Endpoint Protection

Another user clicked on a fake AV warning message and it was allowed to run.
Why is this still happening?

It is actually Personal Antivirus.  I see there is another thread asking why pav.exe is still allowed to run at this late date.
https://www-secure.symantec.com/connect/forums/personal-antivirus-why-doesnt-sav-11-detect-and-remove-its-been-out-while

Please submit a sample of the threat to Security Response so that it can be analyzed and added to our definitions.
https://submit.symantec.com/gold

Also, we may already have definitions available for the particular variant of this threat you are facing if you want to try out the latest Rapid Release definitions.

Title: 'Applying rapid release definitions to a Symantec Endpoint Protection (SEP) client.'
Document ID: 2008052116163448
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008052116163448?Open&seg=ent

On a positive note, the girlfriend was surfing facebook Saturday and Pav.exe was caught and blocked without issue before it was able to infect my PC. Granted I'm running Norton Internet Security 2009 for my home computers, but definitions to detect it would've been in SEP as well. =)

Hope that helps!