Issue:

Browser is showing strange behavior. R&D needs to get debug file from browser.

Resolution:

Google Chrome

1. In the browser, at the top right, choose Customize and control Google Chrome.
2. Pause on More tools, and then choose Developer tools.
3. With DevTools open in the browser, choose the Network panel.
4. Select the Preserve log check box.
5. Choose Clear to clear all current network requests.
6. Reproduce the issue.
7. In DevTools, open the context (right-click) menu on any network request.
8. Choose Save all as HAR with content, and then save the file.

Ref: Open Chrome DevTools / Save all network requests to a HAR file.

Steps to create HAR file when using Firefox:

1. Open Firefox browser and go to the application web page where the issue is occurring
2. Select the Firefox menu (three horizontal parallel lines) at the top-right of your browser window, then select Web Developer > Network
3. The recording auto starts when you start as a docked panel at the side or bottom of Firefox. Click the Network tab
4. Log in to the application and reproduce the issue that you were experiencing before and reproduce the issue you were experiencing before. After the issue has been replicated and you’ve ensured all of the actions have been generated in the Developer Network Panel (should just take a few seconds), right-click anywhere under the File column and click on Save all as HAR
5. Save the HAR file somewhere convenient

Issue:

How do I identify and remove the infected item(s) WithSecure has detected on a .PST archive (Outlook Data File)?

Resolution:

Follow the steps below to configure the scanning report to show additional information when an email is detected inside an Outlook PST file.
These steps will help you to identify the email so that it can be removed manually after the scanning:

1. Open the Registry Editor (regedit.exe)
2. Navigate to the following location:
   1. HKEY_LOCAL_MACHINE\SOFTWARE\F-Secure\Ultralight\GKH2\Plug-Ins\F-Secure Capricorn
3. Add a new 'String Value' (REG_SZ) with the following information:
   1. Name: CustomSettings
   2. Data: mailboxmode=2
   3. Other scanning modes available are:
      1. 0 = none (default, mailbox is not scanned)
      2. 1 = enable mailbox scanning
      3. 2 = enable scanning and provide extended report (inside infection name)
4. Restart the "F-Secure Ultralight Hoster" service:
   1. net stop fsulhoster
   2. net start fsulhoster
   3. (If you are unsure on how to restart a service, just restart the computer)
5. Manually scan the PST. The report will now show message-related fields (email subject, folder, attachment name)
6. Once the message has been identified, proceed to remove it manually in Outlook:
   1. Delete the message with [shift-del] (so that it will not be moved to trash).
   2. Finally follow these steps to compact the PST database:
      https://support.office.com/en-us/article/reduce-the-size-of-your-mailbox-and-outlook-data-files-pst-and-ost-e4c6a4f1-d39c-47dc-a4fa-abe96dc8c7ef?ui=en-US&rs=en-US&ad=US
   3. Re-scan the .PST archive to ensure all infected items have been removed.

Issue:

How to collect the quarantined files on an affected Windows machine using WithSecure Quarantine Dumper, and then submit the files for analysis. 

Resolution:

Collect quarantined files using WithSecure Quarantine Dumper by following the instructions below:

1. Click on this link to download  to a location of your choice, for example, c:\temp:
   • 32bit version: https://download.withsecure.com/support/tools/wsdumpqrt/wsdumpqrt.exe
   • 64bit version: https://download.withsecure.com/support/tools/wsdumpqrt/wsdumpqrt64.exe
2. Launch Command Prompt (CMD).
3. Navigate the directory to the location you selected in step 1. For example, type cd c:\temp\ and press Enter on your keyboard to go to c:\temp\ folder.
4. Type wsdumpqrt.exe -d c:\temp\ to run the tool.
5. Enter your administrator credentials when prompted. WithSecure license terms are now shown.
6. Scroll all the way to the end of the license terms before you can accept them.
7. Press E on your keyboard to accept the license terms.
8. Press any key to complete the run. The quarantined files will be collected in a file named malware_samples.zip with the default password (infected) in the location you specified in step 1. 

These are the parameters that can be used in the tool:​

• -d, –destination: Destination directory for output (default: current admin desktop)
• -p, –password: Password for output (default: "infected")
• -v, –verbose: Verbose output
• -a, –accept-eula: Accept EULA
• -s, –silent: Silent mode
• -l, –list: Only list contents, nothing is written to disk

Tip: Running the wsdumpqrt.exe tool in command prompt without additional command line parameters will print out a short tool description and the extra parameters for using the tool.

Issue:

Getting an error of "Your login to WithSecure™ Partner Portal failed. Please try using a different browser, or you can open a support ticket at: https://www.withsecure.com/en/support " when logging into Partner Portal.

