No firewall settings for WRSA AV on Windows 10 ?

  • 10 February 2016
  • 38 replies
  • 574 views

Userlevel 5
Badge +1
I recently bought an HP laptop with Windows 10 Home installed on it, previously using Windows 7 and WRSA on othr PCs.
 
I installed WRSA Antivirus on the new laptop and the Windows 10 firewall is switched on, also the WRSA firewall is switched on.
 
I am a long-time WRSA user and recall that the WRSA firewall works in a complementary way on top of the Windows firewall, so no problems so far....
 
In advanced settings, under Firewall / Webshield there appear only webshield options, the Firewall options are completely blank. Is this normal on Windows 10 ? 
 
I previously used WRSA Complete so I thought that restriction might be due to version differences as well?
 
Screenshot attached. Appreciate a quick answer please, need to go travelling soon and would like to increase the level of firewall protection to alert when new unknown processes start, not just when WRSA thinks I am infected..
 


38 replies

Userlevel 7
Badge +35
@ wrote:
@ wrote:
Thanks for the feedback caveman. I also use Win 7 but was interested to hear that you cannot run WD with WSA on W10.
 
I am somewhat confused by these 10 sample files that you downloaded. You say that they were identified as Trojans or viruses but that half of the VirusTotal AVs gave them a clean bill of health, as did WSA. This suggests to me that they cannot be particularly malicious or surely they would be detected by all the AVs.
 
Anyway, if nothing else, this thread has provided a good summary of how Webroot works! 
Nemo, here is just the most recent sample of those 10 malwares, doesn't look like a PUP to me, just a nasty JS trojan downloader. As to why so many companies would not detect it, well, I feel sorry for their users if they got hit with this!
 
https://www.virustotal.com/en/file/be6dd0157cd7ca8bbff9137b539e0def4d3ab9dfd77bfe2e37b6ded578489d75/analysis/1456152535/
 
Here is a description, as to what it does...
http://www.certego.net/en/news/italian-spam-campaigns-using-js-nemucod-downloader/
 
Hope this helps.
 
I just had a look at this. This is a .zip file that contains another .zip file that contains the malicious .js file. If you were to download the .zip attachment from the email containing it, unzip that file, then extract and run .js file from the .zip file that is cointained within the attachment, the downloaded payload will be blocked:
 


 
I'll have a look at the other samples that you have listed, but I'm guessing we'll block the paylod on those too. If not, I'll update our detections for them.
 
-Dan
 
 
 
Userlevel 7
Badge +34
Many thanks Dan for your input. Assuming all samples behave similarly, then we it looks as though we are quite safe - and have been all along! 😃
Userlevel 7
Badge +35
@ wrote:
Hi cavehomme
 
I am afraid that you are getting yourself in a lather for nothing. WSA has been built, from the ground upwards, to be compliant to other security solutions that might run with it...as far as I am aware it is one of the few if not the only security app to do so by design...and as I understand it WSA lets the other security app have a first go at protection but watches what occurs very carefully and if the other application lets anything through WSA springs into action to deal with the 'miss'.
 
Personally, I would not worry about the "...they might fight over the same malware unlike in Windows 7".
 
Just my two pence worth...for what it is worth, and hopefully DanP will confirm that. ;)
 
Regards, Baldrick
Overriding Windows functionality like that is not something we can recommend or support, but it should not cause issues if you choose to do so.
 
-Dan
Userlevel 7
Badge +34
Yes that is normal on W10 and has been like this since W8. The WSA product version makes no difference.
 
It is explained here.
 
 
 
Userlevel 5
Badge +1
Thanks for clarifying Baldrick.
 
I may now need to eat my earlier words, I have just discovered that Panda AV Pro in fact includes a fully functioning firewall that REPLACES the Windows firewall ! I had no idea and thought it was just outbound control. I don't know what extra their IS suite offers but it's surprising to see a firewall in the AV product since it's not really just an AV then.
 
Anyway, where this leads me to is that most likely the original statement is correct that the option / granularity that I seek cannot be achieved in Windows 10 due to the restrictions imposed by Microsoft. Anway, I guess I have confidence in WRSA to make the right choices and so I'll continue to use it. Just hope my earlier feature request (not directly related to this issue) of immediately removing known threats via an online lookup gets approved.
 
Apologies for any confusion that I caused, I'll be more awake next time I post !   😉
Userlevel 7
Hi cavehomme
 
Not at all, and no need to apologise as you have quite eloquently raised and discussed on a point that is, I suspect, more of a concern to many users than they might want to admit.
 
