Webroot SecureAnywhere Discussion & Update Thread

Webroot announces integration with BrightGauge

https://www.helpnetsecurity.com/2018/07/18/webroot-brightgauge-partnership/

 

Was going to buy a year subscriptin for WSA after a successful trial but noticed that it is an ongoing sub which auto renews.

Not happy this model.
Is there anywhere i can buy a download key? (UK based so best buy CD is not an option)

 

You can Opt out here: https://www.webroot.com/customerSupport/auto_renewal_optout_lightbox.php

 

I just today became a WSA user. Love at first sight!

1- I note that WSA has a Web Shield . I am a long-time user of MalwareBytes AntiExploit (MBAE). As its name denotes, MBAE stops nasties from exploiting/taking-over/discumbooberating one's browser. Does WSA's Web Shield do this same job, thus enabling me to cease using MBAE? If not, then what DOES Web Shield do that I have never missed until now?

2- I use EXE Radar PRO (ERP) -- an anti-execution program -- version 3.1. On it, rundll32.exe is categorized as "Vulnerable". Thus, ERP pops alerts every time a process uses it. WSA makes VERY frequent use of rundll32.exe. This is driving me nuts with ERP's pop-ups.

Is there anyone else here who is running WSA together with ERP 3.1? If so, how have you handled this issue?

 

I'm not having "this" issue.
WSA Antivirus 9.0.21.18 + ERP 3.1.0.0 Build-24062015

Code:

C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe

You have (Webroot) wrsa.exe whitelisted?
You run WSA Plus or Complete?

 

1) webroot are developing anti exploit technology so i doubt web shield protects you from that.
Easy answer is to have it activated and see if there is a conflict

2) I use nvt osarmor to restrict rundll32.exe as it has exclusions

 

@Thankful might be helpful to ya
https://www.wilderssecurity.com/threads/newegg-com-av-specials.361072/

 

https://download.purplus.com/ProductDetails.asp?ProductCode=D834345

 

About the Web Shield: https://docs.webroot.com/us/en/home...wall%20%2F%20Web%20Shield%20Protection|_____2

Web shield — Blocks known threats encountered on the Internet and displays a warning. The Web shield maintains information on more than 200 million URLs and IP addresses to comprise the most accurate and comprehensive data available for classifying content and detecting malicious sites.

 

My apologies, but I've never heard of the Purplus website/company. It is legit? Is it safe to purchase software from there?

P.S. Webroot IS is currently out of stock.... Check back tomorrow.

 

This is always a good deal and just pick your country on check out: https://www.webroot.com/us/en/home/affiliates/wsc-29

 

@ bjm -- The fact that you aren't having this issue gave me the clue I needed -- that the problem is me (as usual), not the software. So I re-checked my whitelisting of WSA on EXE Radar PRO. My error: although I whitelisted Webroot as a process, I failed to whitelist it as a parent (for issuing commands).

@ Triple Helix -- Thanks for the info re Web Shield. When I run my browser, WSA issues about six commands of the structure shown below, each with a different "SynProc" number at the end. Since I have disabled Web Shield, any idea why WSA is doing this?

@ anyone -- I am running MalwareBytes AntiExploit (MBAE) & OSArmor so I think WSA's Web Shield is not needed in my case. Agree? Disagree?

 

Surely the web shield is a blocklist for bad sites that are known to host malware?
Thus keep it installed.

 

MBAE & OSA already neutralize the "badness" of bad sites but I won't harp on the point. Web Shield is good protection but just not essential in my unique situation. In any event, I have now enabled Web Shield JUST to get rid of the dadgummed exclamation point in my system tray.

 

Um, do you run WSA Password Manager n'/or WSA Backup & Sync?
With Webroot Antivirus I have Running Processes and no Parent Process.

 

I certainly agree with the sillyness of that pesky exclam in thw system tray there should be an option to turn it off like windows security centre.

 

Code:

"C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc 1296

https://community.webroot.com/t5/We...tallation-Folder-and-File-Locations/ta-p/3766

C:\Windows\System32\WRusr.dll
or C:\Windows\SysWow64\WRusr.dll
- This loads for user mode analysis. It's responsible for WRSA running as a user mode service. WRSA will be loaded equally proportionately to the number of user profiles that are loaded because of this file.

 

The Web Shield is much more complex than any other's see this short video: https://youtu.be/v3gjcOH9kec Based on Webroot BrightCloud: https://www.brightcloud.com/

 

Thanks 3XHelix. I shall run Web Shield with aplomb. Taihen arigato for the tutorial lynx.

Negatory on both of those. Triple Helix explained this behavior a bit further down the thread from your post.

 

I am running WSA plus OSArmor & EXE Radar Pro. Now Windows update want to install/run "Windows Malicious Software Removal Tool July 2018" on my computer. I don't think I need it..... but do I?

 

Dont.
It doesn't give you an option to remove. Just does it.
Got rid of some of my software can't remember wthough.

 

Interesting! I've always accepted and downloaded the Windows Malicious Software Removal Tool(s). Maybe there's an argument out there that, if I already have good & solid malware protection, I don't need to and/or even shouldn't. Any thoughts on this, @Triple Helix ??

 

Hmm interesting, It's never done that to me. Maybe another update I will have to skip on Win 7.

 

I always let the Windows Malicious Software Removal Tool run each month as it's part of the Monthly Windows Updates. Windows 10 Pro here and to me it's not a big deal.