Controlling WRData folder size - help needed

Hello Donald and welcome to the Webroot Community!
 
Yes, it is known issue that should be addressed in one of next updates. Please read this thread from Wilders where the lead developer explains this issue.
 
I draw your attention especially to post # 3 "I suspect you'll have a couple large files with the name db[Numbers].db. If your system is clean, you can delete these, but I suggest first writing into our support inbox to ensure everything is legitimate:

I have just noticed that my C:ProgramDataWRData folder is at 17GB! with several recent .db files at 2GB! (Windows 7). This possibly corresponds to a recent slowdown on my machine.
I believe the only fix is to un/reinstall and am ready to do that but have raised a support ticket first - maybe they can see what is causing it?
 
 
 

Hello paulderdash and welcome to the Webroot Community!
 
I would wait on that uninstall/reinstall until you hear from Support.  Good moving filing the Trouble Ticket, as it was believed the bloated data file had been repaired at this time.  If for some reason the fix did not work on your computer, or there is a different bug, the ticket will help them not only fix your issue, but help others as well 🙂

paulderdash,

My WRData was about 10 GB by the time I found a solution; the folder is currently around 390 MB.

I received initial and follow-up responses from Webroot support, which were as follows:

--------------------------
RESPONSE ONE (body) (Nov 19, 2013 21:54)

 “To start it fresh you can uninstall Webroot SecureAnywhere normally and then Delete the WRData folder and restart your computer, then reinstall Webroot and there will be a new WRData folder.”

--------------------------
RESPONSE TWO (body) (Nov 25, 2013 11:12)

“Thank you for your report. We have researched your issue and have updated our database to address this issue. Following reports such as yours, we recommend you run one Deep Scan with Webroot Secure Anywhere. To do so, please follow the instructions below.

1. Open SecureAnywhere and click the 'cog' beside 'PC Security'.
2. On the Scan & Shields tab, select Custom Scan.
3. Select deep scan from the Customized Scan Window and Click Start Scan

This will start a Deep Scan of your system. This should help with the issue that you are seeing.”
--------------------------

Initially, neither the uninstall/delete/reinstall nor the deep scan methods worked for me when performed in isolation. However, performing the Deep Scan immediately after reinstalling the software has apparently corrected the problem on my computer.

Hope this helps…
 
f_donald

You must of had allot of unknown files on your PC and when you sent them a ticket they must of whitelisted all of them the only reason that WRData Folder would get that large is if it was monitoring many program processes so if it was malicious WSA would be able to rollback to the pre-infection state.
 
But in the latest release v8.0.4.42 they added to it self clean old monitoring db files. https://community.webroot.com/t5/Release-Notes/PC-Release-Notes-8-0-4-42/m-p/71323#M349
 
Automatic cleanup of old rollback data.
 
Also you can check your scan log and if you have many [u] files just contact support and they will whitelist them for you in the future.
 
HTH,
 
Daniel 😉

The un/re will fix this as it removes old journaling information however if your are running programs that are still unknown in our Database the client will start monitoring them again. We can whitelist these to stop this, if you can submit a support ticket we can sort this out quickly enough. 

Thanks everyone for your feedback.
Support replied within 10 hours and requested I upload information they require via their rather neat wsalogs.exe log gathering utility:
http://download.webroot.com/wsalogs.exe
I do havemany apps (some possibly obscure) but I believe my system is clean (according to Malwarebytes Pro).
I will await their further instruction and post the outcome here.

I appreciate the comments being made to this thread… However, the responses focused on installed software, obscure or otherwise, are separate and distinct from a software fault that allows any security program to utilize excessive and unreasonable disk space.  
 
In my case, I do not have “obscure” or unknown software installed on my computer (e.g., 100% trusted/good with many users and 0% unproven, unknown or poor via Norton Insight). Equally, I made no changes in software between the time my WRData folder inevitably reached 10 GB in a matter of days, and the current and stable post re-installation and fix size of roughly 300 MB (i.e., nor did the problem exist in the previous version of the software)..
 
