Skip to main content

Does webroot detect kovter?

  • May 19, 2016
  • 4 replies
  • 38 views

Windows Defender was repeatedly reporting that it was quarantining different versions of the kovter ransomewhere. I decided to install Webroot, because I believe the internet is the most dangerous place today. I was surprised that Webroot did not report the infection and now I am a little worried this may not be the product I am looking for. Thoughts? Concerns? Opinions? tnx

4 replies

RetiredTripleHelix
Gold VIP
Forum|alt.badge.img+56
Hello and Welcome to the Webroot Community!
 
I would say yes and if not WSA can rollback to the pre-infection state if WSA is installed before infection! Check here to see if something is under Monitor? http://www.webroot.com/En_US/SecureAnywhere/PC/WSA_PC_Help.htm#C10_SystemControl/CH10b_ControllingProcesses.htm
 
Also read this: http://www.webroot.com/blog/2015/12/02/whats-in-a-name/ and if you can supply a MD5 Checksum off one as it could be under another name with the Webroot Threat Intelligence. http://www.webroot.com/us/en/business/threat-intelligence
 

 

 
Thanks,
 
Daniel 😉

JesseBropez
  • OpenText Employee
  • June 6, 2016
Hello collinsjct,
 
We'd like to help in removing Kovter.
 
Kovter is a particulary nasty registry infection and to properly remove it, manual remediation is almost always required.
 
Please submit a trouble ticket here: https://www.webrootanywhere.com/servicewelcome.asp 
 
Please submit a support ticket as soon as possible, as Kovter has been known to do worse to computers it infects. We'd like to stop it before it can cause any damage to your computer.

  • Community Guide
  • June 6, 2016
?
If the infection was already present on the system before placing webroot on, there is no clean snapshot to rollback to, in order to reverse the damage. So in this case, it answers the title, but not the issue itself. 

? is quite correct, this particular fileless malware resides only in the registry to avoid detection, and is quite nasty.
 
? I would as JesseBropez stated, open a support ticket and allow them to help you remove this infection. 

RetiredTripleHelix
Gold VIP
Forum|alt.badge.img+56
@LucentWarrior wrote:
@
If the infection was already present on the system before placing webroot on, there is no clean snapshot to rollback to, in order to reverse the damage. So in this case, it answers the title, but not the issue itself. 

@ is quite correct, this particular fileless malware resides only in the registry to avoid detection, and is quite nasty.
 
@ I would as JesseBropez stated, open a support ticket and allow them to help you remove this infection. 
Right I missed that part!
 
Daniel 😉