I for one would much prefer to be able to control what is allowed outbound from within WSA as was possible under Windows 7, and I do believe that there is indeed a way of doing that as evidenced by a number of standalone apps that are effectively WIndows Firewall 'helpers'. I have often asked myself as to why this sort of functionality could not be included in WSA, but I think that it is because to do so there would need to be either 2 version of WSA; one for Windows 7 & before leveraging the WFC functionality  and another for WIndows 8 & above leveraging the Windows Firewall-related functionality that came in from Windows 8 onwards.
 
Clearly two versions would not be good or sensible and to have both functionality catered for in the one app would most likely increase the size of the app and therefore to some extent add 'bloat' to it.
 
I agree with you in terms of trusting WSA to handle outbound communications properly but it is a bit of a pain in the neck if one does in fact inadvertently block something that one later wants to allow and as fare as I know (and anyone who knows differently please step in here) the only way to resolve that issue is to uninstall WSA and then clean re-install it.
 
Anyway, I will be intrigued to see what this debates sparks off. ;)
 
Regards, Baldrick
Userlevel 7
Badge +56
To understand how WSA works this thread from Kit is awesome: https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/Scanning-PC-suspiciously-fast/m-p/6636#M215 as well these videos:
 

 

 
Daniel
Userlevel 7
@ wrote:
Many thanks Dan for your input. Assuming all samples behave similarly, then we it looks as though we are quite safe - and have been all along! :D
Thanks, Nemo, for precisely emphasising the point I have been trying to make...that the WSA approach is not a risky one but in fact a very sane approach to the problem...leave the inactive & therefire benign stuff, until it tries to activate, and concentrate on those nasties that are trying to do...well, the nasty stuff to one's system. 😃
Userlevel 7
Badge +35
@ wrote:
Thanks Dan. Can you explain though the purpose of a manual scan of a file? If I download several emails with almost-certain malware attachments and during the download they don't get identified by WRSA as being anything to worry about, well, I can understand the philosophy that they are not active and to leave them.
 
But during download is it actually detecting and comparing with the remote online database, or just ignoring the download? If detecting but then leaving until active, why not just quaranteen and get it off the PC as soon as possible rather than taking a risk later? If leaving it because it does not actually scan the download, then OK, I can understand it will be left alone by default.
 
Second scenario is manual scanning. If I purposefully right click over the downloaded suspected malware files and request a manual scan by Webroot then it must surely be comparing the signature against the online database - it's own or Virustotal for example. So now it has been asked, and now knows there is a malicious payload, so why not quaranteen or remove immediately? Otherwise if left after the scan, it is giving a false impression that the file is legitimate.
 
What if I don't open that file (therefore WRSA will not get the chance to jumpt on it) but instead pass it on to someone else thinking it's not an infected file and the other user is not a Webroot user? Their AV will alert them to a malicious file probably, before they even try opening it. I will have sent them a malicious file and risked their system and data integrity!
 
So under the philisophy of Webroot monitoring file behaviour and then only acting, what is the actual purpose of having a manual scan ability which does not actually alert the user to trojan downloaders, macro virus and other nasties? In the past 2 weeks I have tested more than 20 such malware attachments and WRSA just alerted me on one, and I think that was on actual download not manual scan. The same sample had Windows Defender catch all but 2 on download and then on manual scan those 2 were dealt with.
 
When I ran Windows 7 this kind of feature was resolved because I ran MS Security Essentials and WRSA together but under Windows 10 it is not possible to run Defender and WRSA. Although yesterday I read on these forums that there is a registry hack to allow this, so I am trying it out now, but I am not sure if WRSA will recognise WD as the "primary" AV and allow it to do it's thing when spotting malware and only act if WD fails, or else it will fight with WD to own the malware and deal with it!
 
 
@,
 
In the examples you have given, the attachments have been non-executable files containing exploits that will download and run an executable file when opened, at which point the malicious payload would be detected. For the most part, we focus on the actual executables, which is why those files would not be detected when downloaded or manually scanning the files. If you were to download an attachment that was actually an executable file, it would be detected on download or manual scan. 
 
While it is possible that you could download one of these attachements and send it to someone else, you did mention in an earlier post that you downloaded those attachments from your spam folder, so I don't think that you would actually go into your spam folder, download a suspicious attachement and send it to someone else.
 
-Dan
 
 
 
Userlevel 3
I hate to throw any more wood on this fire but I have to say...
 
