To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

FSHoster32.exe is starting up more and more the longer the machine is running

FredrikDevelop
FredrikDevelop Posts: 2 Security Scout
edited June 2024 in Elements Endpoint Protection (EPP)

I have a machine that after a couple of hours running has 19 processes with fshoster32.exe running. the are idle but consumes lot's of memory.

 

What is fshoster32.exe doing?

Why is it starting more and more processes of this ?

 

How can I investigate why ?

Comments

  • PetriKuikka
    PetriKuikka Posts: 236 Threat Terminator

    Hi,

     

    F-Secure hoster has a safety mechanism, that if some plugin registered to it crashes the hoster 2 times in a row, it will spawn each of the plugins to own hosters to make sure that product doesn't stop working totally.

     

    So there is now some plugin constantly crashing on that computer and we would need a  fsdiag file created by the Support tool from that machine to be able to investigate further.

     

    Can you please run the support tool and create a real support ticket with it at https://www.f-secure.com/fi_FI/web/business_fi/support/support-request ?

     

    You can then even post the support ticket ID here, so we can look at it faster.

     

    Petri

  • FredrikDevelop
    FredrikDevelop Posts: 2 Security Scout

    My Case ID:xxxxxx

  • PetriKuikka
    PetriKuikka Posts: 236 Threat Terminator

    Hi,

     

    thank you for the fast reply. We got the fsdiag, but unfortunately it is missing all the crash dumps we expected to be there. We will try to analyze from the logs and the windows event log what is happening and we will contact you once we have more ideas how we can help you or you can help us.

     

    If you reboot the computer it migth go back to just one hoster and stay like that. But I cannot really guarantee it to help.

     

    Petri

  • PetriKuikka
    PetriKuikka Posts: 236 Threat Terminator

    Hi,

     

    we did more analysis on the fsdiag you sent and figured out something really strange in it:

    - based on logs and windows events, it seems that your computer never shutdowns normally, but instead it seems to follow similar cycle when you would do a "hard reset" from power button

    - our hoster has a bug,  that it automatically forks to secure mode, when it detects second hard reset in a row.

     

    So we will be fixing the bug that our hoster does this forking automatically after reset operation.This fix will come in next releases within some month or so.

     

    But it sounds really odd that your computer cannot shutdown / restart normally. Would you have any idea what could be causing this?

     

    Petri

  • Fredrik_N
    Fredrik_N Posts: 8 Security Scout

    This is probably the only machine that is "turned off" on a regular basis othe rmachines only use sleep mode. Is there a way to reset this flag manually ?

  • PetriKuikka
    PetriKuikka Posts: 236 Threat Terminator

    Hi,

     

    this counting is handled by the operating system service information. One way to get it to normal state is to restart the hoster services using administrative account on the computer:

     

    net stop fshoster
    net start fshoster
     
    net stop fsulhoster
    net start fsulhoster 
     
    net stop fsnethoster
    net start fsnethoster 
     
    Petri
This discussion has been closed.

Categories