Webroot deletes Windows files and causes serious problems for users
Customers of Webroot's endpoint security product, users and companies alike, had a dreadful surprise Monday if the app began diluting Windows files rather malicious.
The reports promptly appeared on Twitter and continued to the Webroot discussion board -- 14 pages and counting. The company developed a manual fix to address the matter, but many users had issues recovering their affected systems.
The issue is what's called in the antivirus industry as a"false positive" -- an incident where a fresh file is hailed as malicious and is deleted or blocked. False-positive episodes can vary in impact from only annoying -- for instance when a course cannot run -- to ineffective, in which in fact the OS itself is changed and no further boots.
The Webroot episode falls somewhere in the middle because it affected legitimate Windows files and delivered them to quarantine. This is somewhat unusual because anti-virus businesses typically construct whitelists of all OS files specifically to prevent false positive detections.
"The Facebook issue was corrected, and the Webroot team is at the act of creating a detailed cure for the false positive issue."
The erroneous detection lasted for 2 weeks, between 1PM and 3PM Mountain Standard Time from the U.S., and led in documents being heralded as W32.Trojan.Gen. According to the name, this is a generic detection touch intended to capture Trojan programs.
For the time being, Webroot has given an option on its online community which involves logging in the Webroot on the web console and creating override rules for each of the wrongly blocked files.
Users then have to wait for the endpoint client to poll the server and then revive the files based on the new rules, which can use up to 24 hrs, or manually trigger forced polling for every client from the command line.
While this solution might work for home users or businesses with rather few computers, it creates issues for large environments, particularly for managed services providers (MSPs).
"How am I supposed to do so over 3 GSMs [Webroot Global Site Manager deployments] with more than 3 thousand client sites? Maybe not adequate," said another.
Comments
Post a Comment