Skip to main content
To Customer Support To Customer Support
We have webroot business, managed inside the portal. A user is running AutoCAD 2018 software and I've followed AutoCAD's recommendation on AV exclusions and configured those under "Override". However, there is no option to exclude specific file extensions within Webroot business, such as excluding *.dwg or *.dwf files from being scanned when they get launched via AutoCAD. This is a major flaw... how is a product in the magic quadrant not having a classic AV software feature?! The whole system basically bogs down with CPU seriously spiking due to Webroot getting and scanning at the file. The problem is obviously Webroot because once I unload Weboort, AutoCAD runs at a swift pace.





If anyone has any suggestions, please advise. thanks.
Hello @ronnieshih and Welcome to the Webroot Community!



The best thing for you to do is to Submit a Business Support Ticket and ask them to check things out for you as it could be some files need to be whitelisted in the Webroot Cloud Database especially if there was a recent update to AutoCAD 2018.



Thanks,
I already submitted a ticket. I thought maybe there is something support doesn't know, which happens all the time.
@ronnieshih - I would like to suggest you capture the "undetermined" report on one of the workstations in question and submit it to me personally and I'll have threat include it as part of our central data rules. This is the most efficient method for more complex solutions. AutoCAD is something we have extensive knowledge about, but if you're still experiencing something unique, we may need to include additional rules to end/stop any monitoring.



So you're aware, our agent is not a "traditional scanning" engine, so traditional methods of "overriding" do not always apply. Also, my guess is more inline with the agent monitoring a process that is "unknown" and has nothing to do with the file types. The best course of action was as @TripleHelix suggested, but the request should have been for them to submit software for review, not necessarily how to make a better override. If support didn't understand the request, they may not have provided the right direction.



If you have one of the problematic systems still installed, simply capture the "undetermined" software report at the site level or now at the main Admin console level above the sites, "Devices with undetermined software on last scan" under "Reports". This will include all the data our central threat team needs to craft an appropriate rule to insure it's not effecting your customers endpoint performance.



Please reach out to me directly through DM here on the community or you're welcome to email me directly at: scooper@webroot.com to discuss further and/or review.



Thanks,
Here is the funny part. There are 2 other pc's with identical version of AutoCAD 2018, also with identical version of Webroot installed. And those 2 pc's don't have issues AT ALL. This problem apparently started 2 weeks ago for this guy. I worked on this pc for 4 hours yesterday. The only time the pc sped up was when I shut down Webroot, the problem is nice and clear, it is something with Webroot. CPU would crank to 13% each for 8 logical CPU's, resulting in 100% CPU time, when any AutoCAD related files are launched. He is now shutting down Webroot in order to get his AutoCAD graphs edited, then opening up Webroot again to stay protected.



Support would like me to run wsalogs.exe, I will to get this done today without disrupting too much of the user's time and see where we get.
@ronnieshih - it could be any number of things, but again, my guess is that it's a process that is unique to his data file. AutoCad and many solutions have tons of DLLs and EXEs that may be at rest until something specific in his drawing/design calls it and causes the CPU to spike due to WR monitoring.



That log will help, but it will only capture data while WR is running and AutoCad is running, so make sure they're both running and the issue is present.



You can also look at the WR UI to see what process is being monitored. Open WR on the endpoint in question, select the icon on the right of Utilities. When that comes up, goto the System Control Tab and start "Start" button. This will show you what is being monitored. From there you may be able to determine which process is causing issues.



Logs should capture this as well, but this is a quick method for sussing out a monitored process.
Terms & Conditions