Do only 'Monitored' processes increase WRData size ?

Am I correct in thinking that only Monitored processes increase the size of the WRData folder - or are there other reasons that can cause an increase in size ?

 

Some info here: https://www.wilderssecurity.com/showpost.php?p=2016611&postcount=30

i.e. They can whitelist stuff for you, if I'm understanding correctly.

 

Or blacklist if it's bad, but that's very rare.

Scanning adds to the logs in the folder. (Very small)

Changing to a higher level of product adds the secondary things (Toolbar) to that folder. (A few tens of megabytes)

Cleaning up infections creates uncompressed cleanup data in that folder. (This can get pretty big if the threat being cleaned up did a lot of stuff, but usually adds only a few MB at absolutely worst).

Files directly in the folder are generated files made specifically by, for, and specifically useful to your computer. Subfolders are stuff like LastPass (sadly, Usable never ended up working. ;.; ) and sync DB. As an example, my system's direct content is 3.44MB (Half a good quality song) and the toolbar files, thanks to more and more sites getting fancier (more annoying) with their login systems is 38.5 MB (six high quality songs).

Several of the files in the folder are very fluffy. All of the Toolbar DLLs fit into the wrbar.exe as compressed versions, for example. So turning on NTFS compression on the folder if it isn't already should improve things (if you are really desperate for 20MB of space) without a negative impact.

I'd be curious to hear from the Joe:
Is it safe to delete webrootwisc.exe (the anti-old-Webroot cleanup utility IIRC) and wrbar.exe (the installer for the toolbar), or will that impact or they just end up recreated regularly?

 

Thanks very much Dermot and Techfox (posted while I was posting and editing my mini novel back down to just 2 lines), I didn`t notice that thread in the Beta section, but it did have some very useful info and confirmed what I thought.

I seem to spend more time checking up on what WSA is up to and fixing it, rather than just going without and not worrying about it

I was just testing something or other yesterday, and only noticed afterwards that the WRData folder had just shot up by over 50megs (all extra stuff is gone - so just journalling or rollbacks whatever)

I`m even seeing Macrium being monitored which was a surprise...

 

We actually wrap around now so only the last three scans are stored, so scanning further won't grow it by too much, although the start/end of the scan will still be logged into WRLog.log.

You can delete webrootwisc.exe but WRBar.exe is used for the uninstallation of the Lastpass components so you may want to keep it around.

 

This is about my only problem with WSA in certain circumstances, using for instance an unknown garbage cleaner than might move 100's of Meg a day will cause the folder to grow to a worrying size (Xleaner/Wipe for example) or an rare browser such as Pale Moon causes a similar problem.

I use WSA on all PC's but this one which I use a fair amount of Beta/RC & relativity unknown software because it's just isn't practical, you can of course get unknowns white-listed but often such software is updated weekly or more - In normal use it's not an issue.

 

What is the first thing after installing an update? I check if WSA is monitoring the new software (version). Lately I find that much less is monitored, so that is very good. - But since I know what I am doing (not installing malware, just harmless updates) I always immediately STOP monitoring .. for performance reasons and also because someone else can do the monitoring job on their hardware (SSD).

The one thing I really (!) would like to see implemented is for example a circle around the WSA icon (flashing? red?) that indicates: something is just now monitored. - That would remember me to go there and see what it is. On the other hand I understand that Webroot needs people who are running WSA on a system where new software IS monitored. How else would the cloud know what that software is doing. Right. But I guess they have millions of users so I don't have to be the one who provides much monitoring.

When I am talking about the fastest AV there is I always mean to run WSA like I do: stop monitoring for files you KNOW are SAFE. Else you will see temporarily a performance drop. At least on my systems I always "felt" when something was monitored and as a speed junkie I don't like that very much.

 

A monitoring reminder would be useful.

I disable WSA when test installing things - the risk of disaster is by far less annoying than constantly checking, allowing & removing when testing things out.

WSA acting solely as live browser protection would suit me better I think, but can`t figure out how to properly make it do so.

 

Disabling WSA when installing software can cause problems as it will then not have context when the new software is installed (and if it was unknown, WSA would still continue monitoring it once it is installed). I'd recommend leaving WSA on and just manually moving software to Allow if you experience a problem.

I think some non-alarming notification of unknown software would be helpful, although we're working on a more conceptual improvement to unknown monitoring which will hopefully improve the performance in these cases so we could potentially avoid it altogether.

 

Is this just an idea so far or will it be implemented (as far as you know) into the 2014 product which we will see maybe in autumn? - That development sounds very interesting and it is kind of hard to wait for it now, damn.