New WSA User Noticing Slower IE performance

As the title states, I'm trialing WSA (latest release) and ever since installing WSA 3-days ago I'm experiencing a definite IE slowdown (on my WinXP machine)! So I'm wondering if I need to change some WSA settings or what?

Any suggestions would be appreciated.

Cruise

 

Can you please Right Click on the Webroot Tray Icon and Save a Scan Log and can you tell us approximately how many files there are?

This one has a [G] in front but we want to see how many .
[G] c:\program files (x86)\mozilla maintenance service\uninstall.exe [MD5: AEFBD718AF1AABE7820053650C2E2F08] [Flags: 40000000.3]

Don't post the files just how many!

Thanks,

TH

 

Sure thing; I'll do that as soon as I get home (in about 2 hours). Fwiw, that PC was running Privatefirewall and MSE (both of which were removed before installing WSA) and IE ran much smoother and faster with that combo than with WSA!

 

If you have more than 20 or so I would Submit a Support Ticket and put all the files in the ticket to get them whitelised. If that doesn't help try a clean reinstall with a Reboot in between.

Cheers,

TH

 

Hi TH,

I just arrived home and created that log. In total there are 1890 [ ] entries! ...but only 11 of them are , the rest are [G] entries. What's the significance of entries?

Cruise

 

If my memory serves me right, stands for unknown. I think those files aren't blocked, but Webroot doesn't trust them, yet. This is why TH suggested writing into Support with those lines so those files could be whitelisted.

 

Checking the scan log on one of my machines, I've got roughly 70 entries listed. Is it recommended to open a support ticket in a case like mine? Most of the entries are related to rather common programs like Macrium Reflect and UltraDefrag. I'm surprised to see that Reflect is still in an untrusted status. Also, I had supposed that if I changed a process (such as ReflectService.exe) to 'Allow' it would no longer be monitored, but the scan log indicates otherwise.

 

Yes it is as with that many nknown files could possibly slow down any part of the system such as the Browser in this case it best to contact support inbox with the above link.

Daniel

 

In your case you are finding that your system performance is being affected it is best to contact the Support inbox and they might want more detailed logs from your system. Because the thing about WSA it shouldn't affect system performance as it has the best score of any AV out there by a large margin tested by Passmark: https://community.webroot.com/t5/Se...e-s-latest-test-April-26-2013/m-p/38092#M1572

Daniel

 

Last time I had WSA installed (don't remember what version exactly) I did notice some websites to load a bit slower. But only on websites that were flash based, or had a lot of flash content on them. But WSA doesn't affect the system performance as TH already said so that's nothing to worry about.

Edit: Also on XP just for the record. But it's over a year ago now, so the software has changed quite a bit since then.

 

does not mean "Monitored", it means "Unknown". Something that is set to "Allow" locally will still show as .

The granularity of Allow/Monitor controls in the GUI is very much lacking compared to the cloud. You cannot Allow an unknown DLL for example, so anything that loads it will be monitored because of the DLL. Thus, getting the information to TR makes a difference. It also helps people who don't manually change things.

The cloud makes a lot of "Okay, I trust this" determinations automatically, but you can check with any TR and find out that there are MILLIONS of safe s out there that never get to a high enough age and saturation to be automatically determined by the cloud. As long as sections of the code don't run, the cloud will not determine it safe.

 

If I'd like to get some files whitelisted and open a ticket should I just send the MD5 of the files? Or should I upload them ore something?

 

You have a few choices:
You can just submit a ticket and say "Hey, there are a lot of unknowns on my logs. Halp?" and then WSA will submit the supporting information all on its own for you unless it doesn't in which case the peeps will ask you to send the full lines of items from the logs (They have the ability to easily import log results).

You can submit and paste the full lines from the logs in which case they will use the auto-sent information or use the U lines you sent if the auto-send failed.

OR

You can submit the MD5s in which case they will use the auto-send if it worked or not if it didn't and will either work with the MD5's (slowerly) or ask you for the full U lines.

I recommend the second option for the best speed of result.

 

I see, Thanks a lot

 

As it turned out, another security app (Shadow Defender) which I use all the time with IE was untrusted by WSA. Having submitted my log to tech support last week they just advised me that they have white-listed Shadow Defender. Since SD was an untrusted app (by WSA) it seems that was responsible for my IE slowdown - now that SD has been white-listed IE is performing well.

Cruise

 

Great to hear IE is now performing normally for you.

 

I checked how many I had when I read this, more than 80, so I contacted support and they whitelisted them, though they explained that unknown / files don't directly slow down your computer, only monitored processes which can be found at the end of the scan log:

 

True, although it does create some additional load on our database, so we prefer to whitelist files when we can tell that they are definitely legitimate.

 

Thanks for the explanation