Macrium Reflect & WSA AV

Hi guys...

New to WSA AV. Just installed last night and thus far all is well and running smoothly. (Version 8.0.3.3 provided via an offer through a financial institution.)

I did a system image with Drive Snapshot earlier which went fine...however, when I wanted to do an image with Macrium Reflect, Macrium would start to load but (apparently) aborted. This happened multiple times.

What do I have to do (besides shut off protection, which is what I ended up doing) when I want to make an image with Macrium Reflect (Standard edition)?

Other than that, no problems to report as yet.

Thanks in advance. Looking forward to learning the ins and outs of WSA.

 

Hi Blues7

Check in 'Block/Allow Files'...from main GUI click the cog/gear to the right of PC Security tab; you should see the tab on the extreme right of the next panel displayed. in there you should see a list of files/.exes on the left and to the right 3 columns for 'Allow', 'Block' & 'Monitor' options per entry. Check to make sure that no Macrium-related file oand/or .exe is set to 'Block'. If any are then change them to 'Monitor' by clicking on the appropriate radio button, and then once having returned to the main GUI, try launching Macrium again.

If that does not work then post back.

Regards, Baldrick

 

Thanks, Baldrick. I'm not sure that this GUI has the setup you are referring to.

Here's a link to an image of what it looks like from an online source:

http://linkdownload123.com/wp-content/uploads/2013/09/webroot_secureanywhere.jpg

Appreciate any info you can provide.

 

I did notice that in the quarantine area there was "detection configuration" to include apps that you wanted to allow, monitor or exclude.

Reflect service was in there but it would not allow me to add reflect.exe By the way, reflectservice.exe is in "Red" letters.

I tried a few times to reflect.exe but each time I clicked the executable it reverted back to the list but no additional entry was made.

 

Hi Blues7

Apologies...I did not register the version that you are using. Sounds like WSA has quarantined the Reflect service, so in this case, if you are happy that this is a legit part of Macrium, you should Restore the .exe...if I recall you have to check the checkbox against the entry and then click on Restore button. That should replace the .exe where it should be.

Give that a try and post back with a screen capture of the Quarantine panel, if that does not work.

Regards


Baldrick

 

Actually, there's nothing in quarantine. It's empty.

reflectservice.exe is a running service that Macrium tells you not to disable or shut down. (I've never had an issue with it.)

I changed the status of reflectservice.exe to "allow" from "monitor" in the running processes list.

When I go to the quarantine area and select "detection" configuration, reflectservice.exe is listed there in red with "allow".

However, I cannot add reflect.exe from the "add" button as after it is selected it goes back to the list without making the additional entry.

It's not a huge deal, I can just shut down protection for the few minutes that it takes to make the image...I just thought it would be a simple process to tell WSA to exclude or allow it.

 

Hi Blues7

OK, let me see if I can summon some more knowledgeable help for you (as I do not have that version installed and my memory of this earlier version is somewhat fuzzy)...don't go away.

Regards


Baldrick

 

I'll be here watching sports on the telly. Thanks, mate.

 

What download link did they give you? It's fine to post!

Thanks,

Daniel

 

Hi Daniel. The link was supplied when you were securely logged into your account at the financial institution and then connected to their security center.

At that point there was a link to download the software and you connected to a Webroot site where the software and keycode was downloaded.
(I don't recall it providing different version options and the keycode was already embedded in the installation executable (as well as an advisory to save the keycode in a safe place.)

 

OK wait for a reply from Joe on this as that's still the 2013 version and I'm not sure if it's upgradeable to the 2014 version?

Thanks,

Daniel

 

Daniel,

Check your PM for additional info.

 

Got it and replied!

Daniel

 

Could you send me the download link via PM as well? There are quite a few differences in the builds targeted to our bank customers which could explain your experiences.

Thanks!

 

I removed 8.0.3.3 and installed the current version. It accepted the keycode from the original installation (and time remaining) upon entering it.

As I mentioned to Daniel, the link for the download offer is contained within the financial institution and one must be securely logged into their own account before one can access the offer or download. Everything is done and completed while one is logged into the financial site.

Someone from Webroot would need to contact the financial institution and provide them with a link to the updated software if they wanted to make it available.

Oh, and for the record, the new version did not allow Macrium Reflect to run either. (It would allow me to add four of the five processes that were marked as "U" in the Scan Log...but not "reflect.exe" and thus it would not run without shutting down protection.)

Thankfully, WSA has no such issues with Drive Snapshot, my primary imaging program.

(And I'd like to extend a personal thanks to Daniel for his generous help and assistance via PM yesterday. Thank you, my friend.)

 

To make matters a little more confusing, I use both WSA and Macrium Reflect and I've had no issues running both. Now, I did have WSA installed prior to installing MR, but, I have had no issues using or running MR while having WSA installed and active.

 

The plot thickens...

I've never had an issue using Macrium in the past regardless of the AV, FW, HIPS etc, (or lack thereof), on my system.

As I say, it's a simple enough matter to shut off protection and create a new image and I don't need to do so with Drive Snapshot.

Must be some other nefarious discombobulation at hand.

 

Sorry for the "me too" but...me too.

 

Now you're just piling on and trying to make me feel bad.

 

Could you save a scan log and send it to my username at gmail.com so that I can take a look?

Thanks!

 

Done...and you're welcome.

 

Thanks for the log - we've improved the handling of this on our side. Could you try running a scan and restart the browser to see if it works any better now?

Thanks!

 

I'll do so momentarily. But it's the browser you're interested in...not Macrium?

 

Joe,

Just in case you meant Macrium Reflect (as I suspect you did), I went ahead, ran the scan and then tried to open up the app.

Ta-da!!! You've done it. It opened up.

To celebrate, I'm going to close my browser and create an image with Macrium.

I'll be back in a bit.

Thanks to you and staff. Awesome work.

 

Okay, so here's what I found...

Made an image successfully with both Macrium and Drive Snapshot.

However, after I rebooted, it took a long time (many seconds longer than normal) for the desktop to appear. Okay, not too bad.

When I started Thunderbird (supervised by Sandboxie), the screen froze with the cursor in an hourglass and I couldn't do anything. Had to do a hard reset.

Rebooted. This time it was quicker to the desktop and no system lockup.

There is an odd thing I see though. Oftentimes, right after I reboot and log back on, the screen goes black for a second or so before it goes back to normal display. This can occur when the desktop first loads or even after I start Thunderbird or Firefox (both supervised by Sandboxie.)
Any thoughts why this may occur? I'd not experienced this previously.

Anyway, I'm here typing so all is at least mostly well. Probably just some kinks that still need to be worked out.