Webroot® SecureAnywhere™ - Antivirus doesn't find all viruses.

I run a side line pc tech business out of my house. Most of my customers usually have some virus or another. 9 times out of 10 they take my recommendation to install your antivirus software but it doesn't find all viruses. I have to use adwcleaner, malwarebytes, and mbar (made by malwarebytesJ) and in some occasions tdsskiller by Kapersky.
I almost always have to run four programs to clean their pc's.
Can someone explain to me why webroot can't find all these viruses?

TIA
Dave

We would need more information. If you believe that Webroot missed an infection, please contact support.


-Dan

Okay, I'm back. Funny, I only got two emails that someone had replied to my initial post. A lot of discussion since.

A little background: I started working on PC's before Windows ever existed. Okay, I'm old. lol. After a long IT career, I started my home pc repair business as a sideline to help folks with their home PCs. I've been doing this for 10 years now. So in 35 years, I have seen a ton of computers over the years and every antivirus program that ever existed.

I also do not expect Webroot to be the end all antivirus program that catches everything. In fact, I have also purchased Malwarebytes and between these two programs, I rarely pick up something.

I was just curious as to why I see so many of my customers PCs that I had previously installed Webroot on come back with obvious infections. I'll run Webroot in Safe Mode and it finds nothing. A quick run of Adwcleaner more often than not uncovers viral infections. I then use Malwarebytes, Mbar, and Tdsskiller to root out the rest. Some of the common infections are Conduit and DriverSupport but there are many more, I just don't jot down their names every time. I am going to start gathering that info from now on and posting in their service tickets for documentation.

Most of my customers are senior citizens but not all. I invariably get the question "I have Webroot, how come I'm infected?" I do explain no one program catches all and try and give them safe computing suggestions.

Regards
Dave

💾 And yes I use to boot off of 8 1/2" floppies!

I looked up the exact stats on the virus to see if it fit your description. It was an exe file, not a zip file. It wasn't an email attachment, it was a download via Firefox. It wasn't in a remote folder, unless you consider the My Documents folder remote. The user downloaded the exe and ran the file to install the program. Webroot didn't catch the download or the installation. This was on 12/24/2014, the exe then "dwelled" in the My Documents folder for 202 days until Webroot finally found it on 7/14/2015. I'll admit, I misremembered the amount of time it was on the system. However, that's still a ridiculous catch time frame.
Well, without knowing more details of the incident, and also not being that IT-"fluent", I can't really say more.

Daniel (Triple Helix) has posted with his request, and that may be a more fruitful avenue to follow. Also, if the client has not reinstalled Webroot since then (or removed it), it would be extremely interesting to get in touch with Webroot Support as they could give a better diagnosis of what happened with the logs.

Also the key question: was the client infected with this malware? Not clear as you say on the one hand "The user downloaded the exe and ran the file to install the program. Webroot didn't catch the download or the installation" and then on the other "the exe then "dwelled" in the My Documents folder for 202 days until Webroot finally found it on 7/14/2015." (Installed? .exe still in My Documents folder? Not quite following you. Maybe it's because I'm not very fluent in IT?) If it was a momentary installation, did Webroot monitor and journal it as an Unknown exe. and then monitoring ceased because it was no longer executed/was uninstalled. So many questions... The first, as Daniel says is the MD5 Hash question. After that, maybe analysis by Webroot Support to better help us all understand what happened?

I think I'll pass this over to Daniel and let him handle it (maybe @Baldrick also?). They're more IT fluent than me.

the tests do not cater for the rather unique way that WRSA works compared to the run of the mill rest of the field.


BaldrickSo what about what I mentioned above????

"The "journaling" approach, while seems "advanced" has major flaws, and has not been embraced by other major players on the market (only few anti-ransomware software employ this)

• the computer is not boot-able after a malware attack , so the user cannot start it. Webroot cannot restore files from jurnaling if the computer is not bootable
• The malware (ex: non Petia) destroyed MBR , so again PC is not bootable
• the user has no internet connection ( example a flight Amsterdam- Australia) for extended number of hours and is inserting an infected USB drive. Webroot has a minimal signature database stored locally , so cannot juornal for 16 hours or handle this situation"

On top of that I can add the situation when a malware is stealing personal info (banc accounts, login info) , while Webroot is "journaling"

After 1 hour of analyzing , restoring the files modified will not do anything , as the info is already stolen.

