Endpoint Protection

Hi I was trying to find a way to uninstall other AV software (ESET in this case) using WSA. I did the following: I created an override in the console for ESET marking it as bad. It seemed to work pretty fine because ESET disspeared. Would you recommend such actions or rather not? Do you have any other suggestions about how to achieve this? For example executing an agent command with some DOS command? It would be a huge asset for companies with many endpoints if they could uninstall their previous software with Webroot.

I am testing msi deployment as we are about to roll this out to an enterprise client. I am using a "live" test environment of various server and client operating systems. When I first deployed this to a client machine, the webroot icon in the system tray had a warning triangle stating that a scan was required. Is there anyway to get Webroot to scan immediately anyway, as with 200 + machines to roll this out to, we could do without manual intervention.   TIA

Hi all, In the Remote Deployment Tool I'm receiving a "Authenticating...failed, Unexpected error 1909" when scanning our network for endpoints. What does this mean and what triggers it?  I have been able to use the RDT successfully before, deploying to about 30 computers.  Last week, the first time I received this message, I refreshed the states and the endpoints showed up as normal and I could deploy changes. Now no matter how many times I refresh I get this error and the status of these endpoints changes each refresh state. They flip between the the 1909 error, and "Invalid Username/password" and "Network path not found."  My coworker's RDT pulls up the endpoints just fine.    I'm not sure what's going on.  Any insight would be appreciated.

1.  What If my hard disk crashes.. or in case of any other accident ... Should I buy another version of Webroot SecureAnywhere ?   2.  Will there be any issues when buying online ... like late supply of bill or anything else ?

Are there are guidelines on how large the overrides list in the console should be, max?   Also, is this list handled in the cloud only or is it somehow downloaded to the clients as well?

i have a security concern/question that i'd like to check with some sercurity experts on this forum. I have an AD enviornment here and i'm considering disabling UAC via GPO to help resolve some minor issues with users accessing network shares.   I've read on more than one occasion on the internet recommending disabling UAC to solve one problem or another and not necessarily my particular problem.   I'm worried about the security hole that I might open and that i may regret later. So, trying to find that balance here in this enviorment.   any tips/advice on this matter is appreciated.  i can provide further details on the issue i'm trying to clear up if interested.

If you have a minor question you don't want to create a topic about, post it here and we'll try to answer. These should be very small questions/things you might feel silly asking. Otherwise please create your own topic - you're free to create as many as you want.   If you're a business customer and you need an answer right away remember that Webroot premium business support (ticket and phone) is included as part of your subscription. Shout-out to Ron and Greg who are legit.

I installed webroot. My main drating program needed an update. I tried to update and got Feature Transfer Error- Message Acess Denied. Unistalled webroot. Still wouldn't work. Uninstalled my program for fresh install. It still get the same access denied message for an intall. Got another install version. Same thing. Any ideas?

Hi Could anyone please explain a little bit more the following option in WSA: "Enable Predictive Offline Protection from the central SecureAnywhere database". From what I read about it it seems to be a sort of a local mini signature database. Is that right? So where is it located? How big it is? Is it updated constantly? How effective/comprehensive it is? Thanks!

Hi I was wondering why do you think it's safe to use MD5 hash instead of for example SHA-2. From what I heard MD5 is very susceptible to collision attacks.

Hi All    Haviing a very strange issue with some of our users when performing a search on www.google.com. When searching, users are randomly getting the following error message.   "Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending the requests, and not a robot"    We dont think this is an issue with our network as when we switch off webroot we no longer get the error message.    Anyone have any idea? Go easy on me i am a noob.      James.    

I'd like to change some settings for the system cleaner, but it rejects changes because they need to be applied via the admin console. I have yet to find any settings for this in the admin console, or any way of overriding GUI changes for system cleaner and active process control.   Any thoughts?

Dear Expert, I am a business customer for Webroot Security anywhere. Looking for an additional solution to apply company security disclaimer notice for the end user once they login to the computer. I would like to see the feedback from your end, what can be done to implement. Thanks

Here's something really cool I've been working on and it's now nearly complete.    This is going to be great for businesses with hypervisor labs:   here's the link to the discussion and progress on Vmware's forum: http://communities.vmware.com/thread/427502?start=0&tstart=0   Please check it out and feel free to additonally discuss it here as well!    I hope this thread assists many people!

