved) problems with RegRun by simply putting in the file names, without paths, ad discussed in this thread:

https://www.wilderssecurity.com/showthread.php?t=13722&highlight=regrun

 

I guess putting full path is, since it worked for you, I've never had to 'Always Allow' anything, as all alerts from WG for me were from test files I created.

TAS

 

but the point in question is what the hell is usrprmpt.exe and what purpose does it solve? does anyone know?