Hi vdcent

 

Welcome to the Community Forums.

 

OK, a little be more specific information please; what is the program you are trying to install, what message do you get when Webroot interrupts, do you get any options to take or other instructions associated with the interruption?

 

That should help provide a little clarity and then we can look to provide some answers if that is possible but in short I would say the following:

 

1. Yes, if the infection is recognised, and in general it will quarantine first and give you the option to delete or restore.

 

2. That is the question we need the additional infromation to try and answer.

 

Regards, Baldrick

---

Thank you... all I see is a Webroot box pop up with the info/location of the threat. From that pop up, I click OK and nothing happens.

---

OK, can yo check in Quarantine (click on the gear/cog symbol to the right of the PC Security tab in the main panel, and in the next panel opened click on the Quarantine tab.  IF there are any files/apps regesitered there make a not of them and then return to the main panel.

 

Then whether there is anything in Quarantine or not run a manual scan and see what the results are.  Please post back here with the results of the above.

 

Regards, Baldrick

---

Ok, I saw the threat in Quarentine... but this is what continues to happen when I try to uninstall this particular progem (which must the infected)... the red webroot box:

 

Threats Detected

 

Malware Group:

W32.Maware.Gen

 

Location:

 

c:windowsinstallermsi1e99.tmp

 

 

So everytime I get this threat message, I've gotten different msi... msia939.tmp, msiea51.tmp, msi1e99.tmp

 

Please advise. Thanks

---

Hi vdcent

 

OK, I think that at this stage it would make sense to Open a Support Ticket and get the Support Team to take a look as it is unusual to get this when one is trying to uninstall a program.  

 

And so this may in fact be a false positive; if I recall correctly Win32:Malware-gen is the generic description used by a number of security app providers re. unknown Trojans which have been detected by heuristic engines.

 

By the way, for the record, what program/app are you trying to install...knowing that may also help in this circumstance?

 

Regards, Baldrick

---

It looks like the installer is an MSI. Some MSIs require the original installation file to uninstall - They call msiexec /i <msi package> for install and /x for uninstall.



Because the MSI is getting called during the uninstall, if it is being picked up as a generic malware detection, this will happen during install and uninstall.



Like the guy above said - what is the application you're trying to remove, and how are you trying to remove it?

---