Resolution:

This error message appears typically when user has an existing WithSecure user account, but that account does not have the access rights on it for the Partner Portal. If you have several user accounts, it could be that you are for example logged in to Elements portal with an account that doesn't have Partner Portal access rights. If you then in the same session try to log in to Partner Portal, it will automatically try to log in with the account you are logged in with in Elements portal. Try to therefore close the browser window or open an incognito window before trying to log in again. 

If you do not have Partner Portal access rights and you need them, an existing user with Partner Portal administrator access rights can add you as a user: https://community.withsecure.com/en/kb/articles/32823-adding-new-users-to-the-partner-portal

If you have been given Partner Portal access rights and received the Welcome email but you are still unable to login to the portal:

• If you have no WithSecure user account (for example Elements Endpoint Protection, Collaboration Protection or Vulnerability Management user account) from before, make sure you have created one using the registration process from the Welcome email you have received. The registration email is sent from crm-admin@withsecure.com. The account can be created from the following page if you already have received the welcome email https://portal.withsecure.com/signup Use the same email address that you used to request the access rights.
• If you have had a WithSecure user account from before and now receive this error message when logging in to Partner Portal after receiving the Welcome email, open a support request so that we can check the status of your account's user rights. 
• If you have several WithSecure user accounts, try to open an incognito / inprivate window in your browser and then try to log in again. 
• if you have a network wide ad-blocker active (e.g. Pi-Hole), this is known to cause problems for the login. Try disabling or bypassing this solution.

If you do not receive the Welcome email in your Inbox, please check your spam/junk email folder as it could be filtered by accident and if there is any rule to move mail from subfolders in Outlook.

Issue:

• DeepGuard blocks an application. This was determined to be a high-risk application by system control heuristics. 
• After the file SHA-1 hash and file path is excluded in WithSecure Client Security or Server Security DeepGuard feature continues to block the application

Resolution:

You can exclude the network drivers from being scanned, by doing the following:

1. Log into Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Click on Settings
4. Select Standard view
5. Select Real-time scanning
6. Scroll down to Files and applications excluded from scanning
7. Select Do not scan the following files and applications
8. Click Add
9. Enter the full path for each files, folder or SHA-1 of the application. Example:

• Select File path if the file that you want to exclude always uses the same path.
• Select Folder path if you want to exclude all files in a specific folder.
• Select Application SHA-1 if the path for the file that you want to exclude may vary across different hosts.

NOTE:
If the file or folder is located in share drive, you need to add the exclusion in UNC format.
Example:
\\servername\share\folder\to\the\app.exe

If this location is also mapped to a drive letter (e.g. N:\), then another exclusion must also be added in the mapped format as the following:
N:\folder\to\the\app.exe

For more information on using wildcards in exclusions, refer here
       
        10. Click the icon to distribute the policy (Ctrl + D)

Issue:

How can a reseller partner decrease or increase the number of licenses for an existing renewable (yearly) subscription in the Partner Portal?

Resolution:

A reseller partner can only decrease the number of licenses within the renewal window = 90 days from the license expiry date. 

License amount increase can be done by following these steps: 

1. Open the Sales tab from the main menu and go to Accounts 
2. Select the customer account
3. Go to the Deal Ordering & Subscriptions tab and click Amend Contracts
4. Select Amend Subscriptions and click Next
5. Select the contract that will be amended and click Amend next to the contract you want to amend
6. Set the Amendment Start Date (by default start date is today, can be set to 31 days in the future)
7. Select Contract for the amendment
8. Verify that you are opening the correct contract for amendment, proceed by clicking Amend (the quote will appear)
9. Click on the pen icon next to the Quantity field and enter the new quantity
10. Click on the Quick Save button to apply the changed on the quote line data
    1. Effective Quantity column shows the increase or decrease of the number of seats. In essence: How many seats are added to the subscription with this amendment
11. Click Save to save the amendment quote
12. Click Generate Order 
    1. Before generating an order from a quote, double-check that the products, quantities, and pricing are correct and as intended

License amount decrease: 

1. Open the Sales tab from the main menu and go to the Renewal Center
2. Select the customer from the list and click Renew + Modification 
3. Enter the new license Quantity and click Quick Save to update the quote 
4. Click Save to save the quote
5. Make sure the amount and price are correct and then click Generate Order 

Issue:

How can a reseller partner decrease or increase the amount of licenses for an existing Evergreen (SaaS) subscription?

Resolution:

It is possible to decrease or increase the amount of licenses for an existing SaaS subscription in Partner Portal by following the steps below.

