Issue:

This article applies to the following WithSecure products: WithSecure Client Security, WithSecure Server Security, Elements EPP Computer Protection and Elements EPP Server Protection

I am getting a detection for the following files: wscript.exe, ieexplorer.exe, winword.exe, explorer.exe, excel.exe, and regsvr32.exe by DeepGuard. How can I fix this?

Resolution:

Mostly these detections come from DeepGuard (a basic part of WithSecure products which monitors applications to detect potentially harmful changes to the system). The following files are normally clean and each is a legitimate Microsoft file:

• wscript.exe
  ieexplorer.exe
  winword.exe
  explorer.exe
  excel.exe
  Regsvr32.exe

  These legitimate Microsoft files are blocked by DeepGuard because a suspicious file, script or application is trying to run them.

When it comes to the business products, in order to investigate further, contact WithSecure support and provide the following:

1. WSDIAG – You can refer to this KB article for instructions on how to create an WSDIAG log
2. Possible file or script that you were running when you receive the detection.

The following is an example case with Microsoft Excel, and how to find out the script which is causing the alert:

Alert shown in Policy Manager Server or Windows Event log:
 

DeepGuard blocked an exploit action.
Application path: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File hash: 6490a5897c31e43393c0feba365a08611340867c

Locally on that machine, you can check the AlertSenderPlugin.log, which contains more detailed information about this:
 

[...]
2019-09-20 09:38:30.426 [1004.2b68] I: ULAVMonitoring::callbackOnOASAlert: Got OAS alert with JSON: {"bookmark":"PEJvb2ttYXJrTGlzdD4NCiAgPEJvb2ttYXJrIENoYW5uZWw9J0ZTZWN1cmVVbHRyYWxpZ2h0U0RLJyBSZWNvcmRJZD0nMTIxNTknIElzQ3VycmVudD0ndHJ1ZScvPg0KPC9Cb29rbWFya0xpc3Q+","rl":"sp.evt.dg.block","rv":{"AskSample":0,"Detection":"Exploit:W32/OfficeExploitPayload.A!DeepGuard","Exploit":"d:\\shared\\download\\samples\\macrotest.xlsm","Hash":"6490a5897c31e43393c0feba365a08611340867c","Path":"C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\EXCEL.EXE","ProcessID":17996,"Rarity":2,"Reason":10,"Reputation":1,"SessionID":1,"tickcount":2348045081145}}. Extra data size: 0
[...]

In this case, alert is caused because of this macro:

d:\\shared\\download\\samples\\macrotest.xlsm

AlertSenderPlugin.log is located here on clients with Client Security 16.x and Elements Endpoint Protection:

C:\ProgramData\F-Secure\Log\PSB\AlertSenderPlugin.log

If the scan does not indicate any harmful files or any suspicious application installed, contact WithSecure support for further assistance.

Issue:

This article applies to the following WithSecure products: Policy Manager Server, Policy Manager Proxy

The Client Security failed to download definition updates from Policy Manager Proxy (PMP) and Policy Manager Server (PMS) with "certificate expired" and "untrusted root ca" errors.

Host using PMP
2022-02-01 09:32:21.040 [1454.1a68] I: Checking for updates from https://xxxx.xxxxx.xxxxx.de:488/guts2
2022-02-01 09:32:21.040 [1454.1a68] I: Update check failed, error=221 (certificate expired)

Host using PMS directly
2022-01-31 16:32:22.806 [0f54.1300] I: Checking for updates from https://xxxxx.xxxxx.xxx.de:443/guts2
2022-01-31 16:32:22.884 [0f54.1300] I: Update check failed, error=216 (untrusted root ca)

The problem occurred after updating to Policy Manager Server 15.30

Resolution:

Based on data from the Java KeyStore (.jks) files, the certificates on the Policy Manager Proxy was renewed, however, it was not included in the logs. The CA certificate was updated, however, SCEP certificates were not.

You can delete the SCEP certificates from fspms-ca.jks to fix the issue.

