WSA hangs on 99%

Hello Borialis
 
Welcome to the Webroot Community,
 
Would you mind doing a clean reinstall? This will ony take 5 minutes.
 
Please follow the steps closely!
 

• Make sure you have a copy of your 20 Character Alphanumeric Keycode! Example: SA69-AAAA-A783-DE78-XXXX
• KEEP the computer online for Uninstall and Reinstall to make sure it works correctly
• Download a Copy Here (Best Buy Subscription PC users click HERE)
• Uninstall WSA and Reboot
• Install with the new installer, enter your Keycode and don't import any settings if asked to as you can set it up as you like once it's done
• Let it finish it's install scan
• Reboot once again

Please let us know if that resolves your issue?
 
Thanks,
 
 

OK thanks, I'll do that and let you know what happens.

I did as you suggested (uninstalled and reinstalled WSA) and the initial scan started. By about 18:00 the scan attained the 99% level. However, it is now 19:17 and it is still at the 99% leve, and the sca appears still to be continuing. At about 18:30, Windows Defender identified about half a dozen changes, which with some trepisation I allowed. It took several minutes for the changes to succeed. They were concerned with WRkrn, eg CWindowssystem32driversWRkrn.sys and WRusr.dll and wrUrlFlt.sys..
As I write the scan is still stuck on 99%. So should I abort it, or hang on, and if the latter, for how long?
Thanks in advance for your advice.
 

Hi Borialis,
 
Sorry to hear that this uninstall/reinstall did not work for you. Did you follow these instructions here may I ask?
 

• Install with the new installer, enter your Keycode and don't import any settings if asked to as you can set it up as you like once it's done

 
 
My best advise is Submit a Support Ticket which is free of charge with an active Webroot subscription. They will get to the bottom of this for you.
 
Would you let us know if Support fixed this for you?
 
Sorry I can't help other then this. But I could ping ? and he might be able to assist here?

Yes. I entered the keycode and there was no request to import settings, so thsituation did not arise.
I will try submitting a support ticket, and, if I don't hear from you to the contrary, will abort the scan in a little while.

Oh I am sorry yes ABORT the scan and reboot and try again?

It sounds like to me,windows defender is interfering on some level.As WSA is more than enough protection,in windows xp you can actually uninstall windows defender.There is an article here which is a good a to z on how to remove windows defender http://www.ehow.com/how_6789352_disable-windows-defender-xp.html
 
As always,i'd recommend backing up your computer first.

This morning I tried another scan, again allowing some registry changes via Windows Defender, and this time the scan completed, and indeed found a  virus associated with the spoolsv.exe program - this is where I thought the trouble was hiding since this program (which is a legitimate program associated with the printer) kept running even though I wasn't using the printer at all.
 
WSA found the following: the infection Win32.UserAdded in C:windowssystem32dllcache associated with spoolsv.exe
A second scan confirmed that the threat had been removed and I have manually searched for Win32.UserAdded files as well as checking using regedit for entries said to be associated with this virus: nothing was found.
 
So, it appears that  Webroot Secure Anywhere has successfully removed the UserAdded virus from my system. Many Thanks.

I should have mentioned, to be precise: the WSA scan that completed this morning did not detect the UserAdded virus. But I then instructed WSA to "Block" the spoolsv.exe process (because I suspected it was the source of the problem), and it was then that WSA identified the existence of UserAdded.

? , blocking the spoolsv.exe is deffinitely not a good solution. Like others here said submit a trouble ticket .
The fact you block this executable will cause you a lot of printing problems 
But to be honest your operating system's a little bit outdated. WSA still runs on it but the OS on its own is not that secure and is not updated anymore. I don't think you are as geek as i am ( because i deliberately run windows 10 on something that's older then my kids :$ ) so should you not consider buying a license to a more recent operating system and have something that's far more secure and gets updated?

Sorry, I hadn't noticed your post had been added over the page.
I take your point about spoolsv.exe and printing - at present it is in quarantine and I've not tried any printing for a while.
And, yes, once Christmas and the New Year are over I intend to get a new PC: this one seems almost steam driven.
And I'll look into submitting a ticket within a day or so.