What you are missing here locomotive is a very salient point...when an object cannot be determined as good or bad,; so that specific action can be taken, WRSA will start monitoring that object journaling its actions but ALSO severely restricting the actions it can perform...and one of those is communication to the outside world...therefore whilst you certainly can "can add the situation when a malware is stealing personal info (banc accounts, login info) , while Webroot is "journaling"" you would be completely wrong as the 'addition' is irrelevant/cannot happen.

One should really do some more focussed research rather than just spouting the some old diatribe that has been seen/heard before...it is like a broken or scratched record.

Some points have been raised...they have been responded to appropriately as it happens...and there is an end to it. We have to beg to differ, and go our separate ways on this.

Wishing you ease of being...elsewhere.

Baldrick

Thanks for coming back, @davetully.

Great to get more information from you!

Essentially, I had two questions I wished to ask you:

1. How many of the malware that you encountered were PUPs?
2. Of those that were not PUPs, how many of them were pre-existing on the machines prior to Webroot SecureAnywhere installation?

------------------------------------------------------------------------------------------------------------
DIGRESSION:
Here are the reasons for my asking these two questions.

Re Point #1:
Webroot has traditionally taken the approach that it does not block all PUPs (see @bjm_'s link) because:
(i) it does not consider them in the true sense to be malware but rather just bl**dy nuisances
(ii) it was the decision of the user to voluntarily install these toolbars etc. For example, I had a student (not using Webroot, I should hasten to add) who had installed Babel and/or some. kind of toolbar which were some kind of PUP and I told him that I thought they were not good, but in the final count that was his decision (he decided to keep them, but at a later date I found, probably because of the advice of his IT man, that they were no longer present on his device)
(iii) quite a few AV companies are loath to remove PUPs because there have been some nasty legal suits that have been introduced by these companies that can prove prohibitively expensive to contest with the added risk that one might lose.

I believe Webroot has been improving in this area in the last few years and there is also now the option in Advanced Settings > Scan Settings to check "Detect Potentially Unwanted Applications" (i.e. PUPs)

Re Point #2:
Webroot's great strength is as a behaviour and malware blocker. It may not be the best AV (though it's certainly far from bad—as far as I know!) at cleaning existing infections.

I notice that you mention two culprits that you have come across on your customers' computers: Conduit and Driver Support. I'm not that au fait in IT matters so I needed to google these critters. It appears that Conduit is a toolbar and Driver Support a driver search and update software. Both therefore seem to me to come under the category of Potentially Unwanted Applications.

We in the Webroot Community have been pushing Webroot to take a more pro-active stance in blocking PUA/PUPs. Personally, I agree with Webroot that they are not strictly malware but would prefer Webroot to detect and, at least invite the remover to take the option, to remove them.
END OF DIGRESSION
------------------------------------------------------------------------------------------------------------

Anyway, I am curious to hear your reply to my two questions.

Again, thanks for coming back!

I think I'll pass this over to Daniel and let him handle it (maybe @Baldrick also?). They're more IT fluent than me.
But I'm certainly interested in what transpires if you do decide to follow this through.

That is where we have to agree to disagree.

A. PCMag is far from insignificant in the market (at I would say it is not about the magazine but rather the reviewer...and in this case he is extremely well regarded in the milieu).beg to differ. Likewise the view can and is taken that some of the 'testing organisations' are dubious to say the least. Again, do not wish to start a polemic on this as it has been oft done.

B. The article that I linked to explains as to why this whole area is an issue re. WRSA. So to quote from that PCMag article:

"As noted, Webroot handles new, unknown programs by letting them run under strict monitoring.

It prohibits irreversible actions like sending personal data to the internet, and keeps a journal of reversible actions, all while awaiting a verdict from Webroot's cloud analysis system. If the program under judgment proves to be nasty, Webroot wipes it out and reverses all its changes.