I chose WEBROOT because it appears to do its job while using the least amount of system resources.  Yes, I could get a product that scans all files, every bit sent or received via Ethernet, wifi, serial cable etc... but having had a couple of those type products before, I found them to be too intrusive on my day to day activities.  They took my custom built I7, 16gig, 1TB SSD machine and turned it into a 1990's era Celeron machine!  
 
I personally believe that security starts with the user.  If you don't know where the email came from, or who gave you the file via whatever media, DON'T OPEN IT.  On the machines I administered (Which happened to be process control stations in industry) I disabled all USB ports, and any removable media.  I also made sure that users were not allowed administrator privileges.  This carries over to my personal machines as well.  
 
One last thing, I know of several people that have joined various peer to peer networks.  These people are usually first in line to get hit with the various forms of Malware and Virus software that is circulating the net today.  I wonder why?? (Sarcasm)
 
My point is, use a quality product (Webroot) for AV, make my your router / gateway has a quality firewall, then let the MS firewall handle what slips though.  And last but not least use your head, and keep plenty of backups.
Userlevel 7
Hi gahelm
 
Would not disagree with what you say and it all seems to be common sense advice...having said that if everyone headed common sense advice then the malware miscreants out there would have a much harder time of it.
 
Regards, Baldrick
 
 
Userlevel 7
Hi cavehomme
 
There is a great deal of confusion about this particular area of WSA and to be honest we are not sure as to exactly the limitations and under what rules the Development Team are operating under. As you example shows there are ways to do what you are requesting but the issue remains as to whether the design of WSA currently would allow this or not.
 
Of course, we can expend a great deal of time and/or lines of posts in a debate that at the end of it may be moot as it is down to Webroot's product strategy, etc.
 
Having said that there is nothing to stop you from opening a Feature Request for this in the Ideas Exchange. There have been a number of these over the last year or so and none have gained much traction witht he Development Team but perhaps a new Request, formed based on what you have provided in this thread may have more chance of success. So go ahead, raise a request, and we will see how much traction this one gains and whether in the light of what the competition is now doing the Development Team are prepared to take another look at some more granular outbound firewall functionality being included in future versions.
 
Regards, Baldrick
 
 
Userlevel 5
Badge +1
Thanks for the suggestion Baldrick. My understanding form the earlier post was that it was not technically possible due to the way that Windows 10 works compared to Windows 7, but now it seems that it's possibly a product design choice. That's a big difference and it's not something unfortunately I've got time to think more about and post requests at the moment, but thanks again for the suggestion.
 
Perhaps I am barking up the wrong tree, thinking about it, all I simply want the Windows 7 WRSA feature enableed of not allowing unknown outbound processes to communicate to the internet rather than the default option of not allowing this only when infected....but perhaps someone can let me know if perhaps this might be already the default in the WRSA Windows 10 version albeit hidden? I don't need the rest of the granularity options, I don't want to tinker with processes, etc, just that simple but important option. Thanks!
Userlevel 7
Hi cavehomme
 
I completely understand where you are coming from with this...you just want the Windows 7 level fucntionalioty; nothing more...and I suspect that many of us out there feel the same way so I would urge you to open a Feature Request so that all those that agree with you can comment/support the suggestion and also it becomes apparent to the Development Team that there is a requirment for this feature to be reinstated, etc. Especially since you are quite correct and we are seeing a number of applications out there that are managing to interface with the WPS (as opposed to the older, and now defunct, WFC) functionality and thereby have some control as to what occurs outbound.
 
With reagrd to "...this might be already the default in the WRSA Windows 10 version albeit hidden?" I can categorically state that this is not currently possible in WSA and there is no 'hidden' fucntionality that would allo one to do that...apologies!
 
Regards, Baldrick
 
 
Userlevel 7
Badge +34
I don't have much to contribute to this discussion but I have always felt that there is a lot of confusion regarding this issue.
 
It seems that since the introduction of Windows 8 when the ability to adjust the firewall settings in WSA was eliminated, the confusion started when users upgraded from Win7 (or earlier) and hasn't been helped by the fact that the online user guide still refers to the firewall settings available in Win7. Many of the recent upgraders to Win10 have become aware of this change and I do feel that WSA need to address this matter one way or the other.
 
 
Userlevel 7
Hi cavehomme
 
I think that you may have failed to understand how WSA is designed to work; the principle which is alien to the more traditional view of scanning everything, reporting everything that is malicious and then removing it. WSA works very differently by focusing it's resource in watching for and dealing effectively with ACTIVE malware, i.e., when a malware payload attempts to execute WSA jumps on it and nails it.
 
After all, a piece of malware that is not active is just another piece of software and does no harm, so why waste precious resources on it UNTIL it tries to activate.
 
