Nastiest Malware 2018 - Live Q&A - November 19th 2018

@ asks: "Maybe someone can answer if WSA can rollback all malware that is missed? And how does WSA protect users if they are infected with malware and in time is rolled back like:
 
1. Have all of there passwords been compromised web browsers and even the main PC login password?
2. Does WSA block all malware from calling out to the bad guys?"

@ wrote:
@ asks: "Maybe someone can answer if WSA can rollback all malware that is missed? And how does WSA protect users if they are infected with malware and in time is rolled back like:
 
1. Have all of there passwords been compromised web browsers and even the main PC login password?
2. Does WSA block all malware from calling out to the bad guys?"

Hey TripleHelix
 
Maybe someone can answer if WSA can rollback all malware that is missed?
So rollback's job is to monitor all changes of a unknown process - in most cases this is malware that wasn't detected immediately. The changes that we monitor are all files created/deleted/modified and registry entries created/deleted/modified. In the case of any files or registry entries that were deleted or modified, we would actually snapshot those and save them. Then once we determine that unknown malware as malicious, that process will be quarantined and all actions as recorded by journaling will be reversed. This means we will remove any new files or registry entries created by the malware and then place back any files or registry entries that were deleted or were modified. 
 
Please note that this doesn't work for 100% of malware as this is a constant cat and mouse game with criminals and malware that will process inject will circumvent our journaling. While Journaling is a very powerful feature, it is not meant to be a replacement for a reliable backup solution. Our snapshots of files and registry entries does have a file size limit and is designed to protect office documents and windows system files - it will not snapshot your Disney Blu-rays. 
 
1. Have all of there passwords been compromised web browsers and even the main PC login password?
Sorry but I'm having a real hard time understand what's being asked. Can we rephrase? Are you asking if the web browser was compromised that has all their saved password passwords, would the criminal get the main user account login?
My answer would be no, unless there is overlap with the main PC login and some of the passwords saved in the browser. 
 
2.Does WSA block all malware from calling out to the bad guys?
 
I would say NO to this. While our job is to obviously try and stop all of malware and all communication they make, but no one is 100% on this. It's a constant cat and mouse game.
 
 

Can you help me understand why crypto is bad/malicious? Also, do you think publishing websites could use this for revenue moving forward?

Thanks @, @, @, and @ for your questions! Hope that everyone found this helpful. 
 
Please let us know what other Q&A's you'd like to see from the Webroot team and we'll do our best to get them on the schedule. 
 
Thanks again!