Skip to main content
Solved

Repeated files that are NOT a virus are flagged for delete over and over.

  • March 22, 2026
  • 4 replies
  • 94 views

MajorHavoc
Bronze VIP
Forum|alt.badge.img+25


As a sacn is in progress, one or more files pop up as a red dialog about a “bad” file. being a trojan. However, I know it is not.  So I uncheck it, and close the dialog. Then it pops up again some time later flagged exactly the same way. 

In other virus software I have used, I could flag a file as safe and unless the file changed (different checksum?) the file would not be reported again.  I find no such method on WSA. 

Does this exist and I am just not seeing it, or do you not support such a function. Because it is annoying as can be to have to tell the software over and over and over and over and over…. You get the picture. 

If this is not in the current program, might I request it as a future feature? Given the period between Mac releases, I suspect I will have to put up with this for at least several year, but it would be appreciated to remember specific files (by name, location, change date, checksum) as safe and to not flag them unless something else changes.  Or at the least an ignore file feature. 

Thanks


 

Best answer by santanu

Thanks again for sharing the additional details! Glad to hear the “Ignore files or folders” option is clearer now.

You’re right that the current interface feels a bit dated but we are also working on a couple of initiatives to make it better. The good news is we’ve launched Webroot Total Protection, which comes with a fresh, modern UI and an improved experience. I’d love for you to explore it - you might find it much more intuitive.
Demo link: https://www.youtube.com/watch?v=LGk8AObb4Lo&t=2s

 

Secondly, let me answer the question for another issue here only. When you select Shut Down SecureAnywhere, it closes the visible app and menu bar icon, but the core protection daemon continues running in the background. Because of this:

  • Protection isn’t fully off.
  • Background scanning may still detect known threats.
  • However, it shouldn’t show any pop‑ups while the main app is closed.

Threat notifications will appear only once you reopen the app or restart your machine (which restarts the daemon and UI).
For SME/Business builds, behavior may vary as those are more admin‑controlled.

If you’re using the consumer version, shutting down the app should prevent any pop‑ups. Could you check and confirm what you’re seeing? If the issue persists, I can loop in support to help troubleshoot.

Happy to assist further - just let me know!

4 replies

santanu
  • OpenText Employee
  • March 26, 2026

@MajorHavoc  Thanks so much for sharing these details with us! To help us better understand the behavior you’re seeing, could you please clarify a few points?

  • Which file type are you trying to allow (for example: exe, app, script, binary, pkg, dmg)?
  • Is this a single file, or part of a folder being scanned?
  • Are you using Webroot EPP Business or Webroot Consumer (Home)?

In parallel, I also wanted to share that Webroot Secure Anywhere for Mac provides an option to ignore specific files. You can do this by:

  1. Clicking the gear icon next to the Mac Security section (on the right-hand side).
  2. Opening the Block and Allow Files tab.
  3. Adding the file and setting it to Allow.

This will mark the file as safe and prevent it from being scanned in subsequent scans.
Please note that at this time, allow/block entries are supported only for executable file types.

If you can help with the details requested above, we’ll be able to guide you more effectively. Thanks again! 


MajorHavoc
Bronze VIP
Forum|alt.badge.img+25
  • Author
  • Bronze VIP
  • March 26, 2026

I’m using Webroot consumer. Often these are windows exe files for Parallels or older Apple apps I use in an OS-9 emulator.  However, often it flags “unknown” file types. Might be binary data, a script file, even had a text file flagged once. 
 

Thank you for pointing out how to add the fill to allow. I tried to find that, but if you look at some of my other comments long ago, I find the UI interface horrible. 
 
Where I see this alert window it  is not the full app window, but a smaller orange window showing only the one file it does not like with a check mark next to it. The only option is cancel or remove. I do not see how to “allow” in that alert window.  But I will look again to see if I can find it. That said, when the main window is up and orange I still have issues trying to find out I see the list of files it does not like. I’m guessing the same place?  But in all seriousness, I’ve been a UI and software designer since the 70’s, and your program’s interface for the Mac is anything but intuitive. 
 

