{"id":4424,"date":"2026-06-08T17:52:51","date_gmt":"2026-06-08T14:52:51","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4424"},"modified":"2026-06-08T17:52:51","modified_gmt":"2026-06-08T14:52:51","slug":"deepguard-detects-wscript-exe-ieexplorer-exe-winword-exe-explorer-exe-regsvr32-and-excel-exe","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/deepguard-detects-wscript-exe-ieexplorer-exe-winword-exe-explorer-exe-regsvr32-and-excel-exe\/","title":{"rendered":"DeepGuard detects wscript.exe, ieexplorer.exe, winword.exe, explorer.exe, regsvr32, and excel.exe"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>This article applies to the following WithSecure products: WithSecure Client Security, WithSecure Server Security, Elements EPP Computer Protection and Elements EPP Server Protection<\/p>\n<p>I am getting a detection for the following files: wscript.exe, ieexplorer.exe, winword.exe, explorer.exe, excel.exe, and regsvr32.exe by DeepGuard. How can I fix this?<\/p>\n<h3>Resolution:<\/h3>\n<p>Mostly these detections come from DeepGuard (a basic part of WithSecure products which monitors applications to detect potentially harmful changes to the system). The following files are normally clean and each is a legitimate Microsoft file:<\/p>\n<ul>\n<li>\n<pre class=\"ckeditor_codeblock\">\nwscript.exe\nieexplorer.exe\nwinword.exe\nexplorer.exe\nexcel.exe\nRegsvr32.exe<\/pre>\n<p>\tThese legitimate Microsoft files are blocked by DeepGuard because a suspicious file, script or application is trying to run them.<\/li>\n<\/ul>\n<p>When it comes to the business products, in order to investigate further, contact WithSecure support and provide the following:<\/p>\n<ol>\n<li>WSDIAG\u00a0&#8211; You can refer to this <strong><a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31193-how-to-create-or-generate-a-wsdiag-diagnostics-file-on-a-windows-computer\" target=\"_blank\" rel=\"noopener\">KB article\u00a0<\/a><\/strong>for instructions on how to create an WSDIAG log<\/li>\n<li>Possible file or script that you were\u00a0running when you receive the detection.<\/li>\n<\/ol>\n<p>The following is an example case with Microsoft Excel, and how to find out the script which is causing the alert:<\/p>\n<p>Alert shown in Policy Manager Server or Windows Event log:<br \/>\u00a0<\/p>\n<pre class=\"ckeditor_codeblock\">\nDeepGuard blocked an exploit action.\nApplication path: C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\EXCEL.EXE\nFile hash: 6490a5897c31e43393c0feba365a08611340867c<\/pre>\n<p>Locally on that machine, you can check the\u00a0AlertSenderPlugin.log, which contains more detailed information about this:<br \/>\u00a0<\/p>\n<pre class=\"ckeditor_codeblock\">\n[...]\n2019-09-20 09:38:30.426 [1004.2b68] I: ULAVMonitoring::callbackOnOASAlert: Got OAS alert with JSON: {&quot;bookmark&quot;:&quot;PEJvb2ttYXJrTGlzdD4NCiAgPEJvb2ttYXJrIENoYW5uZWw9J0ZTZWN1cmVVbHRyYWxpZ2h0U0RLJyBSZWNvcmRJZD0nMTIxNTknIElzQ3VycmVudD0ndHJ1ZScvPg0KPC9Cb29rbWFya0xpc3Q+&quot;,&quot;rl&quot;:&quot;sp.evt.dg.block&quot;,&quot;rv&quot;:{&quot;AskSample&quot;:0,&quot;Detection&quot;:&quot;Exploit:W32\/OfficeExploitPayload.A!DeepGuard&quot;,&quot;Exploit&quot;:&quot;d:\\\\shared\\\\download\\\\samples\\\\macrotest.xlsm&quot;,&quot;Hash&quot;:&quot;6490a5897c31e43393c0feba365a08611340867c&quot;,&quot;Path&quot;:&quot;C:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\Office16\\\\EXCEL.EXE&quot;,&quot;ProcessID&quot;:17996,&quot;Rarity&quot;:2,&quot;Reason&quot;:10,&quot;Reputation&quot;:1,&quot;SessionID&quot;:1,&quot;tickcount&quot;:2348045081145}}. Extra data size: 0\n[...]<\/pre>\n<p>In this case, alert is caused because of this macro:<\/p>\n<pre class=\"ckeditor_codeblock\">\nd:\\\\shared\\\\download\\\\samples\\\\macrotest.xlsm<\/pre>\n<p>AlertSenderPlugin.log is located here on clients with Client Security 16.x and Elements Endpoint Protection:<\/p>\n<pre class=\"ckeditor_codeblock\">\nC:\\ProgramData\\F-Secure\\Log\\PSB\\AlertSenderPlugin.log<\/pre>\n<p>If the scan does not indicate any harmful files or any suspicious application installed, contact WithSecure support for further assistance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Detection or false positive on wscript.exe, ieexplorer.exe, winword.exe, regsvr32, explorer.exe and excel.exe by DeepGuard<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4424","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013995","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:52:51","import_hash":"46f811971e7fd1b659d43f099458d0ce9a6a57ba","vanilla_article_id":29445,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29445-deepguard-detects-wscript-exe-ieexplorer-exe-winword-exe-explorer-exe-regsvr32-and-excel-exe","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/4424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=4424"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=4424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}