DeepGuard notifications for closing applications

Jsten_57

We use F-Secure Elements EPP Premium V 22.1 for virus and malware protection.

Many computers in our office are getting multiple notifications through-out the day noting it has closed an application. It varies between cmd.exe, svchost.exe & powershell.exe. The notifications typically come in groups of three for the cmd.exe. See image below.

I have scanned for malware and virus and not threats have been detected. I would like to know what would be causing the closing of these applications and if they'd be OK to be excluded. Nothing seems to be affected on the computers including any software.

We do use Revit and other AutoDesk software daily that requires a license verification online. It does seem to correspond to when we installed Revit 21 & 22 on our computers.

Any help would be appreciated.

MonikaL

Hi,

If DeepGuard has blocked a safe application (a false positive), then we recommend to submit the sample file to our Labs so that we can analyze the file and correct the detection if necessary. You can open a Labs ticket here: https://www.f-secure.com/en/business/support-and-downloads/submit-a-sample

If you are sure that the detection is a false positive, you can create a DeepGuard exclusion to immediately get the application working again. How to centrally create the exclusion depends on if you are using Business Suite or Elements Endpoint Protection. For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.f-secure.com/
2. Click the See more details link under the product category Endpoint Protection
3. Go to the Profiles page
4. Choose the profile which the device is using
5. Go to the General settings page
6. Scroll down to the Exclude folders and files from all security scans section and click Add exclusion
7. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
8. Click Save and publish

Alternatively, the DeepGuard exclusion rule can be also added using the Security events page:

1. Log in to the Elements Endpoint Protection portal 
2. Go to the Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Exclude folders and files from all security scans list
5. Click Save and publish

On all products, to locally allow an application that DeepGuard has blocked:

1. Open the F-Secure program
2. Click Settings
3. Under the Malware Protection tab, click View quarantine
4. Go to the Blocked tab
5. Select the application that you want Deepguard to allow to run
6. Click Allow
7. Click Close

Note: To prevent it from happening again in the future, please inform our Labs about the blocked application.

MikaArasola

In terms of exclusions, I would maybe highlight that if you end up doing the exclusions then you should do it for Autodesk / Revit rather then powershell / cmd / svchost since all there of these latter ones are commonly used for spreading malicious files.