Secure Cloud

The current customization options for the DNS block page is a little lacking. We added a mailto link in the page to send an email to request a site be unblocked/updated. This goes to our ticketing system. The issue though is that many end users forget to put in the site they need unblocked, so it creates additional overhead in reaching out to the end user to find out which site it is that needs to be corrected. (Most of the time, the site is just categorized incorrectly.) Is there any way to get this information available or to edit the customization text as HTML instead of a WYSIWYG text editor? If we could edit as HTML I could add in a tiny javascript tag that would pull the address and incorporate that into the mailto link so we would always have the correct site that needs to be unblocked.

The content from Teach Privacy is gone from Security Awareness Training. There is not enough security content left. Of the 28 modules 4 are how to use office, 4 are for UK compliance, 2 for Australia, there are 3 for phishing which are micro, mini, full of the same course. There is a data protection module for legislation which is out of date since GDPR came in. There are 5 courses I’m happy to push out to customers: GDPR, Understanding Cyber Security, Ransomware & Cybercrime, Understanding Phishing (full), Understanding Malware (which is an advert for Webroot, so maybe I'm not too happy with that one.) . We have our customers signed up to a subscription service based on security awareness training, we need more security related content. Is there more courseware to come? If so when?

In the Webroot console, how do we permanently delete a quarantined threat? I see in the front-end user GUI the option to permanently delete from quarantine, but user receives error message that settings are centrally managed. Also, will the "Needs Attention" then clear? On a similar note, if we create an override for a found threat, should the "Needs Attentions" clear or about how long should it take before that status clears? Thanks so much for any input!

I periodically get a "A timeout (30000 milliseconds) was reached while waiting for a transaction response from the DnsProxyAgent service" message in my event log. Sometimes this happens twice in a span of 36 - 39 seconds. What could be causing this? I still have DNS protection running according to dnsptest.webroot.com and I haven't really encountered many issues. I just want to reduce errors in the event viewer.

I cannot sign-in to my account. When I request a new password, Webroot's reply never appears at email provider

Hi I am trying to install a new version of Webroot onto a machine that have previously had an installtion of webroot on them. When I install the new version they old licence key is being used and the PC is reporting into our old MSP's console. I've tried to use the installer with the licence key already and the MSI and manually enter the licence key however it this doesnt seem to work. Any ideas? Thanks Steve

Is there a way to whitelist a URL that will override the general policy, by device? Such as if I have a marketing manager that needs access to facebook, how do I exempt her from the block of the general DNS policy?

I am trying to use simulations posted here - https://community.webroot.com/unity-api-forum-49/getting-started-with-the-webroot-unity-api-and-postman-274427 to setup Postman to communicate with the Unity API. I am logged in as Admin in the GSM console. However, following the instructions in the Simulation or the GSM Admin Guide documentation, I don't see the API Access tab. Based on the tabs, I think I am in the Business Console. Could you please let me know if the API Access is available in the Business Console or should I convert to the Managed Service Provider Console (which if I do, then I can't go back to the Business console)

Webroot Endpoint Protection 9.0.24.37 Citrix Receiver 3.4 Enterprise connecting to a XenApp 6.5 farm   Recently we've had a rash of complaints of users whose printers stop working in our XenApp 6.5 environment. We find that the printers are showing offline on the Citrix servers when this happens.   In order to stop this, we either have to disable 'Scan files when written or modified' as per CTX218745, or totally remove Webroot from the workstation (whether Windows 7 or 10). Obviously both of these are big security concerns!   One of our customers' onsite technicians says he called Webroot on this and was supposedly told that this was a known issue and would be resolved in a future release. Is this actually the case? If so, when will it be resolved?

We have a Windows 7 laptop, where we have installed Webroot SecureAnywhere. Recently, the laptop was assigned to a new hire. The laptop was reformatted, installed again with Windows 7 and configured with a new PC name. Webroot was also reinstalled. Now, on the console, the endpoint appears with the new name. However, the old endpoint name is also listed. What is the best practice in removing the old name from the console. Deactivating? Uninstall the agent via Agent Commands > Agent > Uninstall? We want to make sure the endpoint with new name is not affected as this laptop is now online and in use. Thanks!

I run an MSP and I've been shopping around for a Endpoint antivirus. I recently tried WebRoot. I've installed the end point on two of our inhouse machines. Both of the machine had BSOD errors shortly after. Does anyone have any experience with WebRoot and these problems. Obviously I'm not too keen on rolling this out to my customers.