Also in my case, the re-installation and deletion of the WRData folder reclaimed my disk space and I am assuming that the updated but overdue database and/or program updates addressed the software fault that was allowing the .db files to utilize excessive and unreasonable disk space. Contrariwise, the notion that that any security program will only work properly when a smaller number of files are stored on the computer and only when all programs are readily known, is a bit impractical.
 
Accordingly, I am personally very pleased that Webroot support was responsive and despite the delay, that the updated database and/or updated version addressed this bug so that I can continue to use SecureAnywhere.

Initial response from Support was as follows:
 
After receiving and reviewing the logs it looks like we are excessively monitoring multiple programs that would cause the jump in WrData size.

Have you allowed the following files yet?

GSRunAsUser.exe
SolutoService.exe
wcgrid_mcm1_7.28_windows_x86_64
CryptoPreventEventSvc.exe
GenieTimelineAgent.exe
ClockProcess.exe
NiniteUpdater.exe
GearsHelper.exe
soluto.exe

Those are the ones being monitored.
 
followed by the instruction to uninstall / reinstall the software.

 
I 'allowed' the files listed, exported settings, reinstalled and reimported settings, but then saw the large WRData folder was still there. I then repeated the process (as per f_donald - thanks!) deleting the WRData folder this time before installing again. The WRData folder is now<69MB. I will monitor this.
 
I would hope they have made adjustments 'in the cloud' to exclude monitoring of these files, as none are suspect.

Hi paulderdash
 
Thanks for the heads up.
 
I believe that there are some cases where an uninstall does not remove the WRData folder (it has happened to me on a couple of occassions and because of beta testing I do uninstall/reinstall alot ;)).  You did the right thing by deleting the folder after uninstalling and before re-installing.
 
With regard to your comment "...would hope they have made adjustments 'in the cloud' to exclude monitoring of these files, as none are suspect."...I am sure that this will eventually happen but we know that it can take sometime for this to happen given the number of new files that are picked up in the cloud and then have to be researched by the Team at Webroot.
 
If you find that the fact that these files are still Unknown and therefore will be being monitored you can Open a Support Ticket and send Support the details of the files directly.  That should get them listed quicker.
 
If you decide to do this then you should save a Scan Log (I assume that you know how to...but if not post back and I can point you in the right direction) and from that locate all lines that start with [u], copy & paste the ones that relate to the files you mention in your post, into the ticket and submit that.  That should do the trick. 😃 I only do this when the lack of whitelisting of a fiel in the cloud is causing me an issue as it seems to be you, otherwise I usually let the usual process take its course, and eventually the monitored fiels are whitelisted (if indeed they are 'good').
 
HTH?
 
Regards
 
 
Baldrick
 
 

Whitelisting is an interesting topic, its not particular fun and most of the time people dont notice any difference. Its more important that we spend time looking for malware rather than whitelisting in my opinion. So just drop us a support ticket if you havent done so and we can whitelist those programs and your PC. 

I have added those files to my 'Allow' list.
I'll monitor the size of the WRData folder for now.(now at 430MB) and leave the request for whitelisting for now.

I see you were over at Wilders also chatting with Joe about this I hope you read his last post about not importing the old settings. http://www.wilderssecurity.com/showthread.php?p=2322972#post2322972
 
Cheers,
 
Daniel 😉

No problem, I can whitelist your KC in a few minutes if you PM me your KC if you want.

Yes, I noticed now. I apologise for having raised my problem in both forums.

Hi Rakanisheu - excuse my ignorance but 'PM me your KC"? - do I need to send the relevant scan log entries?

Sorry too much Webroot jargon in that reply! If you can send me a private message with your Webroot Keycode I can whitelist all the unknowns on your PC. 

Thanks you - will do but how do I find your private email address?

