Skip to main content
Windows Defender was repeatedly reporting that it was quarantining different versions of the kovter ransomewhere. I decided to install Webroot, because I believe the internet is the most dangerous place today. I was surprised that Webroot did not report the infection and now I am a little worried this may not be the product I am looking for. Thoughts? Concerns? Opinions? tnx
Hello and Welcome to the Webroot Community!

 

I would say yes and if not WSA can rollback to the pre-infection state if WSA is installed before infection! Check here to see if something is under Monitor? http://www.webroot.com/En_US/SecureAnywhere/PC/WSA_PC_Help.htm#C10_SystemControl/CH10b_ControllingProcesses.htm

 

Also read this: http://www.webroot.com/blog/2015/12/02/whats-in-a-name/ and if you can supply a MD5 Checksum off one as it could be under another name with the Webroot Threat Intelligence. http://www.webroot.com/us/en/business/threat-intelligence

 



 



 

Thanks,

 

Daniel 😉
Hello collinsjct,

 

We'd like to help in removing Kovter.

 

Kovter is a particulary nasty registry infection and to properly remove it, manual remediation is almost always required.

 

Please submit a trouble ticket here: https://www.webrootanywhere.com/servicewelcome.asp 

 

Please submit a support ticket as soon as possible, as Kovter has been known to do worse to computers it infects. We'd like to stop it before it can cause any damage to your computer.
?

If the infection was already present on the system before placing webroot on, there is no clean snapshot to rollback to, in order to reverse the damage. So in this case, it answers the title, but not the issue itself. 



? is quite correct, this particular fileless malware resides only in the registry to avoid detection, and is quite nasty.

 

? I would as JesseBropez stated, open a support ticket and allow them to help you remove this infection. 
@LucentWarrior wrote:

@

If the infection was already present on the system before placing webroot on, there is no clean snapshot to rollback to, in order to reverse the damage. So in this case, it answers the title, but not the issue itself. 



@ is quite correct, this particular fileless malware resides only in the registry to avoid detection, and is quite nasty.

 

@ I would as JesseBropez stated, open a support ticket and allow them to help you remove this infection. 

Right I missed that part!

 

Daniel 😉

Reply