I am new at using the webroot endpoint security. I had a threat detected on one of my endpoints and I was alerted on the webroot management console dashboard. I clicked on the 1 endpoint protect needs attention to view threat. As usual, it gave me information on the threat and the endpoints affected by the threat. On the very right-hand side, there is a brush icon to clean up the threat. I clicked on to manually clear the threat, all it did was run a scan on that endpoint but it did not remove the threat. The threat is quarantined but it keeps alerting me on the dashboard saying 1 endpoint needs protection. I assumed that I had the ability to manually clear threats on endpoints, but I may be wrong. I had used other endpoint protection software in the past that gave me the ability to manually clear threats on endpoints. If I can get some enlightenment on how threats are cleared, whether if its automatic or manual. I will really appreciate the feedback and responses.

Hello, I have 16 total DNS agents installed, 14 of which shows as active, and another 2 showing as in-active. My question is: What is the criteria for a client to be "Inactive"? I checked the client machines and the DNS Protection Agent service is running, and the console reports that the End Point and DNS Agent is installed. Unsure why 2 of my clients aren't becoming 'active'. Any help or guidance is greatly appreciated. Thank you, Brad

We are configuring our perimiter firewall with a default deny/all for outbound traffic.  What ports & destinations do I need to allow for Webroot to communicate back to the cloud service?

We are trialing DNS protection on PC's that are in mobile use all around the country. We've had some interesting results and looking at the DnsProxyAgent I'm a bit confused.   Our deploment has devices with WLAN and WWAN (4G module) NIC's operating in public operator network. However in the DnsProxyAgent log file there is no mention of the WWAN module or it's DNS server addresses.    Are WWAN NIC's supported by DNS Protection or not? It is the same style NDIS NIC as the others, so here should be no difference.   ps. Is there a debug switch that would display more detailed log, for troubleshooting?

Beginning this morning, our SonicWall gateway antivirus has started blocking the endpoint upgrade to 9.0.11.70 - clearly a false positive signature in the SonicWall AV database.   What are the IP address ranges for the Business Endpoint Protection service so that I can add them to my firewall exclude list?

Hi Guys, We wanted to block all web ads and webroot helped to do this, but we had an issue with google searches having their ads at the top and customers clicking ads to legitimate sites and them getting blocked. I had a quick search around but wasn't able to find a work around to either hide those ads or allow webroot to pass them through. I did a little testing and found a way to keep blocking web ads but allow access to the google ads (purely for customer ease).  This was to create a whitelist for googleadservices.com in the GSM Overrides. Hopefully this helps someone else work around this. Thanks Guys.

We are starting to see a threat register on our WebRoot Endpoint Protection under Visual Studio that is registering in the malware group System.Monitor.Project.Neptune, which is a key logger. The file name is submain.ghostdoc.codeobjectmodel.dll. Anyone have any insight on whether this is a false positive or not?    

Sorry to sound a bit dumb, but I can't find out how to setup my signature here in the community for my account.   can somebody help?

Dealing with a line of issues with Webroot and Labtech[Automate:On-Prim]. Just discovering some computers are listed as non-GSM in the Webroot plugin.    Why would this be the case they definitly should be and are GSM. Has anyone had this issue, or have resolved this issue and could share.     

My ERP software is faitly limited when it comes to hostnames and DNS.  I need to add a host to the 'host' file, but Webroot doesnt allow that edit from the command line.  Is it possible to shutdown Endpoint Security make my edits and and then restart via the CLI?

We want to demonstrate the need for Webroot to prospective customers who use traditional AV software. So I wrote a simple "ransomware" program that only affects a test folder. It is a compiled .exe program that: Reads files one at a time from a test folder (c:userspublicvideos est) Encrypts the file contents. Writes the file to filename.txt.crypt. Deletes the file.My expectation was that Webroot would see that a new .exe program was encrypting and deleting files and block it, but it did not. I have run the program from a Command Prompt window, from Windows Explorer and from a Desktop shortcut.   I also ran this ransomware simulator on a VM protected by a dedicated anti-ransomware program, CryptoDrop, but it, too, allowed the deletions. As I am not an experienced white hat hacker, I am sure I am missiing something.   I am aware of KnowBe4's RanSim ransomware simulator, but by now it is well known to signature-based an

We have found after some deployments of the newest version that a percentage of clients are having issues with files on Windows file shares.  With some clients, Excel spreadsheets are showing as blank upon opening.  In our case, every time Webroot is closed, the file share issues go away.   We have an open case with Webroot.  They have told us this issue was discovered and known (as of this time, it is still not posted on the forum's "Known Issues"), but we received conflicting reports;  some techs knew the issue, but other people higher up at that point did not.  This pointed to us for a real need for communication within Webroot, as it seems like the left hand may not know what the right hand is doing.   At this time, I would actively discourage any MSP or large business client from updating past 9.0.21.18.  In fact, my topic is also a request:  I need the MSI file from 9.0.21.18 so we may roll back our clients, and