Issue:

What does the DeepGuard functionality in WithSecure products do? 

Resolution:

DeepGuard monitors applications to detect potentially harmful changes to the system.

DeepGuard makes sure that you use only safe applications. The safety of an application is verified from the trusted cloud service. If the safety of an application cannot be verified, DeepGuard starts to monitor the application behavior.

DeepGuard blocks new and undiscovered Trojans, worms, exploits, and other harmful applications that try to make changes to your computer, and prevents suspicious applications from accessing the Internet.

Potentially harmful system changes that DeepGuard detects include:

• System setting (Windows registry) changes
• Attempts to turn off important system programs
• Attempts to edit important system files

Issue:

Why does Remote Desktop Protocol (RDP) connection not work when Elements Endpoint Protection or Business Suite Client Security / Server Security Application Control rules are active on a Windows server 2022?

Resolution:

Make sure that you do not have active Application Control rules with the Event type "File access" which only have a Target SHA1 or SHA256 hash value as the sole condition in the rule. The event type “File access” is known to be problematic, since this event reduces efficiency of caching and triggers aggressive file IO interception. An RDP connection could then slow down the file IO operation when nearly every file needs to be checked against a hash value. Due to the performance penalty for this operation being unavoidable, any file based hash black lists should only be used as a temporary solution until an engine detection is added. VirusTotal can be used to check if a hash value is flagged as malicious.

If you experience issues with RDP connectivity, we recommend to not use and remove any Application Control block action rules with the Event type "File access", which use a hash value as the only condition. Such rules should only be used when enabling them due not cause issues. Alternatively, excluding with hash values can be done using the "Application start" or "module load" event types, instead of "File Access".
 

If you do not have Application Control rules matching the above description and you are still experiencing RDP connectivity issues, the issue can be caused by a race condition bug in the Desktop Window Manager (dwm.exe).

To workaround the issue, we suggest to exclude dwm.exe from all security features. Example how to create the exclusion for Elements Endpoint Protection:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Open the Security Configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile that is in use on the devices
   • Note: Only non-default profiles can be edited.
5. Go to the General settings page
6. Scroll down to the Exclude folders and files from all security scans section and click Add exclusion
7. Add the path: C:/Windows/System32/dwm.exe
8. Click Save and publish 

You can also exclude C:\Windows\System32\winlogon.exe if dwm.exe alone is not enough, since winlogon.exe is the parent process for dwm.exe.

Issue:

What are the functions of each of the services used in WithSecure business products ?

Resolution:

Below you can find the functionality and purpose of each service:

• WithSecure Hoster: Product business logic, including product updates, telemetry, settings & configurations with SYSTEM privileges.
• WithSecure Hoster (Restricted): Product business logic, including product updates, telemetry, settings & configurations with NETWORK SERVICE privileges.
• F-Secure Ultralight Hoster: Anti-malware scanning logic, including real-time scanning, Online Safety, DeepGuard, DataGuard and Application Control with SYSTEM privileges.
• F-Secure Ultralight Network Hoster: Anti-malware scanning logic, including real-time scanning, Online Safety, DeepGuard, DataGuard and Application Control with NETWORK SERVICE privileges.
• F-Secure Ultralight ORSP client: Real-time protection network query service (NETWORK SERVICE).
• F-Secure Ultralight Protected Hoster: Scanning integration to Windows Security Center, runs as protected process (protected by Windows).
• F-Secure Device Control: F-Secure Device Control Daemon service, provides a possibility to block/restrict access to local devices.
• NIF2 (Network Interface Framework) : Online Safety Logic

Issue:

Why can't WithSecure Elements Agent or Business Suite Client Security be installed simultaneously with F-Secure products (F-Secure SAFE, ID Protection password manager / vault and FREEDOME) on a computer? Both products were used to be able to be running at the same time on the device. Why is there now a compatibility issue to run them concurrently? 

Error when installing WithSecure product on a Windows computer that already has F-Secure installed (or vice versa): “Incompatible application removal – Other applications on your computer are incompatible with F-Secure / WithSecure. The following applications will be removed:"  

Resolution:

WithSecure and F-Secure have de-merged and are now independent companies. WithSecure Elements Agent or Business Suite Client Security are not compatible with other anti-virus security software, such as F-Secure SAFE. 

