Solved

Firewall warnings for new untrusted processes

  • 18 May 2018
  • 7 replies
  • 114 views

Userlevel 1
Badge +5
I have SecureAnywhere Antivirus's Firewall/WebShield set to "Warn if any new, untrusted processes connect to the Internet if the computer is infected."  However, this isn't suppressing the warnings.  For example, when Steam updates, or Adobe Cloud wants to connect, I'm constantly getting the pop-ups.
 
Scans do not show that my system is currently infected.  However, when I first installed SecureAnywhere I did create the EICAR test file in order to see how SecureAnywhere works before purchasing it. The test file was properly detected as a "virus" and was removed.  During that time, the machine did show as "Infected", but everything has since returned to green, and both the app indicates "No active threats have been detected" and the web console shows the computer as "Clean" in all scans.
 
How do I "reset" things so that it believes my computer is no longer Infected and stops warning about untrusted processes? The pop-ups are getting annoying, and while I could adjust the setting, if I were to get a real infection of some sort I would want it to block and prompt about untrusted processes, so I don't really want to lower the setting.
icon

Best answer by TripleHelix 18 May 2018, 21:44

View original

7 replies

Userlevel 7
Badge +63
Hello,
 
That is normal for the Firewall to pop-up and ask you to allow unknown files to connect to the Internet so in these cases you can Submit a Support Ticket and ask them to white-list your unknown files. Here is how to reset your infection stats: https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/PC-Threats-Removed-Stats/ta-p/169855
 
Thanks,
Userlevel 1
Badge +5
Then what is the point of that option to warn after infection vs. Warn all the time?
Userlevel 7
Badge +63
@ wrote:
Then what is the point of that option to warn after infection vs. Warn all the time?
Some not well known files are not white-listed so quicky by the Webroot Cloud Database so it's best to contact support and they will get them white-listed for you then things will be fine after. I have my firewall set as you and i don't see many pop-ups from it.
 

 
Userlevel 1
Badge +5
Not sure why this is marked as a solution, since it doesn't actually answer either of my questions, and saying that the pop-ups are "Normal" or telling me how to get untrusted processes whitelisted doesn't actually address the question I asked.
 
  1. What is the difference between these two options?[list]
  2. Warn if any new, untrusted processes connect to the Internet if the computer is infected
  3. Warn if any new, untrusted processes connect to the Internet
  4. [img]https://uploads-us-west-2.insided.com/webroot-en/attachment/33908i59B4152521310A44.png[/img]
  • Assuming that the difference is exactly what is implied by the description (that the first option warns about untrusted processes only if the computer is infected, and the second option warns all the time), then How do you reset the "Infected" status so that it stops warning if the machine was infected but now scans are showing clean? Just having a clean scan does not seem to change the behaviour (or the option means something different than what it says, or it just doesn't work)[/list]I have tried resetting the statistics (thank you for that link). I also discovered that the files that were previously infected were also showing under the "Quarantine" tab, so I have deleted them from there (as they were just EICAR test files).  Hopefully one of those two actions will actually help.
  • Userlevel 7
    Badge +63
    From the online Guide: https://docs.webroot.com/us/en/home/wsa_pc_userguide/wsa_pc_userguide.htm#UsingFirewallProtectionWebShieldProtection/ChangingFirewallWebShieldSettings.htm%3FTocPath%3DUsing%2520Firewall%2520%252F%2520Web%2520Shield%2520Protection%7C_____2 now if you have more questions about it in detail please Contact support!
     
    Warn if any new, untrusted processes connect to the Internet if the computer is infectedIf the computer is infected and any new untrusted process connects to the internet, the system provides a warning. This radio button is selected by default, which is the setting we recommend.
    Userlevel 1
    Badge +5
    Gee, thanks for that completely useless extract from the manual... and again, not actually answering the question.
     
    I'll just ask support.  Hopefully they'll take the time to read and understand what I'm trying to ask, and will actually know how their product is supposed to work. 😞
    Userlevel 7
    Badge +63
    Gee, thanks for that completely useless extract from the manual... and again, not actually answering the question.
     
    I'll just ask support.  Hopefully they'll take the time to read and understand what I'm trying to ask, and will actually know how their product is supposed to work. 😞

    Reply