And today again, during my Time Machine Backup, I shutdown WSA from the menu bar, it closed and I started my backup. (It finishes MUCH faster if WSA is stopped.) Yet again I saw a file get flagged as “trojan” by WSA.  How come if WSA is supposedly shutdown, it still flags files? I’m guessing it’s not fully shutdown?

 

Anyway, thank you for responding. Still hoping for a major update release for Mac with a newer interface. And maybe you can sneak in the ability to ignore any file. 😃


santanu
  • OpenText Employee
  • Answer
  • March 27, 2026

Thanks again for sharing the additional details! Glad to hear the “Ignore files or folders” option is clearer now.

You’re right that the current interface feels a bit dated but we are also working on a couple of initiatives to make it better. The good news is we’ve launched Webroot Total Protection, which comes with a fresh, modern UI and an improved experience. I’d love for you to explore it - you might find it much more intuitive.
Demo link: https://www.youtube.com/watch?v=LGk8AObb4Lo&t=2s

 

Secondly, let me answer the question for another issue here only. When you select Shut Down SecureAnywhere, it closes the visible app and menu bar icon, but the core protection daemon continues running in the background. Because of this:

  • Protection isn’t fully off.
  • Background scanning may still detect known threats.
  • However, it shouldn’t show any pop‑ups while the main app is closed.

Threat notifications will appear only once you reopen the app or restart your machine (which restarts the daemon and UI).
For SME/Business builds, behavior may vary as those are more admin‑controlled.

If you’re using the consumer version, shutting down the app should prevent any pop‑ups. Could you check and confirm what you’re seeing? If the issue persists, I can loop in support to help troubleshoot.

Happy to assist further - just let me know!


MajorHavoc
Bronze VIP
Forum|alt.badge.img+25
  • Author
  • Bronze VIP
  • March 31, 2026

Thanks again for sharing the additional details! Glad to hear the “Ignore files or folders” option is clearer now.

You’re right that the current interface feels a bit dated but we are also working on a couple of initiatives to make it better. The good news is we’ve launched Webroot Total Protection, which comes with a fresh, modern UI and an improved experience. I’d love for you to explore it - you might find it much more intuitive.
Demo link: https://www.youtube.com/watch?v=LGk8AObb4Lo&t=2s

 

Secondly, let me answer the question for another issue here only. When you select Shut Down SecureAnywhere, it closes the visible app and menu bar icon, but the core protection daemon continues running in the background. Because of this:

  • Protection isn’t fully off.
  • Background scanning may still detect known threats.
  • However, it shouldn’t show any pop‑ups while the main app is closed.

Threat notifications will appear only once you reopen the app or restart your machine (which restarts the daemon and UI).
For SME/Business builds, behavior may vary as those are more admin‑controlled.

If you’re using the consumer version, shutting down the app should prevent any pop‑ups. Could you check and confirm what you’re seeing? If the issue persists, I can loop in support to help troubleshoot.

Happy to assist further - just let me know!

Thank you. Yes, it seems that file that keeps popping up is a Trojan warning on a dylib file which is what I cannot add it to a list. To me not being able to add any file to an ignore list is a real problem which makes the product less secure since I am constantly closing dialogs, and soon, ignoring them. Dialog fatigue will set in and I (or others) may just close dialogs because they are tired of seeing them and think they are the same. For a security company, this should be obvious. I learned about dialog fatigue in the early 80’s working at Apple on MacOS warnings and how to reduce them. It is not a new concept. 

On the Quit issue, it possible the menu item did not quit, but went gray with a red exclamation point because of the warning. I thought I said quit, and that this popped up after, but I will try this again and let you know on the next local backup IF it happens again. 

As for Webroot Total Protection, I am on the beta testers list for a number of other products here, maybe I can get on the beta list for testing that as well? I a failry sure I can break that too!  😁

Thanks for the help. Hope to see some improvement in the future.