Increase browser extension PUP detection.

Userlevel 2
Badge +16
It would be great if browser extension PUP detection was improved so they can be removed. I have found that Malwarebytes consistently finds browser related PUP when Webroot doesn't detect anything. It is annoying because of course whenever someone actually gets infected, it would be great if Webroot had accurate detection of browser extensions so I wouldn't need to install Malwarebytes to purge the system of everything Webroot doesn't detect. I was told by support that web browser extensions were not malicious, but that clearly isn't the case.

EDIT: Also, it's confusing why browser extensions aren't detected as PUP when one sets to detect PUP as malware in group policy expecting extensions to be included. I would also like to add that a client won't be favorable of Webroot when they see Malwarebytes finds hundreds of malicious browser extension entries, and Webroot finds nothing.

2 replies

Userlevel 7
Badge +28
Great idea @wowwee! Don't forget to vote on your own idea. The system doesn't do it automatically for the user who submits the idea.

Webroot tech support told me to enable:

    Web Threat Shield → Enable Web Shield

    Web Threat Shield → Enable web filtering driver

to help block unwanted browser add-ons/extensions, however, these were already enabled.

Our users continue to occasionally install unwanted browser extensions, often displaying advertising or other unwanted pop-ups and requiring direct intervention by a tech. These extensions are unwanted software running on our computers. There is no reason an antivirus/endpoint protection app shouldn’t also protect against these threats. Without being able to control these, we’re at the mercy of the browser companies to protect against browser-based malware. Unacceptable.

We need a way to monitor the extensions installed on computers within a site, list them by browser, flag some as disallowed (causing them to be removed) & flag others as allowed (causing them to be kept and allowed to update & be installed on more computers with that policy applied).

I often see the same unwanted extensions on various computers so the curation of the list could by done by us, but it would be more convenient if Webroot could do some categorization (such as an “adware” category) to assist in some basic filtering.

I haven’t really thought this through but that would be a good start.