Solved

Manually choosing block in System Control

  • 21 October 2014
  • 34 replies
  • 153 views


Show first post

34 replies

Another question. Does 'monitor' limit program access?
Userlevel 7
Badge +56
@ wrote:
Personally, as rare as it is needed to do a Rollback, and as technical as I believe it might be, I think it best to leave it to Support.  It is not so simple as simply clicking a button and letting it go.
Agreed!
 
Daniel 😉
Userlevel 7
Personlly, as rare as it is needed to do a Rollback, and as technical as I believe it might be, I think it best to leave it to Support.  It is not so simple as simply clicking a button and letting it go.
Userlevel 7
Badge +56
Another thing about this if the PUA came as a Bundle the Rollback might remove to the point of the installation of the program. And can go along the lines of this short video: https://community.webroot.com/t5/Webroot-Education/What-Happens-if-Webroot-quot-Misses-quot-a-Virus/ta-p/10202 but it would be nice to hear from some Webroot Threat Researchers on this or even the Developer of that feature? @ will know who!
 
Thanks,
 
Daniel 😉
Maybe this might be a good idea for 'ideas exchange': Allow users to rollback programs. 
 
Sometimes contacting support can take time. I like having the ability to fix issues on my PC and clients without having to contact support. I understand there can be risks if a neccessary program is rolled back, but I'm sure WSA can come up with something to eleviate that issue (rules, ...etc).
Userlevel 7
Hi David, my pleasure but I will feel better as and when either Roy and/or Dan comeback to confirm or precise further, as my post is based on some recollections of conversations that occured a while back...and I am no spring chicken so the memory may be playing tricks on me.
 
Regards, Baldrick
Userlevel 7
Excellent additional info Baldrick.. Thank You!
Userlevel 7
Hi David
 
If I may on this one, based on my understanding...what you say is essentially correct.
 
But the rollback feature is only available for files set to 'Monitor', but even then a file can either be set to 'Monitor' automatically by WSA based on it being unknown or manually by the user.  In either case the 'Monitor' status will cause its activities to be journalled...however, in terms of rollback based on the journalling , only when a file that has been set to 'Monitor' is deemed to be malicious will WSA rollback its activities.
 
In the case of the user set 'Monitor' statis even ifthe file is deemed to be malicious by WSA (unlikely to happen as WSA would most probably have spotted that before the user intervention) or the user  chnages the status for 'Monitor' to 'Block' no rollback will occur. Whether or not the Support Team canuse the manually initiated journalling by the user is a moot point...and I suggest that it is worth asking someone like Roy or Dan to comment/advise on this point for us all. @ @ 
 
Regards, Baldrick 
Userlevel 7
Hello there, 
 
Changing the setting to Block will not cause the PUA to be removed, quarantined, nor will it trigger a rollback to restore any changes made by the PUA.  The Rollback really can only be done, as far as I know, under supervision of Webroot Support.
 
It WILL keep the PUA from running or doing anything further, but it is not a 'good' replacement for proper PUA management (Uninstalling the garbage or stopping it from installing in the first place.)

Reply