F-Secure has discontinued the stand-alone versions of ID Protection and FREEDOME VPN, and they are only bundled with the F-Secure application, which includes SAFE antivirus, ID Protection and FREEDOME VPN features all in one application.

Due to the fact that you cannot have two anti-virus applications installed at the same time, you can no longer install both WithSecure and F-Secure products on a Windows or Mac computer. During the installation of a WithSecure application, it will ask to uninstall the F-Secure application. 

Issue:

Malicious code has been found in MBR file (Master Boot Record), how to proceed for further investigation.

Resolution:

Collect the MBR log from the infected machine for further investigation whether it is valid infection or false positive from F-Secure product.

Log Collection Instructions:

1. Install Sector Inspector "secinspect.msi" on the infected machine and note the installation directory. Download link: https://www.microsoft.com/en-us/download/details.aspx?id=19470
2. Locate installation directory C:\Program Files\Windows Resource Kits\Tools or C:\Program Files (x86)\Windows Resource Kits\Tools
3. Execute "secinspect.exe" using cmd with the following argument. secinspect.exe > <log name>MBR.log
4. Collect "<log name>MBR.log" that was generated
5. Once the log has been collected, you can uninstall the tool using the same installer file "secinspect.msi" and choose uninstall option

Once "<log name>MBR.log" was collected, please submit through the Submit a Sample service portal (https://www.f-secure.com/en/web/labs_global/submit-a-sample) for further investigation. Select I want to give more details about this sample and to be notified of the analysis results. Malware team will investigate the log and give remediation instructions for further clean up.

Issue:

The scheduled scan task doesn't appear to begin or function correctly such as repeating scheduled scan on Policy Manager, from an unknown Scheduled Scan rule.

Resolution:

1. When a scheduled scan is configured in the WithSecure product, it creates a scheduled scanning task in the Windows Task Scheduler. If the scheduled scan does not start, you can verify if the task was actually created in Windows Task Scheduler:

1. Click Start.
2. Go to Control Panel > System and Security.
3. Click Administrative Tools.
4. Select Task Scheduler.
5. Select Task Scheduler Library.
6. Look for a Scheduled scanning task. (or the customized scheduled scanning task name you defined via Policy Manager Console or Elements EPP profile editor)
7. Delete the Scheduled scanning task. (or the customized scheduled scanning task name you defined via Policy Manager Console or Elements EPP profile editor)
8. Disable and re-enable back the scheduled scan.

2. If the scheduled scanning task is not found, try re-configuring the scheduled task (e.g. make a change in the scheduled scan, then distribute a new policy from the Policy Manager, or save and publish the profile on PSB Portal).
3. Try to execute the scheduled scanning task in Task Scheduler manually and see if it works. If not, the scheduled task is disabled via GPO mostly.
4. For Server Security 12.x and EPP Server Security 12.x, try restarting FSGKHS (F-Secure Gatekeeper Handler Starter) services and verify if the scheduled scanning task works.
5. If you enclose the string with quotes, the scheduled scan will not work. Remove the quotes via the Policy Manager Console, distribute the new policy or EPP profile editor, and save and publish the profile.

Does not work:
"/t18:00 /b2018-8-1 /rdaily"

Works:
/t18:00 /b2018-8-1 /rdaily

6. If the scheduled scanning task can be found in the Task Scheduler Library but is not visible in the application user interface – that is to be expected. Since the task is being configured and scheduled centrally, it is not handled via the end-point protection application, but via Windows Task Scheduler, and in this sense is not configured in the end-point protection application user interface.

Note:

• The Windows operating system is up-to-date.
• Ensure that the host remains ON until the scan completes
• The task itself can be found under the main Task Scheduler Library, the name is only Scheduled Task and Author is F-Secure Corporation.

Issue:

The Software Updater feature in Elements Endpoint Protection and Business Suite Client Security detects several updates as missing even if they have already been installed. After each installation attempt the product shows a restart or reboot request.

