Issue:

On a Windows computer, application loading / startup is slow or does not work at all when DeepGuard feature is enabled. What can be done if a software is having issues when DeepGuard is enabled? 

Resolution:

We recommend to check and ensure that the Security Cloud is enabled and that the endpoints are able to connect to the Security Cloud. 

You need to ensure that the connectivity to the Security Cloud. 

If necessary, you can run the Connectivity Tool to validate the connectivity state to the WithSecure services backend:

• Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
• Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
• Elements EPP for Computers and Elements EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\fsconnectionchecker.exe

Other than this, you may exclude the application from being monitored by DeepGuard by creating an exclusion for the application. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Server Configuration > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Note that you can use wildcards when creating the exclusions. For example: C:\Users\*\AppData\Local\test\ 

For Business Suite products (Client Security and Server Security):

1. Log in to Policy Manager Console
2.  Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Real-time scanning 
5. Scroll down to the Files and application excluded from scanning table
6. Enable Do not scan the following files and application 
7. Click Add from the right side of the table 
8. Select:
   1. File path if you want to enter the full file path to the application
   2. Application SHA-1 if you want to enter the SHA-1 hash value of the application to exclude it anywhere on the system
9. Click OK
10. Distribute the policy (Ctrl + D)

Issue:

Elements Endpoint Protection Agent or Business Suite Client Security / Server Security DeepGuard feature has blocked a safe application. How do I unblock it?

Resolution:

If DeepGuard has blocked a safe application (a false positive), then we still recommend to submit the sample file to our Labs so that we can analyze the file and correct the detection if necessary. 

You can open a ticket using the Sample Validation service in the Elements portal: https://support.withsecure.com/userguides/product.html#business/elements-welcome/latest/en/submitting_a_file_sample-latest-en

If you are sure that the detection is a false positive, you can create a DeepGuard exclusion to immediately get the application working again. How to centrally create the exclusion depends on if you are using Business Suite or Elements Endpoint Protection. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Go to the Security Configurations > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Alternatively, the DeepGuard exclusion rule can be also added using the Security events page:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Exclude folders and files from all security scans list
5. Click Save profile

For Business Suite:

1. Log in to the Policy Manager Console
2. Select a policy domain or host from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning settings
5. Scroll to the Files and applications excluded from scanning table and enable Do not scan the following files and applications 
6. Click Add
7. Set the scope as All scans and select File path from the drop-down menu
8. Add the file path C:\Program Files\Exampleprogram\examplefile.exe and click OK
9. Distribute the policy (Ctrl + D)

On all products, to locally allow an application that DeepGuard has blocked:

1. Open the WithSecure program
2. Click Settings
3. Under the Malware Protection tab, click View quarantine
4. Go to the Blocked tab
5. Select the application that you want Deepguard to allow to run
6. Click Allow
7. Click Close

Issue:

Can a standard user without admin rights / privileges manually install patches or updates using the Software Updater feature? The Software Updater can show these updates to be available to standard user on the local user interface (GUI), but how can a standard user install them? 

This article is valid for:

• Elements Endpoint Protection (Elements EPP for Computers and Elements EPP for Servers)
• Business Suite (Client Security and Server Security)

Resolution:

Local users require administrator privileges to be able to manually start installing software updates from the local graphical user interface for Elements Agent, Client Security or Server Security. 

There are a few options how to handle such scenarios:

• User can contact the administrator and request the administrator to install an update using the Elements Security Center portal or Policy Manager Console
• User can provide administrator credentials when elevation is prompted and install the software update locally using the Software Updater view in the local graphical user interface.
• IT administrator should have Software Updater scheduled to install patches automatically

Issue:

Can Elements Linux Protection and Linux Security 64 run a Manual or Real-time scan on NFS mount directories?

Resolution:

Yes, both Elements Linux Protection and Linux Security 64 can run a manual scan on NFS mount directories.

But we recommend scanning the NFS content locally on the NFS server instead as there can be issues to scan directly on mounted NFS.

Issue:

How or where to buy WithSecure products if we are a new potential customer? How do I find a reseller partner? 

Resolution:

WithSecure products are sold via reseller partners. If you are interested in WithSecure products and you are thinking of buying, you can fill the contact form on the WithSecure home page and our sales can be in touch with you so that we can find a suitable reseller partner for you: Contact WithSecure | We Are Here to Help 

Issue:

DataGuard feature blocks svchost.exe. Can we exclude svchost.exe from being blocked by DataGuard? 

