Issue:

System administrator needs a list of all Withsecure processes and the folders where they are located in a Windows system 

Resolution:

You can create a list of all WithSecure processes and where they are located in a Windows system by following these steps:

1. Open Command Prompt with administrator rights
2. Run the following command below one by one to view list of .exe files in WithSecure application folders.

dir "C:\Program Files (x86)\F-Secure\*.exe" /s /b
dir "C:\ProgramData\F-Secure\*.exe" /s /b

This will create you an easy to read list.
 

Issue:

Windows 7 SP1 and Windows Server 2008R2 MUST be patched with KB4474419 to maintain protection due to changes made by Microsoft related to driver signing. 

If patch KB4474419 is not installed, the F-Secure client will fail to install updates and request for restart / reboot.

The product user interface will show a different status, depending on if you are using a for home or business F-Secure product:

• Business products, such as Client Security, Server Security and Server Protection, will show "Computer is not protected" status.
• For home products, such as SAFE and Internet Security, will show "You are not protected" status.

Resolution:

Due to changes made by Microsoft related to driver signing, Windows 7 SP1 and Windows Server 2008R2 will require a patch to be installed, in order for our drivers to protect these computers.

Most devices will have already received this patch, as it was released as a Security update by Microsoft in March 2019, and should have been automatically applied. However, some customers maintain their Windows Updates separately, and they should immediately ensure they have the patch from KB4474419 applied. Failure to do so will prevent F-Secure and WithSecure clients from functioning correctly.

For customers who use Software Updater, an optional part of our endpoint protection clients, this patch is available as "2019-09 Security Update for Windows 7 for x64-based Systems (KB4474419) 6.1.7601"

Newer Operating Systems, and Windows 7 SP1 or Windows Server 2008 R2 that have this patch installed are not affected, and the clients will continue to function normally.

Please note that this also affects software products from vendors other than F-Secure and WithSecure as well, if those products contain drivers signed by Microsoft.

Issue:

Is it possible to do tracking or monitoring of user web activity with WithSecure Endpoint Protection product? Such as bandwidth usage or which web pages users have visited?

Resolution:

Due to privacy laws, WithSecure Endpoint Protection products do not store a user's private activities, such as web pages the users have visited or how much bandwidth they are using. 
 

Issue:

A workstation's or server's files have been encrypted by ransomware. How do I decrypt them and get access back to my files?

Resolution:

A ransomware infection typically distributed through a few ways such as phishing email (common way to infect), infected USB drive, unsecured public Wi-Fi networks, exploitation of zero-day vulnerabilities, pirated software, and covert drive-by downloads from a malicious website.

We recommend having both DeepGuard and DataGuard security features enabled for protection against traditional and modern ransomware attack. 

For ransomware attack assistance, we suggest you to contact our Emergency Incident Response team on this page.

https://www.withsecure.com/en/about-us/company-contacts/24-7-incident-hotline

To help us investigate the issue further, please provide the following information:

1. Detailed Description and timeline of the event [When did this exactly happened?]
2. Sample [Please provide us the sample of the suspicious file. Without this sample, we won’t be able to investigate the request further.]
3. WSDIAG [End-Point logs] depending from the OS version:
   • Windows: https://community.withsecure.com/en/kb/articles/31193-how-to-create-or-generate-a-wsdiag-diagnostics-file-on-a-windows-computer
   • Mac:https://community.withsecure.com/en/kb/articles/31222-how-do-i-generate-wsdiag-diagnostic-logs-on-withsecure-mac-products
   • Linux:https://community.withsecure.com/en/kb/articles/31376-can-withsecure-endpoint-protection-clients-detect-malware-for-linux
4. Autoruns
   1. Download the tool from https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
   2. Please remember to enable the "Hide Signed Microsoft Entries" setting.
   3. Save the log file created as an .arn file to your Desktop.
5. Process Explorer
   1. Download tool from http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx and extract the zip file.
   2. Run procexp.exe with administrator privileges.
   3. Click on File > Save and save the file as "procexp.txt" in your desktop.
6. After generating the logs, please upload them via FTP as follows:
   1. Rename the WSdiag.zip file on your desktop.
   2. Right-click on the file and select Rename [Your case number here] _WSdiag.zip.Right-click the 
   3. Windows Start icon and select Open Windows Explorer. A Windows Explorer window opens.
   4. Type ftp://ftp.withsecure.com/incoming in the address bar, and press Enter. Note: After uploading the file, the file is no longer visible.'
   5. Please reply to the incident case inform us that you have now uploaded the Wsdiag file.

Issue:

How to order evaluation (trial) license for a new customer in the WithSecure Partner Portal

Resolution:

Follow these steps to create an trial / evaluation order for a new customer account in the WithSecure Partner Portal.

