To Customer Support To Customer Support
Solved

Getting a warning box upper LH side of screen.

  • 25 October 2013
  • 32 replies
  • 160 views
P
Rank
But it closes so fast I can't read it..... but it is square, grey, and has some red writing in the box. I can read the word "close", and not much else. It comes up for less than a second, I bet, and then my webpage that I want opens up. Pops up an awful lot, but not for every web page. I know it does it when I go to Yahoo's main page - most of the time. I "think" I see the word "malware", but it goes so fast I can't be sure.
 
Any thoughts?
 
Edit.... I just stared at the box when it opened again.... it says "This Site Contains a Known Virus".
 

OK, so I do not visit porn sites, and generally only well known sites that I have used for years.... "Occasionally" I may clock a link from Google news that I am unfamiliar with, but that is about it.
icon

Best answer by RetiredTripleHelix 3 November 2013, 19:18

View original

32 replies

P
Rank
I will do a submit.....  but I think it is crazy that I literally can get 100+ of these boxes a day.
 
Thank you.
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
Yes the website is fine but please instead of posting them here you can check with BrightCloud and if it's to much Submit a Support Ticket and they will look after the FP's until you get the New Web Shield.
 
Thanks,
 
Daniel
P
Rank
OK, the KFFL website is solid. I have used them for years.
 
 
 
Sat 2013-11-02 19:41:22.0244    Closed network connection: [0A01A8C0.14802 - 54E47D4A.20480]
Sat 2013-11-02 19:41:22.0244    Closed network connection: [0A01A8C0.16594 - 953F1517.20480]
Sat 2013-11-02 19:41:22.0725    Blocked website: http://www.kffl.com/a.php/133332/fantasy-hockey/Fantasy-Hockey-Trends--Martin-St.-Louis--Erik-Karlsson--more
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0100007F.11474 - 0100007F.11730]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0100007F.11730 - 0100007F.11474]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.11986 - 19E47D4A.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.12242 - 4DE47D4A.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.12498 - 1AE47D4A.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.12754 - 32E47D4A.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.13010 - 12F44317.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.13266 - 12F44317.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.13522 - 12F44317.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.13778 - 12F44317.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.14034 - 12F44317.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.14290 - 12F44317.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.14546 - 31E47D4A.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.14802 - 54E47D4A.20480]
Sat 2013-11-02 19:41:22.0726    Closed network connection: [0A01A8C0.16594 - 953F1517.20480]
Sat 2013-11-02 20:49:10.0029    Scan Started:  [ID: 518 - Flags: 1575/0]
Sat 2013-11-02 20:52:19.0217    Scan Results: Files Scanned: 48022, Duration: 3m 8s, Malicious Files: 0
Sat 2013-11-02 20:52:19.0287    Scan Finished: [ID: 518 - Seq: 81823929]
Sun 2013-11-03 01:46:02.0927    Saved updated configuration
Sun 2013-11-03 10:49:06.0193    Scan Started:  [ID: 519 - Flags: 551/0]
Sun 2013-11-03 10:51:12.0172    Scan Results: Files Scanned: 48422, Duration: 2m 5s, Malicious Files: 0
Sun 2013-11-03 10:51:12.0202    Scan Finished: [ID: 519 - Seq: 81877876]
 
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
@ wrote:
So, I am getting 100+ false positives a day?
It's possible that's the reason for the New Web Shield I'm not sure if they are still working on the old one which would be a waste of time but the New one works much Better using BrightCloud and other technologies even though its still being rolled out slowly it's well worth the wait as it is very impressive! IMHO
 
Daniel 😉
shorTcircuiT
Rank
Userlevel 7
@ wrote:
So, I am getting 100+ false positives a day?
That would be rather unusual indeed... I get maybe one false positive every 3 to 6 months in total.
 
You would be well advised to submit a Trouble Ticket for Support.. they can take a look at your logs and determine why the shield is being triggered to often.
explanoit
Rank
Userlevel 7
Badge +6
Please paste a few lines of your scan log that show the FP's. Right click the green W in the bottom right > Scan Log > save it to your desktop. Read from the bottom up.
---------------------------------------- Business Products Sr. Community Leader and Expert Advisor - WSA-Enterprise administrator over 2000 clients First company to 1000+ WSA endpoints | Power User / Business Ambassador / WSA-C and WSA-E Beta tester Find me on Twitter!
P
Rank
So, I am getting 100+ false positives a day?
shorTcircuiT
Rank
Userlevel 7
@ wrote:
Well, FINALLY the box stayed open long enough to read one of the websites, and NO WAY is that site supplying malware, so obviously my webroot software is just wrong.
And that can happen: it is called a False Positive.  If you would like to have the site reviewed as being a False Positive, please submit a Trouble Ticket.
 
