fshoster.exe fs 15:30 IIS & NAS

Neb
Neb W/ Alumni Posts: 2 Security Scout
edited October 2023 in WithSecure Elements Endpoint Detection and Response

Hi, 

we are running fs 15:30 on windows appserver IIS webbapp and a separate NAS serverstorage. IIS operations that move and writes large files, slows down and times out. We uninstalled fs to see if this was the issues. We did the same tests done prior to the uninstallation and found the f-secure was the problem. Now we are trying to find exclusion solutions but fshoster doesn’t seem to care to if deep guard is disabled and an exclusion is made for real-time scan. 

As soon as the iis is running a certain exe f-secure does something without notifying… probably scanning of the large tiff files. The IIS Webbapp operating timesout. 

The only thing that works is if we uninstall F-Secure which is not a good solution. 

Please help us find a solution. 

best regards

Best Answer

  • Sethu Laks
    Sethu Laks W/ Partner, W/ Staff, W/ Moderator Posts: 216 Moderator
    edited March 2023 Solved

    Hi @Neb

    Most often, Web Traffic Scanning scans a large number of network queries. (WTS). Please check to make sure they all appear to point to your IIS web services.

    If yes, could you add them to allow the host list?

    If no or unsure, another option is to try disabling Web Traffic Scanning and other network scanning as they may not be needed in the context of the server.

    WTS.JPG

    Also, you can try disable the Scan Network Drivers for NAS slowness.

    Follow the steps below to de-activate this option on the policy manager console:

    1. Open Policy Manager Console>
    2. Navigate to F-Secure Anti-Virus>Settings>Scanning Option>File Scanning>
    3. Untick the “Enable Scan Network Drives”

    SND.JPG

    Thanks

    Sethu

Answers

  • Neb
    Neb W/ Alumni Posts: 2 Security Scout

    1.

    DeepGuard

    2.

    Real-time Scanning

    3.

    Firewall

    4.

    Browsing Protection

    5.

    Web Content Control

    6.

    Web Traffic Scanning

    7.

    Application Control

    8.

    DataGuard

    9.

    Device Control

    10.

    Software Updater

    11.

    Scan Network Drivers

    Hi,

    We've tried all those points above locally for the applications server ending with all of them turned off and still FS doesn't want to allow the process to run across the end network point.

    The only time the IIS process succeeds is when we end fshoster64.exe manually within the task manager, while simultaneously the executable is being run by IIS, which is trying to write, read and modify on the NAS storage.

    This is very subspinous. Fshoster64.exe is somehow chocking the process which lead to a timeout error. Due to this being a performance issue I haven’t seen and event point to something being blocked. I am guessing an on-access scanning to be still turned running and maybe stuck trying to verify if executable should be giving access, causing huge delays. This has also been observed when a save function is activated the checks that creates backups locally from appdata.

    I’ve created fsdiag and memory dumps for fshoster and concerned executable at that point in time.

    Best Regards

    Neb

  • Sethu Laks
    Sethu Laks W/ Partner, W/ Staff, W/ Moderator Posts: 216 Moderator
    edited March 2023

    Hi @Neb

    Thanks for trying out the provided troubleshooting steps; it would be helpful if you could also submit fresh fsdiag and memory dump logs for further analysis. I see your colleague opened a support case with this reference 04940577 for the same issue, but the case was closed without any further response from your end. Please contact our support team and send us the recently collected logs.

This discussion has been closed.

Categories