New Partner Portal:

1. Log in to the Partner Portal
2. Click on the Visit New Partner Portal button on the Home page
3. Navigate to Sales > Account 
4. Choose the customer account from the list
5. Open the Trials tab within the account view 
6. Click New Trial 
7. Define the Customer Contact and click Next 
8. Select the products from the trial (pay attention to the Managed by column, a trial can be Company or Partner Managed) and click Next
9. Check and confirm the trial details and click Save

Old Partner Portal:

1. Log in to your Partner Portal account
2. Click Ordering and select Yearly
3. Click New Order
4. In the Search or add customer, enter your customer account. Note: If the account is not exist, click Add new in the search result.
5. Fill in the customer information and click Save
6. Click Add Products > Evaluation. Note: Evaluation products will be added with 90 days license term
7. Choose the product, click Continue
8. Enter your reference number (This value would be your own reference)
9. Click Continue
10. Click Order to finish the ordering

Issue:

This article describes the steps to generate wsdiag debug, also known as full logging, logs for Elements EPP for Computers, Elements EPP for Servers, Client Security 16 and Server Security 16 or later.

Debug diagnostic logs are needed in some instances by technical support to investigate problems in more detail.

Resolution:

When full debug logging is enabled, an wsdiag will gather more in depth and additional log files, which help in some problem investigations. 

Debug logging can be enabled directly from the WithSecure user interface in the following products: Elements EPP for Computers, Elements EPP for Servers and Client Security 16 and later.

Steps how to enable advanced debug logging (full logging) locally on a Windows device: 

1. Open the WithSecure product user interface
2. Select Settings (Cogwheel icon)
3. Select Edit settings
4. Click Yes on User Account Control prompt (provide admin credentials if requested)
5. Select Support
6. In the Tools section, enable debug logging by tapping the On/Off switch below Debug logging helps customer support to analyze issues.
7. Reproduce the steps that caused the original problem, take note of exact time of the problem
8. Generate an WSDIAG diagnostic file by following the steps explained in this link: How to create or generate a WSDIAG diagnostics file on a Windows computer? – WithSecure Community
9. Open the WithSecure product user interface
10. Select Settings (Cogwheel icon)
11. Select Edit settings
12. Click Yes on User Account Control prompt (provide admin credentials if requested)
13. Select Support
14. In the Tools section, disable debug logging by tapping the On/Off switch below Debug logging helps customer support to analyze issues.

Debug logging can also be enabled for Elements Agent devices using the Elements Security Center by selecting the device on the Environment > Devices page and then selecting Diagnostic operations > Turn on debug logging from the Actions menu. 

In case the option described above are not available, follow the steps below:

1. Download the debug tool from https://download.withsecure.com/support/tools/CCF-logging-tool/fsloglevel.exe
2. Double click fsloglevel.exe
3. Select Full Logging
4. Click OK
5. Restart the computer
6. Reproduce the steps that caused the original problem, take note of exact time of the problem
7. Generate an WSDIAG diagnostic file by following the steps explained in this link: How to create or generate a WSDIAG diagnostics file on a Windows computer? – WithSecure Community
8. Run the fsloglevel.exe tool a second time after submitting the logs
9. Click on Normal Logging to turn off the debug mode (debug mode slows down the machine slightly)

Issue:

How to configure Kaseya VSA agent to retrieve read-only status information from WithSecure client applications such as Elements Endpoint Protection, Computers Edition or Client Security. 

Resolution:

Our Help Guides include all of the information required to configure supported Windows Management Instrumentation (WMI) integrations for WithSecure Business Products. 

Using WMI you can retrieve information such as: Product version, Real-Time Scanning status, Malware definition database information, Firewall status etc.

For Business Suite's Policy Manager, the guide for WMI configuration can be found at https://help.f-secure.com/product.html#business/policy-manager/14.20/en/concept_E8B1C2F45269429D84CA9F073FF6D491-14.20-en 

For Elements Endpoint Protection (formerly PSB), the guide for WMI configuration can be found at https://help.f-secure.com/product.html#business/psb-portal/latest/en/concept_E8B1C2F45269429D84CA9F073FF6D491-psb-portal-latest-en

Issue:

• RDP Brute Force attack performed and Ransomware encrypted system or files
• Technique commonly used by Crysis, Dharma, GandCrab ransomware.

Resolution:

• Use strong and long passwords
  • To avoid brute force attack on RDP, avoid using Dictionary word and simple password. Always use long password with combination of Uppercase letters, Lowercase letters, numbers and special characters.
• Limit number of attempts
  1. Go to Start–>Programs–>Administrative Tools–>Local Security Policy
  2. Under Account Policies–>Account Lockout Policies
  3. Account lockout threshold -> Set between 3 to 5
  4. Account lockout duration -> Ideally set more than 5 minutes

• Only allow user accounts requiring RDP service

1. Go to Start–>Programs–>Administrative Tools–>Local Security Policy
2. Under Local Policies–>User Rights Assignment–>Allow logon through Remote Desktop Services
3. Add or Remove the User accounts or groups which require RDP service

• Close RDP port
  • Use VPN connection to access remote desktop and close RDP ports (TCP 3389) access  via firewall.
• Use RD gateway servers
  • RD gateway proxy servers can be used for securing the connection with SSL.
  • Read more here : https://social.technet.microsoft.com/wiki/contents/articles/10974.windows-server-2012-rds-deploying-and-configuring-rd-gateway.aspx

Issue:

How to troubleshoot Security Cloud connectivity issues. 

