Is it possible to find out the date that Webroot was UNinstalled from a Windows 7 system?

  • 22 July 2017
  • 7 replies
  • 163 views

Userlevel 1
I am helping a friend with her Windows 7 laptop. I installed Webroot several years ago and she's never had a problem.
 
But now, it appears that Webroot has been uninstalled from her system. She didn't do it, and neither did I. To narrow down other possibilities, is it possible to find out when it was removed from her system? It would have been within the last couple weeks.
 
And once I reinstall it for her, is it possible to lock it down so that it cannot be removed by someone else without a password?
 
I really hate the thought of her system being "protected" by Windows Defender as a primary source. She does have Malwarebytes Premium, so things could be worse, but still...

7 replies

Userlevel 7
Hi wjmwr80
 
Welcome to the Community Forums.
 
As far as having definitive date as to when WRSA was first installed, especially if it has since been removed, the best I can suggest is that you check up in your friend's online Webroot console (accessed from HERE). You should be able to see a console name when first signing in and with that the date it was created...which should give you the approximate date that a particular account was created, which usually automatically occurs post installation.
 
In terms of locking down/preventing the removal/uninstallation of WRSA you will need to check and adjust as required a couple of 'Adavncede Settings' and then apply password protection to the 'Advanced Settings' themselves so that they cannot be interfered with, etc.
 
To do this you should do the following:
 
1. Click on Advanced Settings (top right of the main panel)
2. Click on the Access Control tab
3. Make sure that the following options are unchecked/unticked
    a. Allow uninstallation by non-administrative user
    b. Allow non-adminstrative users to modify configuration options
    In fact (b) is optional and just tightens protection, but really only (a) is key here
4. Then at the top of the same panel check/tick the Enable Password Protection option
5. Enter & then repeat enter a suitable password
6. Then click on Save (enter the CAPTCHA characters requested) 
 
And further to that you should find that only an Admin user can uninstall WRSA, and only the holder of the password can access the Advanced Settings to change then, and crucially change the option described under 3a. above.
 
Of course, locking down WRSA to this extent does have some drawbacks in that (i) only a password holder can make Setting changes, & (ii) if you lose the password there is no way to recover it (you will need to contact Support to get the only way to proceed in that circumstance if you want to reset it.
 
For a fuller explanation of the above and details on the Access Control options and what they do please see THIS PAGE from the online help.
 
Hope that helps? If not or you have further questions please post back.
 
Regards, Baldrick
 
Userlevel 1
Actually, I believe you've misunderstood my question. I had hoped the capital letters in the subject line would be enough to eliminate this exact confusion, but what I'm looking to find is the date that Webroot was REMOVED from her system.
 
But your advice regarding locking it down is indeed helpful. Thanks! 🙂
Userlevel 7
Hi wjmwr80
 
Ah, OK, I did misunderstand...but unfortuantely, no, as far as I know there is no way to find that out...not unless it was recent and it is logged somewhere in Windows Event Logs or the like.
 
Regards, Baldrick
Userlevel 1
Thanks! The logs abruptly end on the 14th. There's nothing more recent. I suspect, if it was logged, that the log entries got blown away when we did a system restore to fix her system that wouldn't boot. She suspects it happened sometime after the 19th.
 
Too bad the system restore didn't restore Webroot.
 
I'm hoping it will be easy to reinstall. I'm pretty sure we have a record of the username and password for the Console. It's the other factors that I'm worried about. I'm not sure we made records of them.
 
Is that going to be a problem?
Userlevel 7
Hi wjmwr80
 
Well, that is a shame.
 
In terms of a reinstall please follow the steps below closely in terms of installing WSA on the target system/machine!
 
 • Make sure you have a copy of your 20 Character Alphanumeric Keycode! Example: SA69-AAAA-A783-DE78-XXXX
• Be sure you have or add your Keycode to your Online Console HERE although one does not need to add it just yet.
• KEEP the computer online during the install to make sure it works correctly
Download a Copy Here (Best Buy Subscription PC users click HERE). 
• Install with the new installer, entering your Keycode when prompted to do so in the install process
• Let it finish it's install scan
• Reboot
 
and that should do the job. And if by 'other factors' you mean WRSA settings please rest assured that the default settings that WRSA installs with provide very good protection (if I remember correctly I have only changed one of the defaults from installation).
 
Finally, in terms of the online console...if you know the email used to register WRSA when it was purchased then you can go to the log on screen, and next to the 'Log in' button you can use the 'Forgotten password?' link to reset (i) the password & (ii) the security code...so all you really need is that registration email.
 
Hope that helps further?
 
Regards, Baldrick
 
 
Userlevel 1
Actually, what I meant by "other factors" were security questions, secret words, and such. 🙂 I remember it made us set up a bunch of stuff when we established the account.
Userlevel 7
Hmmmm, apart from the Security Code I have never had to set up any such things as far as I can remember but then I have been using WRSA since it was released and so perhaps my memory is bad. :(

Reply