Explorer.exe monitored, and limit of user control


Userlevel 1
Badge +1
Hello again, not here very often but I have some questions that I could not find answers to.

1.- If a program is monitored, it will not go back to "Allow" after some time, even when it is a known safe program?
 
What got me worried a bit is that after a fresh install, WSA set explorer.exe (and lsm.exe) to monitor. Both 100% clean on virustotal. Is this a new default behavior or should I REALLY start worrying?
 
2.- When I allow a trusted program, it still gets blocked?
 
In this case GSC.exe, I get a "The application was unable to start correctly (0xc0000018)" message. When I disable the realtime shield, it runs.
I like very much how WSA protects you, even if you don't want it to haha!
 
Seriously, I trust you guys know what is best, but where is the limit of user control. I know GSC has FP issues but is considered safe. So if a user allows a program, why not keep monitoring it instead of blocking it completely?

cheers,
Wammes

27 replies

Userlevel 7
Badge +56
 Sorry you're having these problems.  Best bet would be to contact our support team and they should be able to help you out.
Userlevel 1
Badge +1
ok, thanks for the response. thought I go to the forum first, to find out if there are similar issues...
Userlevel 7
Badge +56
Thanks for trying the community first - unfortunately in this case we couldn't help you 🙂
Userlevel 1
Badge +1
:D
posting a support ticket right now. if anything useable comes out i will share with the community ;)
Userlevel 7
Badge +56
Appreciate it!
Userlevel 7
Badge +56
What version of Windows are you having this on and if it's 32bit or 64bit?
 
Thanks,
 
Daniel
Userlevel 1
Badge +1
hihi... I thought it handy to put my specs in my sig... ;)
 
Win7 32 bit
Userlevel 7
Badge +56
Thanks just making sure so I'm going to check my Win 7 32bit VM to see what I can see!
 
Thanks,
 
Daniel
Userlevel 1
Badge +1
thanks Daniel
Userlevel 7
Badge +56
Looks good here.
 


 

Userlevel 1
Badge +1
Yes that was always the case with me too, until I reinstalled WSA. I thought it might be a new default? did a virustotal scan to be sure - was 100% clean...
Userlevel 7
Badge +56
Can you please do another clean reinstall of WSA? Download a Copy Here and make sure you have a copy of your keycode then Uninstall WSA and Reboot and install with the new installer let it finish it's install scan then Reboot once again and please let us know if that corrects your issue also don't import any settings and after you can set it up the way you like?
 
Thanks,
 
Daniel ;)
 
 
Userlevel 1
Badge +1
OK will do!
report back in a jiffy
Userlevel 1
Badge +1
...I am confused.
uninstalled WSA (from start menu-uninstall)
turned of PC (instead of restart)
exec your downloaded wsainstaller
and got a BLUE wsa screen immediately, without asking for a key.
 let it scan and a few items are monitored. 
I got screenshots
Userlevel 1
Badge +1
https://dl.dropboxusercontent.com/u/9534399/Clipboard01.jpg
https://dl.dropboxusercontent.com/u/9534399/Clipboard02.jpg
 
Userlevel 7
Badge +56
Strange can you enter your keycode here to see in it will activate http://www.webroot.com/En_US/SecureAnywhere/PC/WSA_PC_Help.htm#C12_MyAccount/CH11b_ActivatingKeycode.htm and the support inbox will have a look at your scan log maybe some unknown file is using explorer.exe and WSA is keeping an eye on it.
 
Daniel
Userlevel 1
Badge +1
done. do i need to post the log?
(it activated)
Userlevel 7
Badge +56
No support will get it from you and they can check to see what's going on and Whitelist the needed files but please let us know the outcome as it could help other users!
 
Thanks,
 
Daniel
Userlevel 1
Badge +1
Of course!
Thank you for your help :)
 
 
Userlevel 7
Badge +56
Your welcome I think that some files just need to be Whitelisted and you will be fine and the support inbox will let you know!
 
Daniel
Userlevel 7
Badge +6
WSA's behavior during installation has been inconsistent to me.
Sometimes it will just wipe virtually every trace of it away, othertimes it will leave stuff like the keycode ready for a reinstall.
May be a difference between Enterprise and Consumer versions, though...
Userlevel 7
Badge +56
Well I know there are leftovers from unistalling in many places it would be nice if WSA could remove all leftovers sometimes WRData Remains after uninstall.
 
Daniel
Userlevel 7
Badge +62
Hi! I had to use TidyUp on Mac to clean up WSA for reinstalling...
Userlevel 7
Badge +56
It's much different in Windows because of IE11 and the Web Filter.
 
Daniel
Userlevel 7
Badge +62
Alrighty then! Smiley/wink

Sherry

Reply