That is how WSA works...and as you say it is a matter of some trust as to whether one is prepared to put ones faith in such a non traditional approach. But let me speak from personal experience...I have used WSA, every since it was introduced (which was shortly after it acquired Prevx, and I had been using Prevx prior to the acquisition), I have been attacked a small number of times and in every single case WSA has protected me completely.
 
Now nothing is 100%, not even WSA, but I personally would not use anything else as my primary line of defence against malware.
 
Not sure if that helps but just wanted to share with you.
 
Regards, Baldrick
Userlevel 7
Badge +34
Thanks for the feedback caveman. I also use Win 7 but was interested to hear that you cannot run WD with WSA on W10.
 
I am somewhat confused by these 10 sample files that you downloaded. You say that they were identified as Trojans or viruses but that half of the VirusTotal AVs gave them a clean bill of health, as did WSA. This suggests to me that they cannot be particularly malicious or surely they would be detected by all the AVs.
 
Anyway, if nothing else, this thread has provided a good summary of how Webroot works! 
Userlevel 7
Badge +56
@ wrote:
 
Dan, thanks for clarifying.
 
I had assumed that attachments detected as Trojans by WRSA and other AVs would be considered by WRSA as capable of executing a malware process directly or indirectly, hence cause for WRSA to act immediately from the get-go.
 
The scenario that I painted, I would not actually have forwarded such an email myself, but was using myself as an example of someone such a business professional who receives an invoice or Fedex delivery note by email and then forwards it to an admin person to administer. That admin person might not be in the same office therefore not have WRSA,  they could be outsourced and have another AV.  So in other words, my point is that if WRSA knows that it has a Trojan or other malware not yet executed, then the owner of the PC may pass on the file unaware that it is malicious. WRSA could have already taken action which Defender and many other AVs would have already taken to neutralise the threat.
 
I don't want to change AVs, I like WRSA but was really surprised to experience so many malicious files (a sample of more than 20) being passed by WRSA as being OK at download and manual scan. AT the time of download or manual scan WRSA is, I guess, already looking up that file online and so it can check the signature and know it is suspicious. So why not quaranteen it then, or at least put a flag on it to warn the user? From the user's point of view that file just received a clean bill of health not once but TWICE by WRSA (at download and manual scan) when in fact it was widely known as a malicious file. In other words, by twice giving the OK status to a file, WRSA is mis-representing that file as a legitimate file and that file may continue through the user's workflow and do a lot of damage elewhere.
 
Surely does not add bloat to WRSA to online lookup a file even on Virustotal and know it's a suspect and quaranteen it imediately?
 
In the meantime that's exactly why Webroot should allow people like me and quite a few others who used  WRSA on Windows7 together with MS Security Essentials which sweeps up all these obvious Trojans and just leaves WRSA for the more elucid malware, to now do the same on Windows 10, but as you will be aware, WD and WRSA cannot run together on Windows 10.
 
I realise I raise a few issues, but I assure you that main aim is to have an even better WRSA that we have now whilst also raising legitimately serious issues from the real world of the user. I use WRSA on my business PCs and I  am explaining these real world scenarious from real experience of how people work, it's not a theoretical discussion.
 
 
But you can run WD with WSA but why would you want to?
 
https://community.webroot.com/t5/Webroot-SecureAnywhere-Complete/What-s-the-difference-between-the-new-Windows-Defender-and/ta-p/13852
 
https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/How-to-Run-WSA-alongside-Windows-Defender-on-Windows-8-Windows-8/ta-p/23058
 
Thanks,
 
Daniel
 
Userlevel 7
Hi cavehomme
 
I am afraid that you are getting yourself in a lather for nothing. WSA has been built, from the ground upwards, to be compliant to other security solutions that might run with it...as far as I am aware it is one of the few if not the only security app to do so by design...and as I understand it WSA lets the other security app have a first go at protection but watches what occurs very carefully and if the other application lets anything through WSA springs into action to deal with the 'miss'.
 
Personally, I would not worry about the "...they might fight over the same malware unlike in Windows 7".
 
Just my two pence worth...for what it is worth, and hopefully DanP will confirm that. ;)
 
Regards, Baldrick
Userlevel 7
Hi cavehomme
 
Look, it is really simple in my book...the designer of WSA designed it to work in a certain way, based on certain permises...and work it does based on that design...as such I have chosen to trust in that design and its execution...and I leave it at that.
 
As far as I am concerned that is all good for me/I am happy with that.
 
You are free to express your views as you see fit and they are as valid as anyone elses...as they are yours...just don't expect anyone to act on them any time soon. That is Webroot's choice in the matter...if they want to they will and if they don't they won't.
 
