Can you clarify what "Infected" really means against an endpoint

Hello,
This message indicates that there is an infection on the machine that was not able to be removed possibly due to the policy configuration. I recommed calling the Webroot Support team in your area to get further assistance with this issue.
 
Thank you,
Shawn
Webroot Enterprise Support

Thanks,
 
Unfortunately due to a public holiday in Malaysia, our office there is closed and the Laptop seems to have been turned off every since the virus was detected (at least I hope that is the case, and the Malware is not interferring with Internet connections).
 
We will wait until Monday when we can make contact with the user, and then contact Webroot support if there is indeed an issue.
 
In the meantime, I have checked the policy which is the same for all machines and it definitely has automatic remediation turned on.  
 
I take it from your reply that there is no easy way to tell what actions were taken on the client to quarantine or roll back, even though the EP has reported in with the infection.
 
 
Regards
 

Andy

Hello Andy,
 
When an endpoint is listed in the 'Endpoint Needs Attention' section on the status page, it typically means that we have detected malware that we have been unable to remove automatically. This could be for a number of reasons:
 
1. Automatic remediation has been disabled - you have clarified that this is not the case.
 
2. The malware was already on the PC before SecureAnywhere was installed so we don't have the journal history to perform a clean roll-back. This is rare because we are also able to perform 'generic' cleanups like competing products rely on. If you do have an infection that your old product missed, our advanced malware removal team would be happy to clean it up for you free of charge,
 
3. We have detected a PUP (Potentially Unwanted Program) such as a toolbar. We consider many toolbars to be malicious, but the user may have legitimate reasons for using them. Therefore we prefer the user to uninstall the toolbar, or an override could be created.
 
Either way, it should be fairly rare for this to happen.
 
Because the malware hasn't been "cleaned up" yet, there are no further actions for the console to report on. However, you can be rest assured that your endpoint and its data are protected from the malware (if it is indeed malware):
 
1. Webroot's unique outbound Firewall will prevent the infection from communicating to its command and control centre
 
2. Webroot's unique Identity & Privacy shield will generically protect your sensitive applications and their data from information-stealing malware, protecting against threats such as keyloggers, screen grabbing, man-in-the-browser attacks and many more.
 
Please feel free to reach out to your systems engineer once the laptop has been turned back on and we will try to clarify exactly what happened and what we can do it resolve it.
 
Thanks,
Will
Systems Engineer