Webroot SecureAnywhere Discussion & Update Thread

Those files were white-listed yesterday, although I didn't notice any tickets from users with issues. I`ll test it in a VM now, If anybody has any further issues please let me know.

Looks like everything is working OK in my VM with Anti-Exploit

 

Out of curiosity, do you guys wait for tickets to drop in before you sort out the u files?
Seems to defeat the purpose of a cloud antivirus?
The non savvy users depend on you, the pros at Webroot, to sort this out, they will never even know if a file is monitored.
Don´t get me wrong, I really like this product, but this is what I see when these users running WSA.
This seem to be a area to improve, to be faster sorting out the u:s, without the help of users.

Cheers

/E

 

We have a number of queries that we look at on a 30 minute basis (usually less than that), common files, new files, updated files,monitored files, system files updated,files seen on a certain amount of PC's etc.

MBAM Anti-exploit was actually already installed on a test VM and was working perfectly for me. I haven't seen any issue with in our support system, a lot of people use MBAM so if there were an issue we would see it fairly quickly.Generally speaking a program shouldn't have a problem even if its being monitored, and a file that is U doesn't mean that it will be monitored. That is one misconception that people sometimes have about our software. In the case of the malwarebytes files that were mentioned in here only one of them was being monitored and it wasn't causing an issue in my VM.

 

Good to know that a U does not always mean it is monitored.
In that case I was more speaking of monitored files, I have been called out to fix faulty software installations, were the installation file were monitored by WSA, stopping it from install properly.

This has been legal, but unknown software's to WSA, monitored for days and more until I did allow them by hand, to get them to install or in case they did install work properly.

/E

 

Some custom software or software that isn't very popular may slip through the net and will require a customer to send in a ticket to support. I have seen customer software used by companies that may only been seen on 3 or 4 PC's. Generally though installation programs being monitored wont stop them from installing unless there is a file that is detected bad in the package/installation process. It's worth noting that monitoring isnt an on/off process either, there are multiple levels of monitoring depending on what the process is trying to do. Very light monitoring will realistically never cause any issues.

For instance here log snippet's from a test PC:

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [F79623288F2A357AB20288B5DC4F452A]. Type: 1

This is only type 1 monitoring (checking net connections) for the flash updater service. Service works fine and Flash will update perfectly.

Monitoring process c:\users\admin\appdata\local\temp\ovobivqz.exe [---------------------------------------]. Type: 9 (11272)

Here however is a fake AV that is getting a bit more attention from the client (sandboxing,analysing etc)

 

Actually the counter shows 1 when I open google chrome and the logs page shows protected. What happens is Chrome just hangs and will not function. Thanks for your help vojta.

 

You are too quick for me! I didn't get a chance to contact webroot yet but thank you. At first I thought I had to adjust WSA and MBAE would work but I think my issues with MBAE are not connected to WSA. I uninstalled MBAE and when I have time I will contact support for MBAE.

 

(Version 8.0.6.28 (Released December 9th, 2014)
Enhanced

• Journaling and rollback for very large change journals.
• Console data set.

Added

• Support for new web filtering rollout.

Fixed

• Conflict with Kaseya remote keyboard.

Improved

• LSP chain repair during remediation.

Updated

• User Interface for tray messages.
• Further scan engine improvements.

http://www5.nohold.net/Webroot/ukp.aspx?pid=10&app=vw&vw=1&login=1&json=1&solutionid=1098&

 

Will you please give me some examples of programs, besides browsers, that you have added to application protection?

 

I have here any Web facing apps like Outlook, Snagit and Word even Adobe Reader: https://www.wilderssecurity.com/thre...ion-update-thread.364655/page-29#post-2430686

HTH,

TH

 

Thanks, TH.
One more thing, have you seen the following error? See attached.

Go to Active Connections and double-click any process.

version 8.0.6.28
W8.1 x64

 

Have you rebooted since WSA updated? Also how about Windows Updates?

Thanks,

Daniel

 

Yes, I rebooted and all Windows updates have been applied. The problem didn't start with 8.0.6.28, it was also present in the previous version. I manually updated to the newest version to see if it would take care of the problem.

 

Can you please do a clean reinstall of WSA and Please follow the steps closely!

• Make sure you have a copy of your Keycode
• KEEP the computer online for Uninstall and Reinstall to make sure it works correctly
• Download a Copy Here
• Uninstall WSA and Reboot
• Install with the new installer, enter your Keycode and don't import any settings as you can set it up as you like once it's done
• Let it finish it's install scan
• Reboot once again

Please let us know if that resolves your issue?

Thanks,

Daniel

 

I followed your instructions and still receive the error message.

 

Okay now you have to contact Webroot Customer Service so they can look into it deeper as I have not seen this issue but if others did then support would know. But please come back and let us know how it went.

Thanks,

Daniel

 

I submitted a ticket and will let you know what support comes up with. Thanks for the help.

 

Great and it's my pleasure!

Daniel

 

Now that I think about it, I don't think the GUI is supposed to open any options to allow or block connections since I'm on Windows 8.1. Could it be that the error is there because the option in Windows 8 is not there? Maybe, it should be non-clickable.

 

The Perfect Malware Storm

Via the Webroot YouTube Channel

https://www.youtube.com/watch?v=05s7cvDzaro&list=UU4smGh0DLnbm5I6WfBPsCrw

TH

 

Thanks for the link.

 

Is there a way to make WSA work together with WFC?

How can I be a betatester of the 2015 edition?

Is there any reported incompatibility with MBAE

 

As far as I hear it works fine with Windows Firewall Control and no issues with MBAE as Roy tested the 2 fully: https://www.wilderssecurity.com/thre...ion-update-thread.364655/page-33#post-2435370 . Also they don't use the year anymore they decided to go via a Road-map of things they want to do for the year so it's a continuing process! As far as I can say they are improving the Web Shield the Rollback and Remediation engine for new threats the UI is staying the same and 1 or 2 new things for the coming year.

Here is the Link for anyone that what's to be a BETA Tester: https://community.webroot.com/t5/An.../Looking-for-Webroot-Beta-testers/td-p/175350

Cheers,

Daniel

 

I'm on windows 8 with WFC and the latest version of WRA and WFC doesn't work, It doesn't save apps allowed and the list of allowed apps has been wiped out after WRA installation.
I will uninstall and install WFC to see if it works. If you need any other information let me know, or where should I report this bug?

BTW I see that WR doesn't appear in almost any test, AVC or AVtest, is there any report about the performance or detection/protection?

 

Well all I know is some at the Webroot Community use WSA, WFC on Win 8.1 with no issues and they even recommend it. I myself never tried WFC as I still use LNS on Win 7 x64.

Here is a Test from MRG: https://community.webroot.com/t5/An...s-360-Assessment-amp-Certification/m-p/164205 and the reason why WSA is not being tested and nothing new has come up: https://community.webroot.com/t5/An...m-AV-Comparatives-and-Webroot/m-p/17708#M1115

TH