Please click here to see the most recent update.
UPDATE 4/28/17 11:45 a.m. MNT: We have 0 calls in queue on our phone line, and are working through about 80 tickets related to the False Positive repair utility. A good portion of those are simply awaiting customer verification.
Please note, the utility was built to address only this specific false positive issue. It will be deactivated in the future.
If applications are operating normally on your systems, you do not need to implement the utility.
If you haven’t yet submitted a support ticket and you need the repair utility, please do so here. Include your phone number as well with the support ticket.
Best answer by freydrewView original
Sadly enough the music you play on hold is the same that McAfee Support plays on hold.
And the really sad thing is that I had to know that...:-(
You can't even run a report that says "This is the list of files that were quarantined across your client base in the last 24 hours."
And the webroot alerting system is nice enough to disable alerts per site once it reaches a certain "threshold" and just tell you to log onto the console for the site...
As an MSP, this is killing us. It's bad enough to have the false positive. It's even worse to be told "Just restore the file from the quarantine". But it's the WORST to not have the console Agent commands not work.
FIX IT! And, while you're at it, write a GLOBAL script that takes ALL the false positive files found in the quarantine AND RESTORE THEM TO THE ORIGINAL LOCATION.
Oh, and next time, when something like this happens, WHY DIDN"T YOU NOTIFY YOUR DISTRIBUTORS? I'm already pissed that my distributor didn't notify me. Talk about dumping on your resellers. Shame on you!
I would also like to second that comunication to resellers should have been a top priority and the fact that I havent seen an official word on this yet is giving me flash backs to the last major issue that took DAYS to confirm.
I would take the minute risk of 1 of the files being quarantined being bad at this rate to have a mass restore on the hundreds that have been flagged.
We prioritized servers and then did the workstations.
Problem being now, that the "restore from quarantine" is still hung on most systems. Mission critical application executables were recovered from backup.
Why don't you just let the resellers and MSPs handle the bad press and instead, just TELL us when something has gone terribly wrong. I can't speak for everyone, but my clients and my company REALLY like Weboot. It's a great product. And we're the first line of contact when something goes wrong. We just don't like being the LAST to know.
So, make up for the lack of communications by sending us an email tonight, with ALL the details of what happend (Yes, that means CONFESSING TO THE PROBLEM!) and then tell us that you've written that global script and any of the falsely identified programs that were quarantined, have now been restored to their original locations.
Which is good.
The file was a scan service which ran our LAN management console and won't stay running.
Which is bad.
The rest of the systems which were hit haven't been able to poll so I have no idea how deep this goes.
I don't get paid by the hour and this will be the rest of my week.
I tried to find a dumpster fire avatar but it wouldn't let me upload one.
I still have several client computers that aren't fixed. I spent the greater part of my evening trying to at least prioritize workstations and who the manually fix. As an MSP, I have too many endpoints that it's not feasible to remote to all to resolve the issue. I look forward to how Webroot plans on resolving this issue for us MSPs.
Level 3 Senior Tech
Our backlog of agent commands is definitely not caught up. I still have thousands of "reverify" and "restore" commands that are "not yet received" and have been for 5 hours.
When can we expect a fix FROM Webroot?