Endpoint Protection

I have a user having issues and the only thing that changed was installing webroot.  I want to disable the agent remotely to see if the users notices a difference.  I created a test policy that allows the agent to be shutdown.  Is there a way I can run a terminal command to shutdown the agent?

I am getting below error while installing sql services on my windows server 2016 machine.(13) 2022-05-16 05:19:09 Slp: Sco: Attempting to open registry subkey {145996FC-8E6B-47AB-BEA5-A84F12B72AF5}(13) 2022-05-16 05:19:09 Slp: Prompting user if they want to retry this action due to the following failure:(13) 2022-05-16 05:19:09 Slp: ----------------------------------------(13) 2022-05-16 05:19:09 Slp: The following is an exception stack listing the exceptions in outermost to innermost order(13) 2022-05-16 05:19:09 Slp: Inner exceptions are being indented(13) 2022-05-16 05:19:09 Slp: (13) 2022-05-16 05:19:09 Slp: Exception type: Microsoft.SqlServer.Configuration.Sco.ScoException(13) 2022-05-16 05:19:09 Slp:     Message: (13) 2022-05-16 05:19:09 Slp:         Attempted to perform an unauthorized operation.(13) 2022-05-16 05:19:09 Slp:     HResult : 0x84bb0001(13) 2022-05-16 05:19:09 Slp:         FacilityCode : 1211 (4bb

Loving to use Winget (sorry, no Wingate) for all software installed upgrade, I found for my surprise that it detected Webroot installed under Webroot SecureAnywhere (Installed Webroot Endpoint Protection v9.0.32.60)And it says (as you can see) ‘Successfully Installed’, but Webroot Console online says nothing change. Soo… I don’t know what’s going on.Hope they fix it in the near future, since there is no easy way from WEBROOT to update antivirus, not even force to update, not even in the console.. the only antivirus at any level (personal or enterprise edition) that I know for decades that doesn’t help you to update their product in any easy way. Go figure. 

Hello everyone,My company is using Webroot SecureAnywhere for Business. We are trying to deploy an application that may require us to turn off webroot. Everything I’ve seen shows how to do so manually via the client’s GUI. This is too time consuming as we have dozens of endpoints. Is there a way to shutdown webroot via powershell (or any other automated way), install what I need, then turn it on again? I know the security implications of this and understand why this may not even be possible. But I just wanted to make sure.

 Some of our endusers (not all) are experiencing problem with the Webroot Web Threat Shield extension in Microsoft Edge (the new Chromium based version). They get a request to enter the keycode. That should not happen, as the environment is fully managed by us as MSP. Is this a known bug?

Hello, Recently we have seen fileless malware come up on some endpoints. PowerShell is launching a script that loads a text file, that spawns a remote connection back to an attacker.I understand the Evasion Shield is supposed to detect this. Is there a way we can block PowerShell scripts with Webroot, or even better, where we can be alerted if a PowerShell script launches, or can we block it, etc? Thank you

MSP here using endpoint protection.Problem 1 - For some reason my Webroot clients never update, on any computer. I always have to install the latest WRSA.exe installer manually. This has been going on for over a year.Problem 2 - I installed the latest, 9.0.32.60 a few minutes ago. Upon inspecting the WR log files, I found that Webroot is blocking itself when updating/installing.Blocked: Webroot Process ""C:\Program Files\Webroot\Core\WRSkyClient.x64.exe" 

I am getting this error in the Windows Event Log on my server - it is happening with high frequency…WRCoreService.x64.exe Exception code: 0xc0000374OS = Windows Server 2016 1607Can anyone help me solve this issue? 

Just updated to Mac Monterey 12.3 yesterday, and Webroot 9.5.0.139 detects Xprotect Remediator MRT v3 as Keylogger.Refog.1.r. Can anyone verify this, please?Thanks.

Hello, I need help whitelisting a specific file on a specific machine.  We are running Webroot SecureAnywhere with a centrally managed console.  I’ve tried following the instructions located in this thread:https://docs.webroot.com/us/en/business/wsab_endpointprotection_adminguide/Content/UsingOverrides/CreatingWhitelistOverrides.htm I’ve tried creating an override on the desktop without success, but even when I stick the file in the root of C:  and create an override to the folder in that location it does not work.  I’ll attach a couple screenshots for reference.  I’ve also got an open ticket and am waiting on a response, but wanted to ask for any suggestions here? 

My software is set to the default settings where it scans the device daily. The scan report window does not go away. Each day a new scan window is there and these windows stack on top of each other. When I log in remotely the taskbar has a stack of webroot windows that I must close individually every day. This is annoying. Previous research said to remove and reinstall the agent. Tried that. It did not work. Any help out there please?

HiWorking for an MSP and I am noticing an emerging issue with the identity shield causing Chrome to hang or launch with a blank screen.  The circumstances are: Windows 10 2004 January 2021 Windows 10 CU installed Webroot installed and up to date Nvidia graphics card (no specific  model) Chrome installed and up to dateIf all of these are fulfilled except for the January CU, the problem does not occur.  It also does not seem to occur on machines without Nvidia graphics.  I have seen 10 instances of this since yesterday, and was able to replicate the issue on brand new machines.The workaround is to set the application protection for the chrome.exe to allow rather than protect.