The New York Times and Wall Street Journal have recently published articles on having their networks hacked by the Chinese government and malware planted on their machines. The malware was not detected by the security and anti-virus software these companies used. (If I recall, the NYT said that it's Symantec security software flagged 1 out of 46 pieces of malware.) Is webroot getting access to those malware samples and adding them to it's detection capabilities? http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all&_r=0

Hi,   I see that among the setting of business mobile protection there is a Device Attribute called "Ownership" and you can set this to  "Employee owned" or "Company owned".   Firstly, I just cannot find this setting explanation in the online help, so you may add explanation there.   Secondly and most importantly, I got to this setting because my client is looking for a possiblitiy to enable the user of the device to set enything they like on Employee owned devices for the mobile protection, but wants to disable any setting changes on Company owned devices in the name of BYOD. (Something simliar to "Unmanaged" group in the business endpoint protection.) Can this setting do this for them? Or what is this setting really for?   If this cannot do it today, this is a feature request and will you develop it and when?   Best regards, Gyozo

Hi Are you aware of any issues with service pack 3 for xp? WSA seems to block this update. After disabling WSA it installs without problems.

AGENT CHANGES IN BUILD 8.0.2.127 -  March 27th 2013 http://sw.nohold.net/Webroot/Images/wsab_endpoint_logo.png Improved Agent shutdown speed Behavior logging in WIndows Event Logs Identity Shield functionality on Windows Server 2008 Kernel keylogger protection Migration process for Prevx users to SecureAnywhere   Added A registry value of type DWORD named NoStatistics under HKCUSoftwareWRData which, when set to 1, disables the behavior statistics on the status screen   Fixed An issue with changed settings and local database data on shutdown Compatiblity with Jeeves GARP software Identifying cloud managed configuration settings   Other Minor UI changes All Contents Copyright © 2013

I could do with a bit of assistance. I have downloaded the remote deployment tool to my local PC (we're a IT support company and I'm using my colleagues as guinea pigs). I have an .msi that I would like to deploy, and a list of the NETBIOS PC names that I want to deploy to. I have checked on a few of the computers that my account (by group membership) is an administrative account. The PC's I currently want to deploy to are Win 7. When reaching the Remote Depoyment screen, I am getting various errors from Not Installed to authentication errors. I could do with someone pointing me in the right direction.

I would like to know if it's necessary to exclude the databases from being scanned. I can't find any info that specifically mentions Exchange or SQL; it's been common practice to exclude these from AV scanning. I would appreciate some clarification.

Sorry, but I don't have time to pour over the new agreement. I'm afraid to click off on it and be possibly be bitten later. It would be nice if someone could post the differences between the new and previous agreements. Until then, I am unable to administer my endpoints and I need to badly. There seems to be some malware hijacking yahoo accounts on some of them.

Hey,   Wondering if it's at all possible to automatically move a new computer to another group?  Preferably via the command line or MSI.   We're about to begin a rollout and would like to put each department into different groups, obviously this can be done via the management console, but we'd prefer to automate it a bit more.   Any help appreciated.   Thanks,   Ryan

Hi!   I'm fairly new to webroot so this might be a trivial question.  In the few months I've been at my job we have received a few attack alerts emails from webroot.  The emails always specify that 2 PCs are affected and when looking into it's really only 1 PC recently affected and the other was another instance that occured days or months ago (perhaps the last instance of an attack).   Is there a reason why we are always are told 2 PCs are affected?  Is this a setting that just needs to be adjusted?   Thanks!

Hello, we are using MozyPro online backups to backup our file server and SecureAnywhere Endpoint Protection on that same server. Unless we manually disable Realtime protection on the server, the backup always fails.   I have added overrides for both the mozyprostat.exe and mozyprobackup.exe processes using their MD5 values. Regardless, I still need to disable realtime protection in order for the backup to run. Curiously, neither the Endpoint Protection agent nor the management console list any threats.   Any suggestions?

Can someone explain what this is and how it works. "Securely edit your profile and password information for any of your protected Web sites from any computer with Internet access" Don't want to set something up that creates user issues. Thanks