I had to do that myself a couple weeks ago: the unroutable URL that is used to connect to my WiFi range extender was blocked LOL!  I filed the Trouble Ticket and it was fixed within 24 hours.
P
Rank
Well, FINALLY the box stayed open long enough to read one of the websites, and NO WAY is that site supplying malware, so obviously my webroot software is just wrong.
ams963
Rank
Userlevel 7
@ wrote:
Well, the video is pretty cool, but the box coming up about 1/2 the time I  go to a different webage is very annoying. Obviously something is triggereing it, and I am tired of looking at the green boz popping up literally at least 100x a day. So how can I stop it?
Uninstall WSA. Download WSA from here and install freshly. Hopefully this will reduce the problem. If it still persists, please wait for the new Web Threat Shield as it is being rolled out. Hopefully you'll recieve yours soon.;)
P
Rank
Well, the video is pretty cool, but the box coming up about 1/2 the time I  go to a different webage is very annoying. Obviously something is triggereing it, and I am tired of looking at the green boz popping up literally at least 100x a day. So how can I stop it?
ams963
Rank
Userlevel 7
@ wrote:
@DavidP1970 wrote:
But if it is dissapearing before it can be read, isn't it something different?  The Web Threat Shield usually has to have a button click before it goes away?
(Back to the kitchen I go... back shortly  :)  )
It wasn't working well for some as in this case it would disappear before you have a chance to read it the reason for the New Web Shield instead of fixing the old one.
Daniel
 
I can confirm that as I'm having that problem myself. Waiting for the new Web Shield.:)
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
You are perfectly safe as WSA has many Shields and you are still protected by the Web Shield even thought it disappears if anything tried to download or execute then WSA will stop it with any one of the shields most likely the Realtime Shield! Have you seen this Video? https://community.webroot.com/t5/Webroot-Education/What-Happens-if-Webroot-quot-Misses-quot-a-Virus/ta-p/10202#.Um3YohB35c8
 
Cheers,
 
Daniel 😉
P
Rank
OK. so the box looks like the one above.... so what do I do to make it stop?  Honestly,  don't go to any crazy sites, and I can't click on the box because it disappears so fast. But like I said, it even pops up sometimes when I go to yahoo.
 
 
The black box has red writing in it, I believe.
 
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
I got a snapshot from one of my VM's that doesn't have the New Web Shield it's still on the old 2013 Web Shield but because the 2014 GUI is Green so is the pop-up!
 
Daniel
 

shorTcircuiT
Rank
Userlevel 7
@ wrote:
@DavidP1970 wrote:
@ wrote:
Yes it's green in the 2014 version but still using the 2013 Web Shield until the New Web Shield rolls out to everyone they didn't leave anyone defenceless during the transition.
 
Daniel ;)
But if it is dissapearing before it can be read, isn't it something different?  The Web Threat Shield usually has to have a button click before it goes away?
 
(Back to the kitchen I go... back shortly  :)  )
It wasn't working well for some as in this case it would disappear before you have a chance to read it the reason for the New Web Shield instead of fixing the old one.
 
Daniel
And that is why I am here: I still learn every day 🙂
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
@DavidP1970 wrote:
@ wrote:
Yes it's green in the 2014 version but still using the 2013 Web Shield until the New Web Shield rolls out to everyone they didn't leave anyone defenceless during the transition.
 
Daniel ;)
But if it is dissapearing before it can be read, isn't it something different?  The Web Threat Shield usually has to have a button click before it goes away?
 
(Back to the kitchen I go... back shortly  :)  )
It wasn't working well for some as in this case it would disappear before you have a chance to read it the reason for the New Web Shield instead of fixing the old one.
 
Daniel
shorTcircuiT
Rank
Userlevel 7
@ wrote:
Yes it's green in the 2014 version but still using the 2013 Web Shield until the New Web Shield rolls out to everyone they didn't leave anyone defenceless during the transition.
 
Daniel ;)
But if it is dissapearing before it can be read, isn't it something different?  The Web Threat Shield usually has to have a button click before it goes away?
 
(Back to the kitchen I go... back shortly  :)  )
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
Yes it's green in the 2014 version but still using the 2013 Web Shield until the New Web Shield rolls out to everyone they didn't leave anyone defenceless during the transition.
 
Daniel 😉
shorTcircuiT
Rank
Userlevel 7
That does make a difference, that is probably not the Web Threat Shield, the old one or the new one, blocking a bad URL.  Those boxes stay visible until you click to close or over-ride and allow.
 
I am not sure which message you are seeing though.  Perhaps someone else knows which message pops up at the upper left?
P
Rank
Well, if it makes any difference, I was wrong on the color... it is dark green, but it still flashes by so fast, and when you aren't expecting it, so I never really get to read what it says. Even if it is webroot doing its job, it is quite annoying.
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
@DavidP1970 wrote:
It does indeed look good, and there is no doubt that you will notice it.  I have, however, seen a few glitches with it: times when the button to ignore and allow you to continue does NOT work.  Once I have definately ID'd the pattern as to exactly when this happens I will notify Support about it.
No problem here David I click the button to continue and it works and to get off the page click the back Button or go to another site or even click the Home button! But the issue is removing the bad website from the allow list in WSA which will be improved in future builds the reason for rolling it out slowly to everyone. ;)
 
But it is much better than this window!
 
https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/Website-blocking-False-Positive/m-p/58999#M2928
 
Daniel
shorTcircuiT
Rank
Userlevel 7
It does indeed look good, and there is no doubt that you will notice it.  I have, however, seen a few glitches with it: times when the button to ignore and allow you to continue does NOT work.  Once I have definately ID'd the pattern as to exactly when this happens I will notify Support about it.
ams963
Rank
Userlevel 7
@ wrote:
Notice I updated my post above with the window!
 
Daniel
And that looks better than the 2013 shield and a lot cooler.:D
RetiredTripleHelix
Rank
Userlevel 7
Badge +56
Notice I updated my post above with the New Alert Window!
 
Daniel

Reply


Terms & Conditions

© 2004 - Webroot Inc.

We have recently updated our Privacy Policies. We encourage you to read the full terms here.