We have webroot business, managed inside the portal. A user is running AutoCAD 2018 software and I've followed AutoCAD's recommendation on AV exclusions and configured those under "Override". However, there is no option to exclude specific file extensions within Webroot business, such as excluding *.dwg or *.dwf files from being scanned when they get launched via AutoCAD. This is a major flaw... how is a product in the magic quadrant not having a classic AV software feature?! The whole system basically bogs down with CPU seriously spiking due to Webroot getting and scanning at the file. The problem is obviously Webroot because once I unload Weboort, AutoCAD runs at a swift pace.
If anyone has any suggestions, please advise. thanks.
Already have an account? Login
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
The best thing for you to do is to Submit a Business Support Ticket and ask them to check things out for you as it could be some files need to be whitelisted in the Webroot Cloud Database especially if there was a recent update to AutoCAD 2018.
So you're aware, our agent is not a "traditional scanning" engine, so traditional methods of "overriding" do not always apply. Also, my guess is more inline with the agent monitoring a process that is "unknown" and has nothing to do with the file types. The best course of action was as
If you have one of the problematic systems still installed, simply capture the "undetermined" software report at the site level or now at the main Admin console level above the sites, "Devices with undetermined software on last scan" under "Reports". This will include all the data our central threat team needs to craft an appropriate rule to insure it's not effecting your customers endpoint performance.
Please reach out to me directly through DM here on the community or you're welcome to email me directly at: firstname.lastname@example.org to discuss further and/or review.
Support would like me to run wsalogs.exe, I will to get this done today without disrupting too much of the user's time and see where we get.
That log will help, but it will only capture data while WR is running and AutoCad is running, so make sure they're both running and the issue is present.
You can also look at the WR UI to see what process is being monitored. Open WR on the endpoint in question, select the icon on the right of Utilities. When that comes up, goto the System Control Tab and start "Start" button. This will show you what is being monitored. From there you may be able to determine which process is causing issues.
Logs should capture this as well, but this is a quick method for sussing out a monitored process.