This article applies to the following products:

• Elements EPP for Computers
• Elements EPP for Servers 
• Business Suite Client Security 
• Business Suite Server Security

Resolution:

• DeepGuard with cloud connection:

• DeepGuard with no cloud connection:

• Application control with cloud connection:

• Application control with no cloud connection:

• File scanning with cloud connection:

• File scanning with no cloud connection:

• Browsing protection with cloud connection:

• Browsing protection with cloud connection:

• Web Traffic Scanning with cloud connection:

• Web Traffic Scanning with no cloud connection:

• *.f-secure.com
• *.fsapi.com

1. Open a Command prompt with administrator priviledges
2. Stop the network hoster: net stop fsulnethoster
3. Remove all files from "C:\Windows\ServiceProfiles\NetworkService\AppData\Local\F-Secure\fsscor"
4. Start network hoster: net start "fsulnethoster

• Opening the URLs on Browser and they should respond with ok

• Use WithSecure Connectivity Tool, which is available in the installation folders of Elements Endpoint Protection (EPP for Computers and EPP for Servers), Business Client Security and Business Suite Server Security. With the tool you can view the list of addresses the product connects to and check the connectivity towards them.

Note: For Client Security the tool is available in 15.20 and later versions, and for Server Security 15.10 and later. 

The tool is located in the following folder:

• Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
• Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
• Elements EPP for Computers and EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\fsconnectionchecker.exe

 For older Client Security and Server Security releases, you can download the tool from here: https://download.sp.f-secure.com/connectivitytool/ConnectionChecker.exe

What logs do should be checked in case of such behaviour?

fsscorplug.log
.W: fs::rs::WinSocket::Impl::waitForConnection: Wait failed: 258
.W: fs::rs::WinSocket::Impl::connect: Conection timeout: doorman.sc.fsapi.com

CcfPluginState.log
.W: Filter2::ContentFilter2State::ReplyDriverMessage: Failed to reply message 2222

orspplug.log
.W: fs::rs::WinSocket::Impl::waitForConnection: Wait failed: 258
.W: fs::rs::WinSocket::Impl::connect: Conection timeout: doorman.sc.fsapi.com

DeepGuard.log
.W: SecurityCloud::Query: ORSP failed for 0dac68816ae7c09efc24d11c27c3274dfd147dee (0, 0)
.W: SecurityCloud::Query: Too many successive ORSP failures. Further failure logs will be suppressed
.W: SecurityCloud::Query: ORSP query took 3016ms

transportAgent.log (Email and Server Security only)
.W: FSecure.Ess.Fsscore.Client: FSSCORE query for URL('http://schemas.microsoft.com/office/2004/12/xxxx') Failed, error=Timeout 
.W: FSecure.AntiVirus.Exchange.Transport.FSMessageScanner: Can't get a response from FSSCORE. The following URLs will not be scanned 

Issue:

How to enable or disable multi-factor authentication for a WithSecure Business Account?

Resolution:

To enable multi-factor authentication:

1. Go to https://elements.withsecure.com
2. Log in with your Email address (or username) and password
3. Click on the user icon (top-right corner)
4. Select My Settings
5. Click Enable from the right side of the Multi-Factor Authentication disabled notification
6. Click Add to select which type of multi-factor authentication you want to use (multiple can be added)
7. Follow the on-screen instructions

We recommend to enable multiple multi-factor authentication options as a backup. If your only multi-factor authentication option is lost, there is no way to reset the multi-factor authentication. If all multi-factor authentication options are lost, the account would need to be re-created. 

Please refer below announcement for Multi Factor Authentication (MFA) enforcement for WithSecure Business Account ;

https://community.withsecure.com/en/kb/articles/31293-withsecure-business-accounts-multi-factor-authentication-enforcement

It is now not possible to disable MFA permanently however should you need to temporarily disable the MFA you may follow below steps (once you logged in and logout, do take note, if you were to re-login back you need reconfigure the MFA as it is compulsory to use MFA now)

To disable multi-factor authentication:

1. Go to https://elements.withsecure.com
2. Log in with your Email address (or username) and password
3. Enter your multi-factor authentication code and click Continue
4. Click on the user icon (top-right corner)
5. Select My Settings
6. Click Change from the right side of the Multi-Factor Authentication enabled notification
7. Click Remove on the right side of all the multi-factor authentication methods you want to disable
8. Enter your email address and password