I am experiencing a strange issue which I have seen more than once lately during our trial.
For example, on the status p, under recently infected, I see an endpoint that was infected today at 4:59AM with conflicker virus. However when I cl ick on group management and choose that same endpoint , it shows that it scanned at 4:59AM and the status is clean.
Also, the infection shown in the status is not shown in the reports UNLESS I specifically choose today.
Any idea how to resolve?
*note from admin - I reposted an edited version of your image so as not to include ip addresses*
Best answer by JimM
It looks like the threat in the "All Threats Seen" screenshot was picked up with a shield or heuristics rather than a scan. That's why the "Scan History" screenshot doesn't include the threat in it, because it wasn't identified during a scan. The logging doesn't go down to the second in the console version of the scan log, but I suspect the sequence of events probably looks something like "4:59a: dropped conficker on the computer," "4:59b: Webroot shield caught it," "4:59c: Webroot ran a scan that came up clean." Without looking at support logs myself, I can't confirm my analysis, but that would explain it. If you open a support case, Webroot Support can verify.
It looks like the threat in the "All Threats Seen" screenshot was picked up with a shield or heuristics rather than a scan. That's why the "Scan History" screenshot doesn't include the threat in it, because it wasn't identified during a scan. The logging doesn't go down to the second in the console version of the scan log, but I suspect the sequence of events probably looks something like "4:59a: dropped conficker on the computer," "4:59b: Webroot shield caught it," "4:59c: Webroot ran a scan that came up clean." Without looking at support logs myself, I can't confirm my analysis, but that would explain it. If you open a support case, Webroot Support can verify.
I just wanted to create a new message when I found this one.
Today I had a customer case: the PC was infercted with a zero day threat. Good news, just during my support session with the customer, Webroot cloud was updated and finally the threat was removed successfully - meaning whe I started supporting them and ran a scan on the threat file WSA said it was clean but about 10 mins later (and after asking the client to check for updates via its popup menu) the new manual scan removed the threat. So far, this is good news. (FYI, the treat was: oiicmlfpjj.dll + an EXE and a DAT file with MD5: D36ACF364A545989E89C5413948CB577)
So why am I writing here now?
Because then I went to the WSA console and wanted to see the scan results.
I see this on the console:
I was very suprised that all scans (even those manual scans I ran myself and did find a threat) show CLEAN results. This is obviously not true I thought and then I went to the PC and opened the WRlog.log file to see what it says.
Let's see all the evens in the local log file from today and I let you try to match the times of scans with the times shown on the console - I could not find a single logged scan time being the same in the local log and on the console:
(for your convinience, I marked the scans as [scheduled] or [manual] or [POST CLEANUP] to my best understanding)
So far you can count a total of 9 scans in the local log file: 8 x [manual] scans : 3 of them found infection and removed the threat 1x [POST CLEANUP] scan
On the console, you can find 7 scansonly all together for today until 12:05. So 2 scans are even not logged to the console!!! - Why? - Which one is which then?
Furthermore, the 3 scans that found a threat (IF they are the same scans shown on the console at all???) show incorrect CLEAN status!!! - Why?
I would prefer seeing the real event logs in the console for all scans happened on the client and of course, if a scan found a threat, I cannot afford it being shown as CLEAN scan result on the console.
Another interesting question is why we cannot find a removal of a file in either the console nor the local log file at all?
You know, rigth after checking for updates with the client and then running a scan (see logged at 11:44:47.0771) on the SettingscsekevLocal SettingsTempoiicmlfpjj.dll file itself from context menu WSA quarantined that file PLUSanother onefile called: GDIPF.......V1.DAT
See it in the contents of the local quarantine:
(btw, interesting the last file, a33a33ns.zip was not really quarantined, but only an a33a33.nsexe file from it !!! The same exe was zipped because we were curious to see if WSA can find it in ZIP file as well.)
Why was quarantining the DAT file not logged at all either locally or to the console? Where can I find the MD5 of that DAT file now?
So far, based on the aboce, WSA loggong is not only inconsistent regarding the relation of local and console logs but also it is inconsistent with real life events (as the DAT file removed is not logged at all)!
Please fix these serious bugs of scan logging asap! New idea 1: also, you may want to consider marking the scans both in the local log file as [scheduled] or [manual] or [CONTEXT MENU] or [POST CLEANUP] to see clearly what scan was run.
New idea 2: consider showing the contents of the local quarantine on the console per client (so selecting the client and with a new action menu item let us see the quarantine contents of that endpoint and have a chance to create a good/bad override by clicking on the quarantined file).
New idea 3: condider showing the MD5 of the quaratined file in the quarantine view of the WSA client and maybe even create a contect menu that allows you to copy the MD5 of the file to the clipboard - just as you can copy the filename today.
Thank you Gyozo for the detailed report. I will file a defect. Thanks :)
Did two more scans eventually show up in the console on this endpoint, or are two scans missing completely? I count 9 scans in the logs but only 7 within that timeframe in the console. What is the polling interval set at?
Great work https:///t5/user/viewprofilepage/user-id/3836. Seriously, thanks for bringing this up.
I consider this a critical issue to investigate since I have seen similiar reporting failures in the past.
Next one I see I'll bring up to Webroot support to bolster this.
2 scans are comletely missing from the console during this period. FYI, I did wait for the poll-in of the client to make sure I see all scans.
Actually, I just found an option in the console called: "Save non-executable file details to scan logs"
This defaults to "Off". I suggest you change the default to On as this migth have been the reason why quarantining the DAT file was not logged on the local text log. I believe every action must be logged especially if that is a threat found and quaratined. Of course, every threat related event also must be logged to the console.
I do agree that even blocked threats must be logged. Are they?
As it stands, only threats detected during a scan are reported up to the console. However, I agree with the consensus in this topic that they should be, just for reference. I'll bring this up with product management and ask them to take a look at this topic. The more useful info we can provide, the better.
We are trying to reproduce this behavior, and so far we haven't been able to do that. We're going to involve our QA department and have them run some tests. Is this behavior something you see frequently? Specifically, we are interested in scans missing from the console that have verifiably run, according to the local scan log.