For Policy Manager installed on a Linux host: :

1. Stop the WithSecure Policy Manager service
2. Delete the fspms.jks file
3. Run the following command folder under data folder (/var/opt/f-secure/fspms/data/)

• /opt/f-secure/fspms/jre/bin/keytool -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
• /opt/f-secure/fspms/jre/bin/keytool -delete -alias fspm-ra-signing -keystore fspms-ca.jks

4. Start WithSecure Policy Manager service
5. On the Policy Manager Proxy machine, run the fspmp-enroll-tls-certificate script from /opt/f-secure/fspms/bin/ 

For Policy Manager installed on a Windows host:

1. Stop the WithSecure Policy Manager Server service from services.msc > F-Secure Policy Manager Server
2. Delete the fspms.jks in %ProgramData%\WithSecure\NS\Policy Manager\Policy Manager Server\data  Note: Make a backup of this file
3. Launch Command Prompt as administrator
4. Navigate to %ProgramData%\WithSecure\NS\Policy Manager\Policy Manager Server\data folder in the Command Prompt
5. Run the following command:

• "C:\Program Files\WithSecure\Policy Manager\jre\bin\keytool.exe" -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
• "C:\Program Files\WithSecure\Policy Manager\jre\bin\keytool.exe" -delete -alias fspm-ra-signing -keystore fspms-ca.jks 

6. Start the WithSecure Policy Manager Server service from services.msc
7. Upon launching the Policy Manager Console, you will be prompted to accept the new certificate. You can click Accept to continue
8. Run the fspmp-enrol- tls-certificate.bat script on the Policy Manager Proxy machine.

• (…\F-Secure\Management Server 5\bin\fspmp-enroll-tls-certificate.bat)

Once the steps above are completed, the definition updates should work as expected. 

Issue:

With the firewall enabled in Client Security or Elements Endpoint Protection (EPP for Computers or for Servers), I am unable to reach the network share or printer.

Resolution:

The default firewall rule blocks unknown inbound/outbound connections. Ensure that you have allowed the network traffic in the product firewall to port 135, 137-139 and 445. Whitelist the affected printer IP or port number to the firewall rule.

In case this does not help, we recommend to check the local firewall rules in the Windows Firewall user interface and ensure that there is no potential conflict between WithSecure firewall rules, and local firewall rules.

Issue:

Application blocked by Deepguard as rare application with alert "DeepGuard blocked an application because it is not commonly used" or "DeepGuard blocks a rare application"

Resolution:

If a process has been blocked by DeepGuard as a rare application, please submit the application to our Labs to investigate the file.

Open a ticket by following the Sample Validation service instructions: https://support.withsecure.com/userguides/product.html#business/elements-welcome/latest/en/submitting_a_file_sample-latest-en

As a temporary measure, you can create a DeepGuard exclusion for the blocked process by adding its application hash in the Elements profile: How to create a DeepGuard exclusion for Elements Endpoint Protection? – WithSecure Community 

Issue:

This article is applicable to the following roducts: Business Suite (Client Security, Server Security and Policy Manager) and Elements Endpoint Protection (Elements EPP for Computers and EPP for Servers)

• Is there a way to prevent users from copying data to USB storage devices with the Device Control feature?
• Can Device Control block all USB storage media devices?

Resolution:

1. You can limit or block access permissions for removable drives using Device control. Refer to the following links for instructions:

• Limiting access permissions for removable drives
• Blocking device access using predefined rules
• Getting Hardware ID for a device

2. To find out the hardware ID for a device via the Elements Endpoint Protection, you need to have Device Control enabled and have the device plugged into the system with Elements EPP for Computers installed.

As soon as the product upstream the statistics to Elements Endpoint Protection backend, you can then select the respective device with the product installed under Devices page to find out the device ID, hardware ID and compatible ID.

Note: Device Control can only be configured from the Policy Manager or Elements Endpoint Protection (Profile editor). There is no local configuration on the user interface.

Issue:

Browsing Protection is blocking the Google search results page itself. User receives block alert while navigating the search results without clicking on any specific page.