Resolution:

This issue needs to be investigated by WithSecure Support. Please enable debug logging and reproduce the issue. Then collect a Wsdiag diagnostic file and attach it to a support case:

1. Open the WithSecure Client user interface on a device
2. Open Settings
3. Go to the Support page
4. Enable "Debug logging helps customer support to analyze issues….")
5. Reproduce the issue
6. Generate new WSDIAG log file by running the WithSecure Support Tool found in the Windows Start Menu
7. Disable Debug (recommended to avoid performance issues) 

Issue:

This article applies to the following WithSecure products: Elements Agent for Mac, Client Security for Mac

WithSecure product is installed on a Mac computer but the user interface shows that computer is not protected and that the real-time scanning is not activated.

Resolution:

After installation of the Mac product on macOS Mojave or later, a red F-Secure (X) icon may appear when running real-time scanning.

This is due to a new security feature, which was been introduced in macOS High Sierra (10.13).
During first time installation, the security feature requires you to allow system software from F-Secure.
Until the software is allowed, real-time scanning will fail.

Once the installation is complete, allow WithSecure software as follows:

1. Go to System Preferences > Security & Privacy, and select the General tab.
2. Click Allow. Once this is done, the icon status changes to normal and the error message disappears.

Note: The steps described must be performed locally on the machine and not remotely.

Full instructions with pictures: https://community.f-secure.com/psb-en/kb/articles/5688-issue-with-real-time-scanning-after-computer-protection-for-mac-installation-on-macos-high-sierra

In case the mentioned solution above does not work, carry out the following solutions one by one and verify if the real-time scanning could be enabled.

Solution 1:

1. Check in System Preferences > Security & Privacy > Privacy > Accessibility and remove or disable 3rd party accessibility software such as the Better Touch Tool or MagicPrefs.
2. Go to System Preferences > Security & Privacy.
3. Select the General tab.
4. Click the Allow button.

Solution 2:

1. Check in System Preferences > Keyboard > Shortcuts > Full keyboard access to enable full keyboard access.
2. Go to System Preferences > Security & Privacy, and select the General tab.
3. Use Tab key to move the focus on the Allow button
4. Press Spacebar on your keyboard while the Allow button is active.

Solution 3:
Add F-Secure Team ID (6KALSAFZJC) to the list of approved kext developers by using "spctl kext-consent add 6KALSAFZJC" command in the Recovery mode.

1) Startup the Mac in recovery mode
2) Click the Utilities menu and select Terminal.
3) Enter the following command:
spctl kext-consent add 6KALSAFZJC
4) Press Enter
5) Close the Terminal app and restart

Refer to the following page for more detail information: 
https://developer.apple.com/library/content/technotes/tn2459/_index.html#//apple_ref/doc/uid/DTS40017658-CH1-TNTAG4

Issue:

The hive.db file under C:\Windows\System32\config\systemprofile\AppData\Roaming\f-secure\HiveRoot -folder is growing. Can it be deleted?

Resolution:

The hive.db file under C:\Windows\System32\config\systemprofile\AppData\Roaming\f-secure\HiveRoot is the cache of our scanning engine for clean files.

The file can be safely deleted, but the F-Secure service needs to be disabled first. Steps as follow:

1. Open the command prompt window in elevated mode
2. Run the command, "net stop fsulhoster" to stop F-Secure Ultralight Hoster service
3. Delete the hive.db file
4. Start back the service with the command "net start fsulhoster"

New hive.db will be repopulated when services are started again.

Note: If Tamper Protection is enabled, you may need to temporarily disable Tamper Protection before attempting to stop the F-Secure services.

Issue:

This article is applicable for the following products: Server Security 12.x, Email and Server Security 12.x, PSB Server Security 12, PSB Email and Server Security.

How to uninstall F-Secure Server products on Windows server using Uninstallation Tool?

Resolution:

Although F-Secure Uninstallation Tool is not supported to be used on Windows server, the tool can be used for special cases with the following instructions.

Important! DO NOT run this tool if you have Policy Manager installed on the same server. It will delete everything including the H2DB database and will cause data loss.

1. Download the tool from here
2. Open Command Prompt (cmd) with Run as Administrator… option
3. Navigate to the folder where you saved the UninstallationTool.exe (e.g. Downloads)

cd C:\Users\<your username>\Downloads

4. Type in the command below to launch the Uninstallation Tool

Uninstallationtool.exe -a --server

5. Follow the instruction on the screen and allow the tool to finish the uninstallation
6. Uninstallation will be done.