Hiren's Boot CD(Cloning drives). Webroot threat

Hello @SLW 

Can you please Save a Scan Log and post the lines near the bottom of the log that show the removal of the said file and or files.

Right Click on the Webroot Icon down near the Clock to Save a Log!

Thanks,

Is this what you’ve after? Thu 2017-05-25 21:28:50.0231    End passive write scan (1 file(s))
Thu 2017-05-25 21:34:10.0346    Begin passive write scan (1 file(s))
Thu 2017-05-25 21:34:11.0483    End passive write scan (1 file(s))
Thu 2017-05-25 22:07:51.0030    Begin passive write scan (1 file(s))
Thu 2017-05-25 22:07:52.0263    End passive write scan (1 file(s))
Thu 2017-05-25 22:20:21.0875    Begin passive write scan (1 file(s))
Thu 2017-05-25 22:20:23.0402    End passive write scan (1 file(s))
Thu 2017-05-25 22:24:49.0595    Begin passive write scan (1 file(s))
Thu 2017-05-25 22:24:50.0837    End passive write scan (1 file(s))

I need the lines that show the file that was removed as I need the file hash! And the above is from 2017.

Please contact Webroot Support via the Ticket system! They will sort it out for you!

https://detail.webrootanywhere.com/servicetalk.asp?

I’ll just post what’s different than my last one from the bottom up.

Scan Started:  [ID: 962 - Flags: 1575/0]
Thu 2017-05-25 08:26:09.0157    Scan Results: Files Scanned: 23093, Duration: 1m 38s, Malicious Files: 0
Thu 2017-05-25 08:26:09.0447    Scan Finished: [ID: 962 - Seq: 194099164]
Thu 2017-05-25 09:07:56.0231    Begin passive write scan (1 file(s))
Thu 2017-05-25 09:07:56.0665    End passive write scan (1 file(s))

Begin passive write scan (3 file(s))
Tue 2017-05-23 15:21:48.0221    End passive write scan (3 file(s))
Tue 2017-05-23 15:24:04.0155    User process connected successfully from PID 0, Session 0
Tue 2017-05-23 15:24:04.0202    User process connected successfully from PID 704, Session 2
Tue 2017-05-23 15:24:08.0071    User process connected successfully from PID 0, Session 0
Tue 2017-05-23 21:13:54.0888    Scan Started:  [ID: 960 - Flags: 1575/0]
Tue 2017-05-23 21:15:26.0462    Connected to A20
Tue 2017-05-23 21:15:26.0760    Scan Results: Files Scanned: 21103, Duration: 1m 31s, Malicious Files: 0
Tue 2017-05-23 21:15:27.0005    Scan Finished: [ID: 960 - Seq: 193972525]
Wed 2017-05-24 05:50:59.0539    Begin passive write scan (1 file(s))
Wed 2017-05-24 05:51:00.0471    End passive write scan (1 file(s))
Wed 2017-05-24 06:45:08.0856    Scan Started:  [ID: 961 - Flags: 1575/0]
Wed 2017-05-24 06:46:27.0950    Scan Results: Files Scanned: 21584, Duration: 1m 19s, Malicious Files: 0
Wed 2017-05-24 06:46:28.0220    Scan Finished: [ID: 961 - Seq: 194006787]
Wed 2017-05-24 09:05:19.0587    Loading package: 4/16973835
Wed 2017-05-24 09:05:19.0611    WF Configuration : 0x1E7

Again that is from 2017 not 2023 and it’s not the correct lines I need so contact Webroot Support!

I see that there are days for each line. I believe this happened today but I’ve been trying to work on my situation for the last few days.

Thu 2023-12-28 16:55:28.0210    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-QMJQG.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 3 (36937)
Thu 2023-12-28 16:55:28.0210    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-QMJQG.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 4 (36937)
Thu 2023-12-28 16:55:28.0217    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-QMJQG.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 8 (36937)
Thu 2023-12-28 16:55:28.0217    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-QMJQG.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 6 (36937)
Thu 2023-12-28 16:55:29.0521    Monitoring process E:\Users\Daniel\Downloads\InstallCyberLock766.exe [2DDD09A6540740CF64C9B002CDD006E4]. Type: 2 (36936)
Thu 2023-12-28 16:55:31.0075    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-7JMUH.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 3 (36937)
Thu 2023-12-28 16:55:31.0075    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-7JMUH.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 4 (36937)
Thu 2023-12-28 16:55:31.0091    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-7JMUH.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 8 (36937)
Thu 2023-12-28 16:55:31.0091    Monitoring process C:\Users\Daniel\AppData\Local\Temp\is-7JMUH.tmp\InstallCyberLock766.tmp [B45B57079668093DE3B21AF2C174820B]. Type: 6 (36937)
Thu 2023-12-28 17:12:10.0959    Scan Started:  [ID: 151 - Flags: 551/0]

Please contact Webroot Support via the Ticket system! They will sort it out for you!

https://detail.webrootanywhere.com/servicetalk.asp?

I saved the log as you described and it didn’t allow me to save in the default location and let me save under my user name and that is what it saved under my user name.