Controlling WRData folder size - help needed

@ wrote:

@ wrote:
Hi David
 
There is an alternative way (originally highlighhted by D_J...if memory serves me correctly) which may be more accurate but takes longer is to run Save a Scan Log and from the text file produced do a search for ‘(nnnn)’ (without the ‘’ marks) where ‘nnnn’ is the ‘nnnn’ portion of the ‘dbnnnn.db’ file(s) found in the C:ProgramdataWRDATA folder.  This should find an entry in the Log from which you can identify the application/file that is being monitored and to which the journal file concerned belongs;
 
Sat 12-09-2015 10:21:40.0098         Monitoring process C:BrowsersMaxthonPortableBinMaxthon.exe [63D4BC1DABF35B13C94A9FAE02D7C0FF]. Type: 3 (1235)
 
relates to file ‘db1235.db in the C:ProgramdataWRDATA folder.
 
Of course, this is not ideal in terms of dealing with many ‘dbnnnn.db’ files but if one can identify the largest of these files and start with those then one can reduce (safely) the size of the folder. This is especially the case where you can see that the monitored file is one that you trust but may just be a new version that has been recetly downloaded and has yet to be whitelisted.
 
I throw this one in the ring...for what it is worth (with thanks to D_J, of course).
 
EDIT: I should have also mentioned that 'playing' in this folder & with these files is risky and could cause WSA to stop working if the wrong files are deleted...so caution is advised as well as having a system backup and/or a system image.
 
Regards, Baldrick

Solly you're so right they do match from the scan log and in the WRData Folder!
 
Thanks,
 
Daniel :D
 
 

Hi Daniel
 
I really can take little credit as I believe (memory failing me) that it was D_J who first posted this/brought it to my attention...all kudos are due to him.
 
Regards, Baldrick

Bumping up this thread, I wanted to ask: what happens to the large db files under programdatawrdata? Are they taken care of, in a garbage collection-like process? Or is uninstall/reinstall the only way to get rid of them?

Myself, I have deleted these large db files. If they are not deleteable, this means they are locked by Windows, so WSA is still monitoring an associated application.
 
Still, some housekeeping should be done by WSA itself. The user should not be required to do dangerous things, like deleting stuff that might be needed by the app. Nor should he/she need to uninstall-reinstall the app.

Thanks nic. I hope it will be improved, so that the following will not be necessary when uninfected. Carnik, here is a recent response from Support: ''There were quite a few files running on your computer that had not yet been classified in our determination database. When Webroot detects unclassified files and processes it will monitor these files for malicious behavior. It will also journal any changes made by the files so that when the files are eventually classified and if they are classified as bad the changes can be rolled back. This is the information that fills up the folder. After analyzing your logs, we have white-listed (classified as good) the unknown processes which SecureAnywhere had been monitoring on your system. You can go ahead and delete the .db files in the WRData folder and then run a new scan of your computer now to update. (click "Scan My Computer" in the Overview window of SecureAnywhere). This should resolve the issue.' You may have to shut down WSA protection to delete the db files. But always ask Support to whitelist your unknown processes/files before doing this.

Agree with all your points!

@ wrote:
You shouldn't really have any apps in monitoring for any length of time. If you do see any in there, either whitelist them on your end, or contact our support to have them whitelisted in our database. What's the situation that's causing you to have so many new applications that are unknown by us?

I believe that you've got the actual issue here. It's not that WSA monitors apps (and, hence, creates dbXXXX files). It's that it does so for (a) lots and LOTS of (b) widely-deployed files.
 

@ wrote:
 What's the situation that's causing you to have so many new applications that are unknown by us?

I could joke about it (no sarcasm, here trust me) by stating that it's just that I use my rig for something besides solitaire...
 
I have all sorts of applications on my rig. The applications that got monitored are in a rather respectable to huge circulation. Like the official bitcore client, the official miflash application (used to flash Xiaomi phones), the fastboot.exe Android utility, parts of the official Microsoft distribution for .net under windows 10(!)
 
And I am talking about legitimate apps here, false positives if you prefer.
 
Only a couple of days ago, Firefox's plugin-container got monitored too:
 
Tue 10-11-2015 19:19:40.0237    Monitoring process C:Program Files (x86)Mozilla Firefoxplugin-container.exe [344CC9339BA1022F335B46B95AABF32F]. Type: 3 (6263)
Tue 10-11-2015 19:19:40.0237    Monitoring process C:Program Files (x86)Mozilla Firefoxplugin-container.exe [344CC9339BA1022F335B46B95AABF32F]. Type: 4 (6263)
Tue 10-11-2015 19:19:40.0242    Monitoring process C:Program Files (x86)Mozilla Firefoxplugin-container.exe [344CC9339BA1022F335B46B95AABF32F]. Type: 8 (6263)
 
 
That's regarding my argument that too many widely deployed apps get monitored.
 
And with regard to how well monitoring works, right now I started Miflash to check what WSA would do. In the logs, it has started monitoring alright:
 
Fri 13-11-2015 19:30:02.0582    Monitoring process C:Program Files (x86)XiaomiMiPhoneMiFlash.exe [56103CBE92459C65375AB9BE161A26AA]. Type: 4 (5781)
Fri 13-11-2015 19:30:02.0582    Monitoring process C:Program Files (x86)XiaomiMiPhoneMiFlash.exe [56103CBE92459C65375AB9BE161A26AA]. Type: 5 (5781)
Fri 13-11-2015 19:30:02.0652    Monitoring process C:Program Files (x86)XiaomiMiPhoneMiFlash.exe [56103CBE92459C65375AB9BE161A26AA]. Type: 8 (5781)
Fri 13-11-2015 19:30:04.0132    Monitoring process C:Program Files (x86)XiaomiMiPhoneMiFlash.exe [56103CBE92459C65375AB9BE161A26AA]. Type: 4 (5781)
Fri 13-11-2015 19:30:04.0132    Monitoring process C:Program Files (x86)XiaomiMiPhoneMiFlash.exe [56103CBE92459C65375AB9BE161A26AA]. Type: 5 (5781)
Fri 13-11-2015 19:30:04.0136    Monitoring process C:Program Files (x86)XiaomiMiPhoneMiFlash.exe [56103CBE92459C65375AB9BE161A26AA]. Type: 8 (5781)
 
 
I opened WSA to check whether it was under PC Security gear -> Block / Allow files; nothing there. Don't know if that is a bug or a feature. But it does feel that something is ill-designed with the way the entire monitoring interacts with the system user.

