Twice in two days I've had customers with Webroot installed call because they opened a Web page that displayed some kind of virus alert. Their browsers were locked (unable to be closed normally) but I was able to close them using taskkill. Their computers were otherwise unaffected (as far as I can tell, and I did take time to review them both).
Is Webroot supposed to intercept that kind of activity? If so, it didn't work in these two cases, although nothing else malicious ran on them (again, as far as I can tell). Would some forensic information help to defend against this sort of thing? If so, I should be able to collect information from both computers.