App Review Webroot Internet Security Plus 12.21.19

[omidomi]

Rollback was good for threats 10 years ago. Those that just do minor changes to the system.
Ransomware are way above rollback capabilites, since it would requires it to do a whole copy of all files...which is impossible for it.
I don't see any videos showing it rollbacking any ransomware effects, and that those fanboys seems to never mention it...

Em, another bad thing (you may see in my tests) when Webroot monitor a malware , that malware work easily (Calling in or Out) or Encrypted Files , I think that When a status is "monitored" that files should't do any thing....

 

[ForgottenSeer 823865]

Em, another bad thing (you may see in my test) when Webroot monitor a malware , that malware work easily (Calling in or Out) or Encrypted Files , I think that When a status is "monitored" that files do nothing....

In fact, when monitored, the file act as it should but restricted in some extent, the changes it does are "journaled" and if later the files is flagged as malicious, then Webroot supposedly reverse the modifications made by the file.

 

[omidomi]

In fact, when monitored, the file act as it should but restricted in some extent, the changes it does are "journaled" and if later the files is flagged as malicious, then Webroot supposedly reverse the modifications made by the file.

Encrypting All Files are in the "restricted in some extent" Status
Wow!

 

[ForgottenSeer 823865]

Encrypting All Files are in the "restricted in some extent" Status
Wow!

Exactly, it is why I say it is a weak mechanism. The only good thing in Webroot is its Identity Shield component.
When you observe all the security setup of the Webroot fanboys, rarely it runs alone, they often add an anti-exe alongside, because they know Webroot can't handle serious malware.

Note: In the previous post, I just summarized what Webroot should do, but we all know in most case it doesn't or it does it partially, depending the complexity and severity of the malware.

 

[imuade]

Webroot has two features to tighten security:

1. Firewall: it can warn about any new process trying to connect to internet
2. Heuristics: it can warn about any new process trying to start

Some more details are available here:

Webroot SecureAnywhere Antivirus Comprehensive Review Right Here

This is the review that you will have to read if you want to know whether Webroot SecureAnywhere Antivirus is worth it or not. Now, there are a lot of antivirus products in the market and you don't want to waste your time researching them all. Read this comprehensive review to make an informed...

securitygladiators.com

I haven't tried them yet, I'm just reporting they exist.
Probably Webroot will become more chatty, but it's the usual balance between safety and usability

 

[roger_m]

1. Firewall: it can warn about any new process trying to connect to internet

Unfortunately the firewall has a serious flaw. It automatically allows connections after two minutes, if the user has not chosen to allow or block the connection before then. It's fine if you are actually using the computer and watching what is going on. But if you are away from the computer and a malicious process tries to establish a connection, it will be allowed.

 

[imuade]

Unfortunately the firewall has a serious flaw. It automatically allows connections after two minutes, if the user has not chosen to allow or block the connection before then. It's fine if you are actually using the computer and watching what is going on. But if you are away from the computer and a malicious process tries to establish a connection, it will be allowed.

Ah, that's bad... what about the second point?
Heuristics: it can warn about any new process trying to start

 

[SeriousHoax]

ESET scored 98% so it's bad!!! But if Webroot had participated in the test, it probably would've scored 28% only. We all know 98% is better than 28% so at the end of the day Webroot is worse. Case closed

 

[roger_m]

Ah, that's bad... what about the second point?
Heuristics: it can warn about any new process trying to start

I've never enabled it and don't know anything about. I might have a look tomorrow.

 

[artek]

With Webroot, I was referring to actual bad results and once again scoring very close to the highest scoring antiviruses is not a bad result.

Once again, I was referring to actual bad results and once again you are missing the point. There's only one antivirus vendor I can think of which has said that test results don't matter and that's Webroot.

For the record, I have never used ESET as my main antivirus other than using trial versions a few times over the years and probably never will.

Yes, you're right. What a great result. Lower scores than Avira, F-Secure, Kaskersky, Bitdefender, Microsoft, Tencent, Vipre, Symantec, Trend Micro, Panda, K7, Avast, AVG, McAfee. I guess if you squint hard enough they look pretty close to the top.

If you think that Webroot is the only vendor that's been complaining about these tests, you haven't been paying attention very long. And to prove my point why do you think ESET no longer participates in AV-Test? Could it be that, like Webroot, they had consistent bad results and decided to pull out because it was making them look bad?

Again, the only difference is that we like ESET.

 

[RKRN3]

I always used Avast, but am not a fanboy of any of the Anti-Virus companies. Now, let's imagine that ESET is bad. So, put it out of this thread's discussion. Now look here (Test Webroot SecureAnywhere 9.0 for Windows 10 (192322)). What do Webroot fanboys have to say about this result? Noobs like me would see that it is way bad compared to others.

 

[artek]

I always used Avast, but am not a fanboy of any of the Anti-Virus companies. Now, let's imagine that ESET is bad. So, put it out of this thread's discussion. Now look here (Test Webroot SecureAnywhere 9.0 for Windows 10 (192322)). What do Webroot fanboys have to say about this result? Noobs like me would see that it is way bad compared to others.

The point of my argument is not to pillory ESET. The point is to highlight how poorly the community views these tests as a representation of a product's protection ability, until they discuss Webroot. The tests are criticized and derided in almost every thread, only to be marched out and represented as gospel when targeted towards a product we dont like. The curious thing that I've noticed is that this is unidirectional only towards Webroot. Other products, like ESET, which you'll find are no longer participating in the test you've linked, probably for the same reasons as Webroot, are never criticized in the same manner.

