After receiving the Webroot SecureAnywhere Internet Security Complete from Amazon, I (new user) installed it on two PCs. When I created an account and logged into the Webroot PC Security console, I noticed there were no PCs listed. I thought this was odd since the Webroot installation collected my e-mail address from both PCs. (Okay, I didn't expect an account to be automatically set up, but I did expect my account to be auto-populated with my two PCs once I did set up an account - how clever!) When I clicked on "Add a PC", a dialog opened and displayed:
So you want to add a PC to this screen?
Download the Webroot SecureAnywhere software. (Sorry, I already installed it from CD)
Enter one of your Keycodes during installation. (Yep, I already did that too)
Once the initial scan has completed, the PC should appear here within a few minutes. (Initial scan has already been completed hours ago, and it still hasn't shown up here! Now what?!?)
I sent a message to Webroot Support and, not surprisingly, received a disappointing answer. Fortunately, I figured it out. It's not just the initial scan that will "Add a PC", but ANY scan will do. After opening Webroot SecureAnywere on my first PC and performing a manual "Scan My Computer", I checked my online Webroot PC Security console a few minutes later and my first PC was listed. When I did the same thing for my second PC, it was finally listed as well.
This all could have been avoided if correct wording was used under "So you want to add a PC to this screen?" -OR- if the CD box instructions/installation program instructed me to create an Webroot account FIRST, then proceed with the install.
How about the ability to have the Community login credentials the same as the Console login credentials? Since there is a link to go from Console to Community, I assumed I would already be fully logged in. This is not the case.
I put my computer to sleep at night, but WebRoot will not wake the computer to scan, so the scan ends up running first thing in the morning when I need to start using my computer.
Please allow WebRoot to wake up the computer and do the scan in the wee hours when I don't need to use it.
I just looked at something in my first post. Since this feature exists (Spell Checker)then why is it that when I posted the new idea, it didn't automatically come back and caught the post and say "Feature Already Exist" That would be a great feature. I even turned on suggestions and nothing was there.
I hope this is clear to all.
Just a little idea I had looking at my keycodes as you do.
I am sure some of you have a lot of keycodes in your consoles. I for one dont have too many but I have a few, and somtimes I cannot quite remember which one goes to which so I end up going back and forth to try and locate and place each one.
My idea is to have another colum in the Manage Keycodes page to add a identifyer which the user or admin could change to help them remember which code belongs to which device. Such as "Gaming PC" "Laptop" "Tabet" "Phone" or whatever, you get the idea
What do you guys think?
The Webroot File Submission site (http://snup.webrootcloudav.com/SkyStoreFileUploade
To allow better access to it I would like to suggest that a link to the site is added to the WSA local client; either as a button under the 'Support/Community' tab or the 'Utilities' tab, so that in much the same way as the 'Support' button takes the user to the site directly to open a support ticket, so this would take the user to the File submission site and give them immediate access to:
1. File submission
2. MD5 Hash lookups
3. URL Reputation lookups
As such it should not add very much in terms of additional code to the installer and would provide further useful tools for the user to readily use.
Is it possible to have WSAC scan questionable links in emails without having to open them? For example, I've just received an email from a college friend I haven;t really spoken with in a long time. I'm certain the email is bogus and that the link is at least spyware, but being able to submit it for investigation could be advantageous.
Most of the cases the root problem of a successful 0-day infectino is that the very first piece of malicious code (most likely a downloader trojan) can successfully communicate to it CC (command and control centre).
Webroot today has a default allow action if user does not block via this popup window:
First of all: surely, admins never like the idea of giving such control to the user. User will never know the exact risks of clicking the Allow button here. When he clicks, it is already late to save the network from harm. Please refer to many many Cryptolocker cases around the Globe.
Secondly, the countdown counter here gives you 120 sec to decide. Who among the users can get proper help on what to click here in just 120 sec??? Who is that admin among us who could properly check this unknown process out it at the endpoint and advice in just 120 sec? (Anyone yes - I would employ you tomorrow and we will make big money... )
(please also read this idea - it might work in some cases:
Thirdly, actually, I have never seen any firewall (perimeter or personal) that has a "default allow" implementation. Eversince we have communicating systems we all learnt quite well: for any unknown process the only safe action is to block its communication, isnt' it? (Please note, blocking unknown processes' communication will not have any effect on known good processes.)