Regards, Baldrick
Userlevel 7
Badge +56
It still has a Firewall and it's a Smart Firewall as it will block malware from calling out to it's control center and you will get a pop-up if that's the case. If you want more granular control maybe look for a third party firewall but again it still uses the same API's from Windows 10. https://en.wikipedia.org/wiki/Application_programming_interface
 
Note what JoeJ said here:
"PrevxHelp( JoeJ, VP of Development ) wrote:
 
The firewall in Windows 8 is much easier to work with than previous platforms because of the built in OS controls. Every vendor needs to use the same APIs now (the older methods are deprecated), but that's exactly why we aren't doing it currently - no matter what vendor wraps the APIs, it will be exactly the same underlying calls which are built into the OS, and you can use the OS UI to do the same job if you want to customize it.
 
The reason why we have the functionality on Windows 7 and not Windows 8 is because Microsoft doesn't expose the same normalized interfaces on Windows 7 (or require vendors to use the new APIs)."
 
 
Thanks,
 
Daniel 😉
Userlevel 7
Badge +56
I'm just saying Webroot could but they would be using the same API's built in Windows 8 and 10 as all other Firewalls have to as well. I would like to see the Granular control back but I don't think it's a priority for Webroot.
 
As I posted here: https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/No-firewall-settings-for-WRSA-AV-on-Windows-10/m-p/239337#M23002
 
Daniel
Userlevel 7
Completely agree, Daniel...I suspect that given the differences between what is available in Windows 7 and subsequant versions of Windows it is just not a very important topic at the moment in terms of the WSA road map...more is the pity as I thinkthat it is an area where an improvement would be welcomed by many user.
Userlevel 5
Badge +1
@ wrote:
Completely agree, Daniel...I suspect that given the differences between what is available in Windows 7 and subsequant versions of Windows it is just not a very important topic at the moment in terms of the WSA road map...more is the pity as I thinkthat it is an area where an improvement would be welcomed by many user.
I think that fundamentally it comes down to an issue of trust. We don't necessarily need lots of drill-down options to control things if we fundamentally trust 100% the Webroot team.
 
But in my tests this weekend I'm now really sitting on the fence on the trust issue. I downloaded 10 attachments from the past week in my spam folder with WRSA enabled and not a single squeak from WRSA. So I then scanned each file, again not a squeak. I then uploaded all of them to Virustotal and indeed they were all malware, but typically only 50% of AV softwares detected them as being malicious.
 
Interestingly ALL of the sample were identified as malware by Windows Defender. So guess what? I've now fallen back to WD because I simply trust it more....I find that difficult to say and accept, but based on not only my test, but also AV Test and AV Comparatives they are now ranking WD at 95% or above detection rates.
 
To detect the other 5% and for secure banking, I would love to use WRSA in the same way that MS Security Essentials and WRSA can co-exist on Windows 7, but it's impossible on Windows 10 because WD is switched off when Windows detects WRSA as full AV solution and not treated as just an extra layer of security.
 
So now to get approaching 100% malware coverage I am reverting to either Malwarebytes Premium which DOES work as an extra layer of security on top of WD, or possibly Spyshelter or Zemana, but they are taking me back to the horrible days of chatty HIPS alerts even for trusted processes and applications, ouch!
 
Bottom line is that I really want to make WRSA work, but due to the issues I've noticed plus the fact that as a workaround I can't run WD + WRSA as the extra layer, I am being forced by Webroot design policy to look to alternative solutions. I really want to keep giving my money to Webroot, but they need to wake up and deal with some of these issue. I'm not being arrogant but I guess that for each one person like me there might be a few hundred or even thousands thinking and doing the same, just quietly in the background without sharing their experiences or frustrations on this forum.
 
Userlevel 7
Hi cavehomme
 
WSA has not failed to detect those 10 elements of malware it has just not because they are of no consequence or no threat to your system...that is all. It is a false sens of security when one has a more traditional AV or IS app scan ones system, declare it has found 100 threats and either quarantined and/or deleted them. That is all well and good but if none of them were goingt o cause any damage then what is the point...a false sense of security.
 
Personally, I think that detecting & dealing with active malware consisently and throughly, as WSA does, is far more important than the more traditional approach. And it gets worse, when the traditional AVs & ISs include cookies in their threat tally.
 
Of course, it is horses for courses and one must do what one thinks is for the best. So good luck to you in your search for something better than WSA...unfortuantely I do not think that will find it.
 
Regards, Baldrick

Reply