 

[imuade]

I've never enabled it and don't know anything about. I might have a look tomorrow.

OK, I have tried the Heuristics setting with a safe, but not very common file:
IPv4Calculator.exe
SHA-256: 58850505066f38724195dc6dd008d35f5a44a55b900a1c487d6f08603d06264a

The file was blocked and it's actually blocked by default after 120 seconds

 

[roger_m]

Yes, you're right. What a great result.

Yes, it's an excellent result. It doesn't matter if scoring lower than other antiviruses, if it's scoring very highly. You're wasting your time trying to prove that ESET is a bad antivirus, because it isn't.

If you think that Webroot is the only vendor that's been complaining about these tests, you haven't been paying attention very long.

Name another vendor that has actually said that tests don't matter? I made no mention of complaining, I was specifically talking about claiming that tests don't matter. Even if you ignore the professional test results, almost always, every big name antivirus does a lot better than Webroot does in tests here at the Malware Hub. You'll see in tests against ransomware, Webroot often lets a user's files get encrypted.

Again, the only difference is that we like ESET.

I like Webroot less than ESET because it consistently isn't very good at detecting malware.

 

[artek]

Name another vendor that has actually said that tests don't matter?

Not that they "don't matter." But that they're not representative of real world protection, or that they are inaccurate. And the vendors that have complained about that:

Cylance, F-Secure, Symantec, Panda, Microsoft.

Oh and here's one for you:

"Corrons and Righard Zwienenberg of ESET presented a paper at the Virus Bulletin Conference in October 2016 on the potential gaming anti-malware product tests. In it, they noted a few obvious examples. "Some testers organize their malware testbeds by naming the files by their hashes," the two wrote. "There have been cases where products were not able to detect malware in a file with a ‘normal’ filename, while it was detected when the name of the file matched the file’s hash."

You can find vendors complaining about this almost every year since 2007.

 

[ForgottenSeer 823865]

Not that they "don't matter." But that they're not representative of real world protection, or that they are inaccurate. And the vendors that have .

We all know that, i hope, but in Webroot case, they decide to participate or be partners to those labs, so if they agree to such participation, they have to accept those labs results.

The problem is i don't see Webroot, the company, complaining too much, but only their fanboys especially when its results are consistently lower than all other AVs...Then they got emotional, say test labs are useless, say people criticizing WR has no clues on how it work, blablabla....
but when they see a video or a unique test showing good results , then it gain more value than labs? come on...hypocrisy and bias at it best.

To be honest, if you disagree with a methodology, you withdraw from this test lab.; but as i always said, Test labs are marketing proxies for vendors and even if you score lower than other , you stay with them because it is still good advertisement. Especially when later you order a personalized (paid) test which will often, show very good results...

 

[roger_m]

Not that they "don't matter." But that they're not representative of real world protection, or that they are inaccurate. And the vendors that have complained about that:

As I said again in my last post, I was talking about Webroot saying specifically that tests don't matter. Due to the way that Webroot works, its detection rate for new malware is not good. It is not good at detecting new threats, which is why it will usually perform very badly when tested. It monitors unknown files for suspicious behaviour. If it thinks a program is malicious, in theory it can rollback its actions, to restore the system to a clean state and also will add signatures for it. However, as tests in the Malware Hub show repeatedly, it is unable to rollback the actions of ransomware. As a result, they really do need to improve both their signatures and behavioural protection, in order to compete with the big name antiviruses. As I've said previously, its web filter is very good and will block a lot of threats. But for the threats it misses, then Webroot will often let the malware run.

It's important to note, that other antiviruses can also monitor for suspicious behaviour and then add signatures for unknown threats and Kaspersky even includes a rollback feature too (which reportedly works much better than Webroot's one does). But a big difference, is that they can detect a lot more threats. Rather than focusing on detecting threats after the system is infected, due to better signatures and behaviour blockers, they do a much better job of stopping the system getting infected in the first place.

There's nothing remarkable about Webroot, but fanboys keep insisting there is. They don't even know what's so amazing about it, other than that it "works for them."

 

[ForgottenSeer 823865]

There's nothing remarkable about Webroot, but fanboys keep insisting there is. They don't even know what's so amazing about it, other than that it "works for them."

In fact most of them don't even understand how it works, if they did, they can't logically accept such mechanism especially in our time.
If webroot would virtualize the whole system then it will works, but not the way it is implemented now. The rollback machanism can't cope with 50+Gb of modified datas.

 

[roger_m]

In fact most of them don't even understand how it works, if they did, they can't logically accept such mechanism especially in our time.

Exactly. But we're the ones who don't understand how it works

 

[South Park]

OK, I have tried the Heuristics setting with a safe, but not very common file:
IPv4Calculator.exe
SHA-256: 58850505066f38724195dc6dd008d35f5a44a55b900a1c487d6f08603d06264a

The file was blocked and it's blocked by default after 120 seconds

View attachment 233061

My experience with Webroot was that it blocked a LOT of safe but slightly uncommon files, including about 20 individual dll's from the Sea Monkey and Pale Moon browsers. I had to manually unblock each file and hope the setting stuck. It was such a huge PITA that I finally uninstalled it, despite having a free license.