issue with newest wsa and perfectdisk

confirmed on three laptops. perfectdisk took nearly 4 hours to defrag a drive with wsa turned on. tested 3 times. turned off wsa and drive defraged in less than 30minutes. then started a defrag with wsa turned on perfectdisk was taking forever turned off wsa and perfectdisk started moving right along. same behaviour on three laptops.

i was pulling my hair out trying to figure out why this specific laptop was taking so long to defrag and just almost sitting there. only to for other reasons turned off wsa for a short time during the defrag and saw it start cruising along.

perfectdisk version 12.5 and newest wsa retail. windows 7 x64

 

follow up. if i exclude the perfectdisk stuff from wsa all works fine. not sure why i never saw this before the newest version of wsa.

 

I suspect a new version of Perfectdisk isn't whitelisted so it's being monitored. Sending a log to our support team will allow them to whitelist it centrally and avoid problems elsewhere.

Let me know if you find anything else!

 

I have PerfectDisk 12.5 build 312 (which is the latest build for v12.5) on Windows 7x64 + the latest WSA and don't experience this problem. Do you have the same version/build of PD?

 

not sure what version it was i uninstalled it already. perfectdisk 13 is what im using now which seems fine right off the bat. so not sure what was going on but all seems fine now.

 

You can always look at the scan log to see if any of perfectdisk files are Unknown or being monitored? And if they are just send the lines to the Support Inbox to get them whitelisted.

Daniel

 

i submitted it to support when i had the issue and not sure if they fixed it or not. sadly no logs because in trying to fix the issue i fully uninstalled and reinstalled webroot during testing

 

I had the same problem with Perfect Disc 13 - (I was away when several users upgraded (AKA my sons company) & had the same issue & this was the sort of final straw) As it's a rather popular program I was surprised it want white-listed within a week or so of final & was actually on deny (why don't probably the most popular defragger get white-listed?) - I still feel the huge (with bells on) weakness with WSA is when a program is on deny or monitored there is no obvious indication this is being done or what a basic user should do IMHO this needs sorting, most users have no idea of what white-listing is.

The amount of people I have recommended WSA to who wonder why they can't copy-paste etc. & have no idea why is becoming to me embarrassing to the point I'm no longer going to recommend WSA until there is some form of plain indication to a user that a program is under severe restriction or when a program is apparently misbehaving (that is actually being denied privileges by WSA) or using gigs of space monitoring well in excess of even the most bloated traditional AV solution?

Sorry if this seems overly forthright but all my PC's now have ESET on because of this - Am I alone with this issue?

I'm not certainly not here to troll & there must be dozens of users who have WSA because of me but it does seem when software such as Raxco/WinPatrol/Serif Software/Stardock/Softmaker/DBPowerAmp suite/almost all cleaners other than CCleaner etc. which aren't exactly rare are on monitor or deny for some time I can only question the system used for white-listing? And on each incremental update a program that makes changes to the system needs to be re-submitted to be white-listed I wonder what are the advantages of using WSA are? Bragging about the size of the tiny initial install when it clocking up large amounts of space logging seems to me to be somewhat futile & at the same time buggering programs up that are harmless & popular.

It seems It seems to me only the most basic programs are white-listed auto, I can only assume most users don't know they are being monitored & using GIGS of space & or slowing a PC down - I'm sorry but I'm moving on & as an ex Prevx user that's sad but with 16 GIG of RAM I can deal with ESET's slightly larger footprint as it install & forget - Any input from Webroot? Because I've been made to look a right prat this last fortnight while I was on holiday - I appreciate WSA works for some but no longer for me.... I have a life & submitting files to be white-listed each time a program stops working or is updated is not part of it.

 

I also discovered recently that WSA was blocking a new program I installed, but it took a little while to figure out. It really would be helpful if WSA had a notify option when blocking for users who aren't worried by pop-ups.

 

We're in the process of some significant improvements to our journaling logic, to identify pre-existing applications as they update as well as more popular applications to avoid excessive journaling just because they haven't yet been whitelisted. These are being researched/implemented cautiously as there can potentially be security implications but we're investigating it as we speak to prevent the cases you're describing.

 

I also had an issue with another program not functioning correctly because a main .dll file was in the protected files under WSA identity tab. I think its the identity shield that is buggy atm and needs regular checks to see if a program is under the protected files where it shouldn't.

 

It's possible that the DLL was trying to access protected data. Changing it to 'Allow' if it was listed as 'Deny' would be the way to get around it.

 

That's good to hear!

 

I find that Webroot takes several weeks (and sometimes longer) to reclassify files from "monitor" or "deny" to "allow" without manual intervention.

So, once a week or so, I go through my Scan Log to see if any files are "unknown" and designated with a . If I find any such files listed in the Scan Log, I simply e-mail them to Webroot Technical Support and ask that they whitelist them. Within 24hrs the files are whitelisted by Webroot staff, and all is good.

 

problem with this is for the normal customer they will never check the logs to see if wsa is what is causing the issues. i love it and recc it very highly but hopefully in a few areas the improvements joe mentions will help these issues. also i actually had no issues with pd13 it was the newest version of perfectdisk 12.5 that gave me this issue

 

Or hire more TR.
Or have a system to auto-validate certain software.

But I do see where there is a potential for problems. It's not at all unheard of for an official update to be subjugated and contain malware. Users leap on them the moment they come out, so it's a great way to mass-infect a buttload of peeps automagically.

I try to avoid jumping on updates for about a month and often not until the next update release. This has saved me from one subjugated update infection and from dozens of bugs that were fixed in the next update. Now, if Webroot doesn't see it as good within a month, then something might be wrong, but I'd rather make sure my system is stable than end up having update problems.

 

Personally I think erring on the side of blocking unrecognized software is a good thing. WSA just needs to alert when it blocks so we can know and not wonder why an app has stopped working - at least make "alerting" an option for advanced users.

 

What if it kept a list of things that it blocked or monitored that you could review at your leisure?

 

That's already provided, under the Block/Allow files and Control Active Processes. Changing a file to 'Allow' under Control Active Processes will disable journaling for it.

 

Victek, I think that this is a good idea but would add to it a little more granularity to cover when something has been placed automatically by WSA in a monitoring state; so perhaps an option for notification On/Off & then either Monitor or Blocks only or Both.

That way the user can decide how much information is to be provided (the paranoid can set everything to on and go to popup heaven whilst the more laid back can just get a popup on Block only, and the completely horizontal amongst users get no warnings at all...not that they would care., etc. )

But, seriously, I support your idea.

Regards


Baldrick

 

I think they designed WR so it won't show notifications for Monitoring on purpose. "Average Joe" probably won't know what "monitoring" means, he might get scared unnecessary, probably endig up in a support call.