The little envelope beside your username a the top of the forum click on it or click on Roy's username and click send him a private message. https://community.webroot.com/t5/user/viewprofilepage/user-id/7522#.UsLkILRlfK0
 
HTH,
 
Daniel 😉

My thanks to Roy (Rakanisheu) for spending time on this i.e. whitelisting my unknowns, and advising me to perform a custom deep scan.

Hi ^^
 
Would be nice to get some help too, my WRData folder is 3.9 gb atm. the last two .db files are 1.9gb each. My ssd is almost full so 4gb of data from webroot is not what i need right now :3
 
What logfiles do you need?
 
Thanks in advance

Hi CandyFace
 
Welcome to the Community Forums...:D
 
If you click on the cog/gear to the right of the Utilities tab (in the Main GUI) and then click on the Reports tab in the mew panel displayed you should be able to see a 'Save scan log' button. Click that and then save the .txt file created.  If you then open that file it should display the details of the scans thatWSA has made.  Each line us usually prefixed by a Capital letter in [] barckets.  You should then Open a Support Ticket describing your issue and copy and pasting any line starting [u] that you find in the log.  Example below:
 
   [u] c:program filesaxtmaxtmapp.exe [MD5: 326C3F0BDFC5AA24063FD001F8F954D3] [Flags: 40191100.4122]
 
Support should then be able to review these, whitelist those that are safe and that should then stop the journalling of those files actions, which it what generates the large files in WRDATA.  To clear them you will need to uninstall WSA, make sure that WRDATA has been deleted and then reinstall WSA (make sure that you have your key code to hand as you will have to enter it again, and also that you say 'NO' to any offer from the installer to load saved preferences...this needs to be a clean install).  Hopefully with that and the whitelisting you should not have the same issue re. the size of WRDATA.
 
Post back if there is anything  further that you need help with.
 
HTH?
 
Regards
 
Baldrick
 
 
 

Hi
 
In spite of Roy's whitelisting I still see my WRData .db files climb to a couple of GBs (currently WRData folder > 6GB) every couple of weeks. I can do a clean install every time, but it this hardly makes it a set and forget solution.
 
Rgds - Paul

Hi paulderdash
 
How are you?  Well, I hope? :D
 
This continues to rear it's head from time to time despite the fact that one of the recent releases included, I beleieve (but could be wrong) the optimising of existing databases and cleaning out old data...may need to check that this has indeed been released.
 
So by the sounds of it you have again, know not how, some applications seen as unknown by WSA, and modifying a lot of files.
 
So perhaps rather than just an uninstall/clean install, may I suggest that you run a scan and the check the scan log to see if you have some additional [u] prefixed files, and if they correspond to the couple large files with the name db[Numbers].db that you have reported having
 
If I recall correctly the advice provided by @, if you believe that your system is clean, you can delete these (I do occasionally after checking), but of course it would be safer to contact Support again with the details of the [u] to get these whitelisted.
 
I have a similar pattern of growth in the WRDATA folder from time to time and usually find that, for some unknown reason I have new [u] prefixed files in the scan log, and most probably new versions of something already installed (as I tend to try to keep installed software up to date) which by dint of being new versions (different checksums, etc.) are now untrusted, etc., and most likely these are creating most of the data by writing a great deal of temporary data to the disk. 
 
Just an educated guess on my part as in the early days I had a lot of large db[Numbers].db files...but these days, as previously stated, a few every now and then.
 
Not sure if any of this is of help...but hope that it is.
 
Have a great weekend.
 
Regards
 
 
Baldrick
 
 

Thanks again for your advice Baldrick!
 
I also thought a recent release had, at least partially, addressed this ...
 
I had already reinstalled but will try the approach you and @ suggest next time!
 
Indeed I too keep all software, installed and portable, rigorously up to date so that may account for the issue. But that is good practice.
 
Rgds - Paul
 
Edit: On further inspection I see I do have a lot of [u] files in a new scan log.
Re your comment 'if they correspond to the couple large files with the name db[Numbers].db that you have reported having' how do I determine this i.e. which [u] files are related to which db[Numbers]?