Sure, Webroot, you might say that implementing this could result in blocking too many legitim processes, but hey, this is your constant job to classify new processes and as quickly as you can and we purchase a WSA licence it means we do trust you can do this mandatory job for us, for our safety.
Also, even without your expert job (and cloud database updates), local admins could easily deal with those untrusted processes whose communications were blocked via the Admin Console, so they could easily classify any unknown process as "Good" if need be.
Dealing with some bloked communications is (to my opinion) still much better staff then dealing with tons of encrypted files... and neverending ransomware infcetions are just about to teach it for us all.
So why nort let us stay on the safer side?
WSA 6500+ endpoints inatalled and maintained daily, 12+ years Webroot sales & support, 2 yr Webroot MSP
When Trojans get downloaded they are currently a) scanned by WRSA and b) may be further scanned by the user with a manual scan. On both these actions WRSA does not quaranteen these files because they are not considered active malware, according to your researcher Dan. I have checked more than 20 such files via Virustotal and not only ESET, Kapserky recognise them as Trojans but even the lowly Windows Defender. Of all these Trojans across 2 weeks, WRSA did not alert when downloaded not afterwards manually scanned, they were passed as OK.
Because the files may have been scanned twice, the average user is going to believe those files are OK and clean according to WRSA and they may pass them on to someone else in their business workflow or to a friend when in fact those files contained malware. Those files can then wreak havoc on another system that is not protected by WRSA.
Fundamental question and request: Upon download and manual scan WRSA is most likely checking those files against an online databse, so why not immediately quaranteen such suspect files or at least alert the user there may be a risk?
Can WRSA deal with such files immediately, using your own online lookup or add the feature to compare on Virustotal.
Thanks for your consideration
I (or rather my wife) recently had the issue described in this post. Basically, she changed her SIM card while abroad and the SIM card lock kicked in. when she tried to unlock, no keyboard would appear. I then learned that it's because the phone needs a data connection before unlocking is possible. There was no explanation of this from the phone itself, and I had to ask the community here to get an explanation.
My suggestion is to include a text message in the lock screen in such a case, saying something along the lines of 'It isn't possible to unlock this device at this time because no network signal is available.'
It would be usefull to me if WSA was able to generate events in the windows event log. It would make it easier to create scheduled tasks or incorporate data into a SEIM.
'Windows allows applications to report their own security events to the security log by registering through Authorization Manager with LSA as a security event source using the AuthzRegisterSecurityEventSource function. "
When visiting security websites websites that deal with proxies, anonymizers, VPNs, TOR, etc. Webroot blocks these websites with the usualy warning.
In Search Engines they get the "Reputation: HIGH RISK - When Visiting this website there is a high probability that you will be exposed to malicious links or payloads."
When visiting the sites the message is "Suspicious attack ahead. Webroot has blocked access to the website you tried to open. It has been reported to contain suspicious content."
For many of these sites, this warning is completely innacurate. The sites themselves are trustworthy, particularly websites like torproject.org which are highly reputable website/project run by a registered 501(c)(3) US non-profit organization.
When reporting this issue to Webroot, I've been informed that "Tor is flagged because it is a proxy that many admins would not want employees using. We have no plans to change this."
If Webroot has no plans to change this, I would like to propose that you change the way users are warned about these sites. Add different kinds of warnings that specify in more detail why the site is blocked. For example "This site contains content that may be offensive to your network administrator."
As it is, I, and I'm certain other webroot users, are in the habit of simply clicking "ignore" (more specifically, "tell me more about it" then "unblock page and continue") on every security oriented website that brings up this warning (I've seen it on security oriented news sites as well). The problem with this is that we are being forced to do this blindly. We have no idea if Webroot has blocked the website because of the content, or because it may actually contain "malicious links or payloads." Essentially, by being over-protective, webroot has become less effective in protecting us.
Please provide warnings that specify why a website is blocked. That way users can make an informed decision about whether or not they want to continue...