1. Open the Sales tab from the main menu and go to Accounts
2. Select the correct customer account from the list
3. Go to the Deal Ordering & Subscriptions tab and click Amend Contracts
4. Select Amend Subscriptions and click Next
5. Set the Amendment Start Date (by default today. Can be set up to 31 days in future)
6. Select Contract for the amendment and click Next 
7. Verify that you are opening the correct contract by clicking Amend (Quote will open)
8. Click Amend Products to proceed with quantity change 
9. Select the Amend option to change quantities of subscriptions (you can increase of decrease)
   1. If you are reducing the quantity of licenses, the updated monthly contract value will take effect on the 1st day of the next month
   2. If contract value remains the same or increases after the amendment, the change will take effect immediately and if done mid-month, proration is applied on pricing
10. Update the new intended quantity for the subscription on the Quantity field and click Quick Save to view the changes
11. Click Save to save the quote
12. Click Generate Order to make the order

Issue:

This article applies to the following WithSecure products:

• WithSecure Elements Agent (EPP for Computer or EPP for Servers)
• WithSecureBusiness Suite (Client Security or Server Security)

How do I uninstall an WithSecure business product via a GPO uninstallation?

Resolution:

You can follow the steps below to uninstall client software with an Active Directory Group Policy Object

1. On the Windows Taskbar, click Start > All Programs > Administrative Tools > Group Policy Management.

   The version of Windows that you use may display Programs instead of All Programs in the Start menu.

2. In the Group Policy Management window, in the console tree, expand the domain, expand Computer Configuration, expand Software Settings, right-click Software Installation, and then click Properties.

3. On the Advanced tab, check Uninstall this application when it falls out of the scope of management, and then click OK.

4. In the right pane, right-click the software package, and then click Remove.

5. In the Remove Software dialogue box, check Immediately uninstall the software from users and computers, and then click OK.

6. Close the Group Policy Object Editor window, and then close the Group Policy Management window.

   Note: The software uninstalls when the client computers are restarted.

Issue:

Elements EDR and EPP for Computers (mac OS) or Client Security for Mac shows the following alert notifications: 

• Allow Full Disk Access for full protection
• The computer is not protected

The error remains even if Full Disk Access rights have been given.

Resolution:

You will need to do the following to allow WithScure Elements EPP with EDR for mac/Client Security for mac to scan the computer and allow the program to work again:

1.     Go to System Preferences (Apple logo menu from top left corner)
2.     Click Security and Privacy
3.     Click Privacy
4.     Select Full Disk Access on the left pane
5.     Click the Lock in the bottom-left corner to make changes, and login with your Mac password (if prompted)
6.     Tick the box next to WithSecure Elements Agent and WithSecure System Extenstion on the list
7.     Click the Lock again to prevent further changes

If the issue persists using the latest build version, contact Technical Support and submit a diagnostic file (FSDIAG) for further investigation.

Issue:

A DeepGuard Security alert is sent to the Elements Endpoint Protection portal's Security events list or Policy Manager Console's Alerts list.

Example: 

Security alert: DeepGuard prevented an untrusted application from modifying another process.
Details: DeepGuard prevented an untrusted application from modifying another process. Application path: C:\Program Files\exampleprogram\examplefile.exe File hash: 2179dde55137b4a228135af0b45acc7752e13e15

Can this be a false positive and can the file be excluded? 

Resolution:

DeepGuard is equipped with a self-protection feature where it prevent any process from terminating WithSecure's processes. DeepGuard monitors the OpenProcess function, which is used by the program to access the WithSecure process information with a termination rights.
 
When DeepGuard detects that the program is trying to open a WithSecure process with the PROCESS_TERMINATE flag, it shows a block message and removes the flag, preventing the ability of the program from terminating the process.

This alerts will not affect the functionalities of the accessor program as DeepGuard only removes the termination rights, hence made the OpenProcess called more safe towards WithSecure processes.

If you want to make sure it is not a false positive, you can open a submit a sample ticket.

If you are absolutely sure it to be a false positive and you do not want to have the alert shown, as a workaround you can exclude the program directly by using its path + filename or by excluding the SHA1 value shown in the alert. 

Follow these steps to add an exclusion:

For Business Suite (Client Security and Server Security) using Policy Manager policy:

1. Log in to the Policy Manager Console
2. Select a policy domain or host from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning settings
5. Scroll to the Files and applications excluded from scanning table and enable Do not scan the following files and applications 
6. Click Add
7. Set the scope as All scans and select File path from the drop-down menu
8. Add the file path C:\Program Files\Exampleprogram\examplefile.exe and click OK
9. Distribute the policy (Ctrl + D)

For Elements Endpoint Protection (EPP for Computers and EPP for Servers) using portal profile:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Choose the profile which the device is using
5. Go to the General settings page
6. Scroll down to the Exclude folders and files from all security scans section and click Add exclusion
7. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
8. Click Save and publish

The SHA-1 can also be added manually to the DeepGuard protection rules. Follow the steps below to manually add an SHA-1 exclusion in DeepGuard:

1. Log in to the Elements portal
2. Open the Security Configurations section from the menu on the left
3. Select the Profiles tab on the left
4. Select the profile you want to add the exclusion to
5. Select Real-time scanning on the left
6. Scroll down to DeepGuard protection rules
7. Click on Add rule
8. Fill in the SHA1-hash and a note about the application
9. Click Save and Publish