Sure, no problem. But I can't do that open-ticket-send-logs-and-do-it-again-and-again dance all the time. That's my grunt. The only other time I was involved more with AV issues in the last decade, was the 200 system network I manage at work, running Kaspersky Endpoint Security 10... Then again, it's to be expected considering the net size.
 
WSA has been making me running the hoops. It shouldn't if you ask me. And I consider myself quite experienced on the matter...

Ok I'll get someone who is good to take a look. They will still need your log files so they can see what is getting monitored, but I'll get the logs to someone who can really dig into it properly.

Excuse my ignorance but how do I get to that report to see what is being monitored? @: If I save a scan log the [u] files seem to be mainly Nirsoft Utilities (see this link: http://blog.nirsoft.net/2015/10/18/antivirus-statistics-and-scores-according-to-false-positives-of-nirsoft-tools/). But these keep coming back after repeated whitelistings. Also I run a few beta softs that may not be initially known in the determination database, but are not 'obscure' programs.

Hi db999
 
Welcome to the Community Forums.
 
I think that the WRDATA folder must be on the drive that WSA is installed on and therefore protecting. I believe that one can, at install time, used the advanced install options to locate the install of WSA to another drive, whilst still protecting the C: drive, but I have not tried that myself.
 
Let us know if yo would like to try...the worst that can happen is that you have to uninstall/reinstall WSA TWICE rather than just once if what I have suggested does work, and we can provide instructions on how to do this.
 
Regards, Baldrick

You could try setting up a symbolic link, but as far as I know there's no setting to change this natively within the application.

Hi boleyd
 
You are quite correct...this is an 'issue' that has been going on for some time now and there are a number of routes to effectively slimming down the size of the WRData folder re. the .db files. These are:
 
1. Open a Support Ticket so that the Support team can review what is being monitored and whitelist any files that may need so doing so that the next time that you run a scan WSA should recognised that the item(s) being monitored are not longer 'undertimed' and then WSA should effectively stop monitoring the file(s) and remove the jornal (.db file).
 
2. Uninstall WSA, check to see if the WRData folder has been deleted and if not then delete it manually, and then do a clean reinstall WSA (we can provide instructions on how to do that).
 
3. If you are technical there is another way that avoids the uninstall/reinstall, which involves the review of the 'dbnnnn.db files in the C:ProgramdataWRDATA folder, and then the deletion of selected ones of this file type.
 
This is not ideal but it does avoid the uninstall/reinstall and also preserves to some extent the rationale for those files; as you may have surmised from the thread these files are the journal files produced when WSA sets a file/app to 'Monitor' and so are important in case WSA has detected a suspicious or an as yet undetermined (in terms of goodness/badness) file/app and then determines it is bad and then needs to roll back its activities, etc., in which case the relevant 'dbnnnn.db' file is required.
 
The problem is that we cannot easily tell which 'dbnnnn.db' relates to which file/app in the system (there is a way by looking in the Registry but I have lost my notes on that...must try to find them) so the best thing to do is to (i) check all places in WSA where files could be set to 'Monitor', decide whether they are OK or not (and if in doubt leave them as such), (ii) try to work out roughly when a file/app that is set to 'Monitor' was so set & (iii) then go to the C:ProgramdataWRDATA folder and carefully delete all 'dbnnnn.db' files that are either prior to a certain period, i.e., say more than 2 weeks old, on the basis that WSA should have been in a position to sort out if the journal is required or not, or delete everything except for the 'dbnnnn.db' files that are circa the dates that you believe that you 'Monitored' files/apps may have started to be monitored, etc.
 
The above may seem more convoluted that an uninstall/reinstall, but I have found that it seems to work well, and does give you a better chance of keeping 'dbnnnn.db' files that may be needed; after all an uninstall/reinstall should clear all the files in that folder regardless of whether they are needed or not.
 
An alternative way which may be more accurate but takes longer is to run Save a Scan Log and from the text file produced do a search for ‘(nnnn)’ (without the ‘’ marks) where ‘nnnn’ is the ‘nnnn’ portion of the ‘dbnnnn.db’ file(s) found in the C:ProgramdataWRDATA folder.  This should find an entry in the Log from which you can identify the application/file that is being monitored and to which the journal file concerned belongs;
 
Sat 12-09-2015 10:21:40.0098         Monitoring process C:BrowsersMaxthonPortableBinMaxthon.exe [63D4BC1DABF35B13C94A9FAE02D7C0FF]. Type: 3 (1235)
 
relates to file ‘db1235.db in the C:ProgramdataWRDATA folder.
 
Of course, this is not ideal in terms of dealing with many ‘dbnnnn.db’ files but if one can identify the largest of these files and start with those then one can reduce (safely) the size of the folder.
 
None of the above are a 'solution' in itself but may assist with you reclaiming space from the WRData folder.
 
Hope that helps?
 
Regards, Baldrick