Resolution:

This appears to be related to new Chrome feature “Preload pages“. Unfortunately we are technically limited and can not improve the functionality. Disabling the Chrome’s Preload pages feature is the only easy way to workaround it. It can be disabled via group policy or registry: Chrome Enterprise Policy List & Management | Documentation

Or, as a workaround, you can try to disable the below setting in Chrome:

1. Navigate to Google Chrome settings
2. Search for "Preload pages"
3. Disable the setting

Issue:

Can users be prevented from disabling or uninstalling the WithSecure Browsing Protection extension from Google Chrome? 
Can this be done from the WithSecure Policy Manager Console for Client Security or from the Elements Endpoint Protection Portal for EPP for Computers? 
 

Resolution:

WithSecure products do not feature a setting to prevent the WithSecure Browsing Protection extension from being disabled or uninstalled by the users from the Google Chrome browser.

Chrome does have an ExtensionInstallForceList which can be used to specify list of apps and extensions which cannot be uninstalled nor disabled by the user. You can learn more about this feature from the Chrome Enterprise Policy List: https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionInstallForcelist

Issue:

If currently the access rights for all the different Elements portals are spread around between several WithSecure Business Accounts with different usernames and email addresses, can these be combined / merged to a one single account that can be used to access all of these services:

• Elements Endpoint Protection portal
• Elements Endpoint Detection and Response portal
• Elements Vulnerability Management portal
• Elements Collaboration Protection
• Partner Portal (for WithSecure reseller partners only)
• Elements Exposure Management

Resolution:

All the access rights to the different portals can be on a single WithSecure Business Account. If a specific user account is missing access rights to a portal, you or one of your colleagues with user management rights can add the user to that portal. When adding a user / administrator with an email address for an existing WithSecure Business Account, it will simply add those user rights to that Business Account. 

How to add user rights to Elements Endpoint Protection and Elements Endpoint Detection and Response portals:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Open the Management section from the menu on the left
3. Go to the Organization settings > Endpoint Protection Accounts page
4. Click on the three dots on the right side of the Accounts title
5. Click Create new administrator
6. Enter the email address of the existing WithSecure business account
7. Click Submit 

How to add user rights to the Elements Vulnerability Management portal:

1. Login to the Elements Security Center portal: https://elements.withsecure.com
2. Open the Elements Vulnerability Management section from the menu on the left
3. Go to the Users tab
4. Click the circle with three dots (…)next to the title Users
5. Select Add user
6. Enter the email address of the existing WithSecure business account

How to add user rights to the Elements Collaboration Protection portal:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Click Management – Collaboration Protection from the menu on the left
3. Go to the Users page
4. Click Add user 
5. Enter the email address of the existing WithSecure Business Account and follow the on screen instructions

How to add user rights to the Elements Exposure Management portal: 

1. Log in to the Elements portal
2. Open the Management section from the menu on the left
3. Go to the Organization settings > Security administrators page
4. Click Add admin
5. Follow the on screen instructions to add Elements Exposure Management rights

Issue:

I have noticed that Software Updater does not reboot the system automatically after installing an update, and system reboot is required to complete the installation. Why is this happening?

Resolution:

WithSecure server solutions are designed to not reboot a server automatically after Software Updater has finished installing an update (and if system reboot is required to complete the installation), despite you have set the Software Updater reboot configuration to either "Ask user" or "Force reboot".

This is an expected behavior for WithSecure server products. We do not want to trigger a system reboot, to avoid potential interruption on a server.

You need to reboot the server manually, to complete the update installation.

Issue:

When exporting a report on the Solutions > Reports page in Partner Portal user gets error:

"An internal error has occurred – An error occurred while processing your request. Our support team has been notified of the issue. If you have additional information that you believe may be helpful as we resolve the problem, please feel free to contact Salesforce Support. Provide the URL of the page you were trying to access, any error ID that appeared on the page, and any other relevant information. We apologize for the inconvenience. "

Resolution:

This issue can happen if your Partner Portal language is set to any other language than English. 

Here are the steps how a Partner Portal admin user can change the portal language for a user:

1. Log in to the Partner portal 
2. Open the drop-down menu by clicking the blue arrow beside your user name in the top-right corner 
3. Go to Account Management 
4. Click Edit Member 
5. Select the member from the list and click Next 
6. Select English from the Language drop-down menu
7. click Save