wrsssdk.exe [3968] was blocked from terminating Smms

Discussion in 'ProcessGuard' started by EEEEE, Jul 25, 2005.

Thread Status:
Not open for further replies.
  1. EEEEE

    EEEEE Guest

    Started by "c:\windows\system32\services.exe" [572]
    [EXECUTION] Commandline - [ "c:\program files\webroot\spy sweeper\wrsssdk.exe" ]
    Tue 26 - 21:32:36 [TERMINATE] c:\program files\webroot\spy sweeper\wrsssdk.exe [3968] was blocked from terminating c:\windows\system32\smss.exe [444]


    why o_O?
     
  2. EEEEEEEEE

    EEEEEEEEE Guest

    im using sygate firewall
     
  3. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
  4. eeeeeeeee

    eeeeeeeee Guest

    thank you :)


    why there is no learing mode for driver or service instialltion?
    because if I need to install new software some time it need to install driver , the instialltion will damege and i need to stop BLOCK ROOTKIT INSTALLITION and install again
    if learing mode allow driver instialltion it will be better :)
    or they use differnet level of learing mode
    like first learing mode allow every thing exept global protection option
    and the second learing mode allow every thing + driver instialltion
    .....learing mode allow every thing + global protection option
     
  5. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    SpySweeper also needs to install a service/driver and as Bubba has said allow the .exe as it is a part of a trusted program.
    A few security programs show this type of behaviour and it is usually the program just checking to make sure it can terminate a process as this may be necessary to stop malware.

    HTH Pilli
     
  6. EEEEE

    EEEEE Guest


    its really clear why spysweeper try to checking to make sure it can terminate a process

    thank you very much
     
  7. please

    is it ok to give SPYSWEEPER and KAV terminate protected application ?
     
  8. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    See above, they both may need to and they are trusted programs :)
     
Thread Status:
Not open for further replies.