Resolution:

If DataGuard blocks svchost.exe, it is not recommended to add svchost.exe to the Manually added trusted applications and folders list since svchost.exe can be used by various processes and therefore it is not possible to fully know if the svchost operation is harmful or not. 

If the folder, where svchost.exe is trying to access or modify a file, was automatically protected due to the Discover monitored user data folders automatically feature, you can add the folder to the Manually excluded folders list in the profile so that DataGuard will not block svchost. 

Steps for Elements Endpoint Protection:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the device 
4. Go to the DataGuard settings page
5. Scroll down to the Monitored folders section
6. Under Manually excluded folders, click Add path 
7. Enter the path to the folder you want to exclude
   1. Note: All sub-folders will also be excluded
   2. Note: Wildcards and environment variables are supported
8. Click Save profile

Steps for Client Security:

Client Security does not have a Manually excluded folders feature, so you will need to disable the protection for that specific automatically protected folder. For example svchost.exe is blocked due to file being in the Documents folder, you can disable the protection specifically for the Documents folder:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > DataGuard
5. In the Protected data folders table, disable the protection for a folder
6. Distribute the policy (Ctrl + D)

Issue:

How to view a list of all users who have access to a company's eService portal? 

Resolution:

At least one user in the company should be assigned as the eService admin user. This user will have the User Management tab visible in the WithSecure eService portal. From the User Management tab you can view and manage the current members. 

If you do not know who in your company has the eService admin user rights, please contact your WithSecure Customer Experience Manager. 

Issue:

Does WithSecure Software Updater on Elements Endpoint Protection (EPP Computers and for Servers) or Business Suite (Client Security and Server Security) products install Windows feature updates as part of the software update process?

Resolution:

Elements Software Updater does not install Windows feature updates or major operating system version upgrades. A move for example from Windows 11 25H2 to Windows 11 26H2 would not delivered through Software Updater, and these upgrades are not part of the security updates it installs. The same applies to Windows service packs.

What Software Updater does cover is the regular Microsoft updates for the installed Windows version, including security updates, as well as updates for supported third-party software. Windows optional updates are not included.

To upgrade devices to a new Windows feature version, please deploy the feature update with Microsoft's own tools, such as Windows Update, WSUS or your existing Microsoft management tooling. Once a device is on the new version, Software Updater keeps providing security updates for it as usual.

Issue:

Is is possible to run the WithSecure Quarantine Dumper Tool(wsdumpqrt.exe / wsdumpqrt64.exe) be run remotely?

Resolution:

The WithSecure Quarantine Dumper tool can't be used remotely. Currently the tool is designed to be used locally only, so you need to download and run the tool on the device itself with administrator privileges. 

If you have remote administrator access to the device, you can log in to the device and run the tool that way. 

Collect quarantined files using WithSecure Quarantine Dumper by following the instructions below:

1. Click on this link to download  to a location of your choice, for example, c:\temp:
   • 32bit version: https://download.withsecure.com/support/tools/wsdumpqrt/wsdumpqrt.exe
   • 64bit version: https://download.withsecure.com/support/tools/wsdumpqrt/wsdumpqrt64.exe
2. Launch Command Prompt (CMD).
3. Navigate the directory to the location you selected in step 1. For example, type cd c:\temp\ and press Enter on your keyboard to go to c:\temp\ folder.
4. Type wsdumpqrt.exe -d c:\temp\ to run the tool.
5. Enter your administrator credentials when prompted. WithSecure license terms are now shown.
6. Scroll all the way to the end of the license terms before you can accept them.
7. Press E on your keyboard to accept the license terms.
8. Press any key to complete the run. The quarantined files will be collected in a file named malware_samples.zip with the default password (infected) in the location you specified in step 1. 

Issue:

How to block all USB mass storage devices (USB flash drive / stick) with the Device Control feature?

Resolution:

To block all USB Mass Storage Devices with the Elements Endpoint Protection Device Control feature:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > profiles page
3. Open the profile that is in use on the devices
4. Go to the Device control settings page
5. In the Device access rules section, change the Access to device value for USB Mass Storage devices from Allow to Block
6. Click Save profile

To Block all USB Mass Storage Devices with the Client Security or Server Security Device Control feature via a Policy Manager policy:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Open the Settings tab
4. Navigate to Windows > Device control
5. In the Device access rules table, change the Access level for USB Mass Storage Devices from Full access to Blocked 
6. Distribute the policy (Ctrl + D)