My theory is that one of the instances (maybe even "System") has a dialogue box open that nobody is clicking on - perhaps a prompt to clean the infection.
I stumbled upon a quick, no-reboot fix.
1. Shut down Protection (a bit scary, but not as bad as having a frozen AV product!)
2. Kill all WRSA processes.
3. Restart the WRSVC
4. Scan away!
We use Labtech to make killing the processes and restarting the service a bit easier. Also Process Explorer comes in handy to watch them all stop and restart.
Come to think of it, it is also possible that a -poll command sent in the background produced a dialogue box that nobody even sees to click on.
Best answer by JohnnyS
View original