for testing purposes i uninstalled wsa and cleaned with ccleaner just to do a basic registry clean. then rebooted. installed bullgaurd (i own a lic to it and wanted to test it out for a specific reason) and with webroot UNINSTALLED its firewall is saying webroot was granted access out to the internet and when i try to delete the webroot folder in programs folder its saying denied because its in use why after uninstalling and rebooting would wsa still be asking for a connection i was finally able to delete it but had to do so in safe mode. can anyone tell me why after removal its asking for a connection and why is it blocked from deleting the folder? thanks p.s.ill be reinstalling it soon enough BUT i dont dont want to run into this in the future. also is there any kind of removal tool because after uninstall there are many keys and some folders etc left behind. do they have a actual tool to fully remove this stuff like others do??
Unless something blocks it from uninstalling correctly, the only thing that is left behind is a single file in the temp folder. If the file can't be deleted because it's still in use, it didn't uninstall properly. If there is no copy of WRSA.exe (or a renamed version) still running, then -something- has locked down the file from an outside standpoint. If there is a randomized-name version still running, then there was something interfering with its original installation. Other security programs playing badly or a TDSS or TDL4 infection will both do either of these on occasion.
was just coming to post... somehow it must have not removed itself properly. i checked the programs list after the first reboot and it was back on the list?? then uninstalled it again and rebooted and once again it was on the list, this time i did it in safe mode and it is finally gone. i have no idea what was blocking it. at the time of removal there was NO OTHER security programs or anything else that would have been preventing it from removal as far as i know. this was a system with win 7 x64 and office 2013 and nothing else but webroot. its my test system for specifically testing programs like this. and def not infected as i just did a fresh install this morning and this system has not even been online except to go here to wilders today it has gone NO WHERE else.
*Ponders* (Though I could point out that a reinstall of the OS won't necessarily remove a TDL4-PL infection, I doubt that's the issue. ) Did you reboot between installation and uninstallation? That's the only thing I can think of. Possibly a post-install/post-reboot finishing of the install that un-uninstalls it. But even then, on a fresh VM here, I can't get it to not uninstall when I ask it to.
yes rebooted for sure. i almost 100% positive its not a tdl4-pl. ive also purposely killed and reflashed the bios completely using the phoenix crisis recovery.
I must say I have never had this issue, after the WSA installer erm uninstalls you can do a search with a registry search program (I use an old but good program called 'Registry Crawler') this finds about 18 entries usually related to the toolbar. As regards files if you search for Webroot etc you find the odd file usually in Firefox & that's it. A good program that searches all files (hidden & system) far faster than windows is 'Free Commander' which is most useful & as the name implies is Free No files left have ever attempted internet access. I have done this countless times with the same results. Of all the AV's in the known universe WSA does the best job of uninstalling I have yet to come across.
I haven't heard of this either. It's probably worth watching but as long as you're installed properly, I wouldn't be worried now
@zdfactor - Just read this thread again & my post wasn't meant to be as harsh as it was, sorry if it came across that way, I hope it didn't cause you offense - Regards Paul