I have Poll Interval = 15 minutes. One customer turned off his computer (running Windows 10) for a while, so the status of the agent is Unseen… Now, he turned on, the agent was updated to 9.0.31.86, and it’s almost one hour already, the status of the agent is still Unseen from… Besides, I sent Re-Verify Data command, and the system said “Reverify the contents of the selected device's local database when the next scan takes place.” However, even I tried to run scan manually, the command log is still showing status: Not Yet Received.Any other setting that I can push the update between the agent and the management console quicker?Thanks.

A client is required by their bank to run IBM Trusteer Rapport Securty software in order to login to their business online banking account. A Chrome plugin for this application recently failed due to WebRoot Identity Protection Application Protection blocking a DLL used by the program. After an hour spent attempting to whitelist the DLL, then the entire application folder, I contacted WebRoot support.   In the end, support was not able to get the DLL whitelisted successfully, and it has been necessary to turn off Identity Protection altogether in order for the plugin to run, allowing access to the online banking site (required for direct deposit processing for payroll).   Has anyone else run into these kinds of unresolvable issues with whitelisting? Leaving Identity Protection off for any length of time is not an option really, yet at the moment it's the only way to get any protection and have the ability to process payroll for this small municipality.

   I just can’t say enough bad about Webroot. I blew it away two years ago because of all the problems and lack of support. So here I am two years later and am still being haunted. I uninstalled it from all my endpoints but it did not remove itself from SecurityCenter. It is still in the WMI. That really doesn’t surprise me. It is obvious that Webroot has no business getting in to the virus arena but anyway….. is there an automated way to remove the Webroot entries in the WMI?

HiI have had console alerts setup to notify me of Threats and Installs for 3 years but in the last 6 months I have not been sent notifications for detected threats or installs on all bar one occasion where I received it 24 hours after the fact.It used to all work instantly.I have raised this with support now and in the past and not got very far. Is anyone else experiencing this issue and if you managed to fix it how did you do so?Thanks Bill

I am new to managing webroot so please bear with me. I am trying to install software on an unmanaged endpoint (windows 10 pc) and webroot keeps blocking a single file. I know this file is safe. How to I tell Webroot to let this file be installed

Good day, why do I need to do a clean up  on an endpoint if it has already been automatically remediated? Thank you

For SOC Compliance, we need to have a evidence of our policies. Currently the work around is to just take screen shots, but this is very tedious and inefficient.I see there was an older thread, however that answer does not apply to the current UI.We currently use the CE 21.4 version, is there a solution to be able to export the policies? (I tried through the reporting tool, but I do not see the option there as well...)

Everytime I try to open up chrome, I get the spinning icon and nothing opens.  If I disable Webroot, I can open it up no problem. I am using windows 10 home edition.

@freydrew @Rob House In the live Q&A post about the new console, you said that friendly names would be shown from the old console but functionality did not yet exist to rename in the new console.I’m disappointed to tell you that friendly names are NOT being shown in the new console.  This is going to make management very difficult.  Is this a bug that you’ll be fixing soon?REF:  

This link mentions that Secure Anywhere Endpoint Protection can “Lock down ports and devices such as USB, CD and DVD Drives” - We’re looking to possibly wanting to lock down USB Storage devices from being access on our machines. How/where can I configure this in our Webroot Policy? http://wrpolska.pl/wp-content/uploads/2013/01/WSA.pdf 

MSP here.  I’ve seen other posts that discuss Webroot with Windows Defender, but now that it’s 2021, Windows 10 has changed a bit.Why other posts don’t apply anymore: Disable periodic scans in Windows Defender is no longer an option According to this article, you can set a DWORD value in the registry to enable Passive Mode for Defender, however, upon setting it, is has no effect on issue #1 belowTwo issues:With Webroot + Windows Defender enabled, Windows Defender is still actively scanning data in real-time.  I ran a test and saw the Microsoft Anti-Malware service spike up to 30-40% CPU usage.  Webroot is installed and functioning correctly, but Webroot doesn’t seem tell Windows Defender to tur

Is anyone using Webroot and N-able RMM, any integration between the two?

My alerts and any details I have been able to find in the console all refer to paths with variables that are not resolvable.   Is it possible to get the full actual path of malware rather than it showing with variables like %appdata%???   The problem is I do not know which user so I cannot determine the path and more importantly who.   This is an example of the issue. Who's appdata?   Threat List: APPLICATION-C2A064D9174E0B78AFDA[1].JS, W32.Trojan.Lisp.Autocad, %appdata%microsoftwindowsinetcachelowie4lldmwe4,   http://snup.webrootcloudav.com/SkyStoreFileUploader/upload.aspx?MD5=F239541E10FEF69C6D9AFCD7D897AD58 F239541E10FEF69C6D9AFCD7D897AD58,