This system just isn't compatible with many independent lab tests. Labs like AV-Test Institute and AV-Comparatives expect antivirus programs to act right away on malware they recognize, whether detection occurs using signatures, heuristics, or behavioral analysis. Webroot's relationship with the labs has been rocky, but two of the four that I follow have recently included Webroot in their testing, with decent results."

If you read on from that point in the article you will further explanation...assuming that you are minded to read it.

I am not saying that all this proves a point but rather helps to inform on the original point...which is backed up by the experience of the vast majority of Community members who have expressed themselves. In my own case WRSA has, on a number of occasions in the past, 'saved my bacon', since I started using it . I cannot say the same for a couple of the other solutions I used prior to that.

But as ever, only my experience of WRSA.

Regards, Baldrick

Quote" Essentially, I had two questions I wished to ask you:

1. How many of the malware that you encountered were PUPs?
2. Of those that were not PUPs, how many of them were pre-existing on the machines prior to Webroot SecureAnywhere installation?"

Unquote

#1
Again, I rarely keep records on what was found/detected (but will as of today) so I have no idea on how many were PUPs.

#2
New customers typically are infected either due to no protection at all or by using ineffective software. Since I've been doing this for a while in our area its pretty rare I get a new customer so I deal with mostly past customers who have Webroot installed and reinfected. At times the customer forgot to empty their Quarantine for months so reeducation on promptly clearing is done.

Speaking of which, it sure would be nice if Webroot would put a button on the main menu to access the Q without burying it under hotspot next to PC Security.

I don't want to take over @davetully's thread. I was only pointing out an example of an extreme failure with Webroot's software finding threats accurately and timely. However, I will answer your questions for clarification, but this thread doesn't need to become about an old virus that we got.

@locomotive, I'm aware of how Webroot works and why it runs scans fast. However, it should catch something when it is downloaded and runs. As I pointed out, it did neither. Thus, what is the point of owning an AV software if it does nothing but scan a few places quickly once a day. I realize that is simplifying what Webroot does, but it gets across a point that the software is no good if it doesn't perform the task it is meant to do.

As for your question @TripleHelix. This happened a few years ago and I no longer have the MD5 hash. I was able to pull the dates from the All Threats Seen report. However, the MD5 hash was cutoff in the report. At the time it found the virus, I did open a support case. However, support was never able to give me a logical explanation as to why it wasn't found 202 days earlier.

To explain your questions of clarifying what I was saying @Muddy7, I'll try again.

1. The user downloaded a .exe file to their My Documents folder that Webroot should have caught as virus.
2. Since Webroot didn't quarantine the file, the user installed the program.
3. Points 1 and 2 happened on 12/24/2014.
4. On 7/14/2015, 202 days later, Webroot found the .exe file on a regular daily scan in the users My Documents folder and quarantined it as a virus. In Webroot they call the 202 days, dwell time on a system. In other words, how long the file was on the system.

So, three questions have always remained:

1. Why wasn't it caught during download?
2. Why wasn't it caught when the user ran the file?
3. Why did it take 202 daily scans to finally find the file, which was easily located in the My Documents folder?

Hope that clarifies everything for everyone. Again, this is just an example of Webroot's failure to work properly. I don't want to start a long discussion about it since I've already been through this with support.

Honestly this is over my head, I'm not fully trained as a support tech so I'm not sure the answer to this. Our support team is the best resource for this, do you know which support agent was unable to provide clarity on this issue?

Personally, I think that one should be informed before making statements that are questionable in some peoples' minds.

Regards, Baldrick

I agree with you about being better informed.
It is impossible to be informed though if Webroot is not tested by anyone in the last 6 years ; PC Mag is insignificant in the market and for every software in the market if you look long enough , you can find a positive review...

Bottom line, as long as Webroot stays "in the house" and doesn't get exposure to third party testers I will not touch it....

In my own case WRSA has, on a number of occasions in the past, 'saved my bacon', since I started using it . I cannot say the same for a couple of the other solutions I used prior to that.
Ditto for me.

Well, that's my regularly being infected while using various well-known AVs pre-2006, and then never knowingly being infected since—plus others who I refer to serving large customer bases and reporting similar results—dexterously dismissed.