Webroot affecting AutoCAD 2018 performance severely

Hello @ronnieshih and Welcome to the Webroot Community!

The best thing for you to do is to Submit a Business Support Ticket and ask them to check things out for you as it could be some files need to be whitelisted in the Webroot Cloud Database especially if there was a recent update to AutoCAD 2018.

Thanks,

@ronnieshih - I would like to suggest you capture the "undetermined" report on one of the workstations in question and submit it to me personally and I'll have threat include it as part of our central data rules. This is the most efficient method for more complex solutions. AutoCAD is something we have extensive knowledge about, but if you're still experiencing something unique, we may need to include additional rules to end/stop any monitoring.

So you're aware, our agent is not a "traditional scanning" engine, so traditional methods of "overriding" do not always apply. Also, my guess is more inline with the agent monitoring a process that is "unknown" and has nothing to do with the file types. The best course of action was as @TripleHelix suggested, but the request should have been for them to submit software for review, not necessarily how to make a better override. If support didn't understand the request, they may not have provided the right direction.

If you have one of the problematic systems still installed, simply capture the "undetermined" software report at the site level or now at the main Admin console level above the sites, "Devices with undetermined software on last scan" under "Reports". This will include all the data our central threat team needs to craft an appropriate rule to insure it's not effecting your customers endpoint performance.

Please reach out to me directly through DM here on the community or you're welcome to email me directly at: scooper@webroot.com to discuss further and/or review.

Thanks,

@ronnieshih - it could be any number of things, but again, my guess is that it's a process that is unique to his data file. AutoCad and many solutions have tons of DLLs and EXEs that may be at rest until something specific in his drawing/design calls it and causes the CPU to spike due to WR monitoring.

That log will help, but it will only capture data while WR is running and AutoCad is running, so make sure they're both running and the issue is present.

You can also look at the WR UI to see what process is being monitored. Open WR on the endpoint in question, select the icon on the right of Utilities. When that comes up, goto the System Control Tab and start "Start" button. This will show you what is being monitored. From there you may be able to determine which process is causing issues.

Logs should capture this as well, but this is a quick method for sussing out a monitored process.