Workarounds for excluding specific PaperCut executables from anti-virus suites

We are aware of certain PaperCut software executables being incorrectly flagged by anti-virus software vendors such as, but not limited to: AVG, G DATA, IBM QRadar, McAfee, Norton, Symantec, Trend Micro and Windows Defender / Security.

The following files have been previously known to prompt anti virus warning messages:

  • [app-path]\PaperCut NG/MF\providers\print-deploy\win\pc-updater.exe
  • [app-path]\PaperCut NG/MF\providers\print-deploy\win\[update version]\client-update-macos.zip
  • pc-job-ticketing-latest.exe
  • NG’s v16.4 release on Windows (pcng-setup-16.4.39159.exe)

Mobility Print

There have been some reports of Mobility Print service issues whereby the service may go offline with limited information available on the cause. In most cases, this is due to the antivirus software on the Mobility Print server.

Windows

On the server

  • C:\Program Files (x86)\PaperCut Mobility Print

Print Deploy

In order for Print Deploy to auto-update regularly, the following two files need to be added as an exclusion if flagged by an antivirus vendor; pc-updater.exe on Windows and client-update-macos.zip on macOS.

Windows

On the server

  • [app-path]\providers\print-deploy\win

On the client (only if deploying Print Deploy clients onto users’ computers)

  • %LOCALAPPDATA%\AppData\Local\PaperCutPrintDeployClient
  • C:\Program Files\PaperCut Print Deploy Client

macOS

On the server 

  • /PaperCut MF/providers/print-deploy/darwin

On the client (only if deploying Print Deploy clients to users’ computers)

  • ~/Library/Application PaperCutPrintDeployClient
  • /PaperCut Print Deploy Client/

Linux

On the server

  • [app-path]\server\bin\win\providers\print-deploy\darwin

Job Ticketing

The pc-job-ticketing-latest.exe auto-updater is flagged as dangerous when attempting to install the latest version of Job Ticketing. To prevent this, add a file whitelist location for: [app-path]\Program Files\PaperCut MF\job-ticketing\

PaperCut NG v16.4 installation on Windows

The NG installer link here and more specifically pc-direct-print-monitor-16.4.39159 from our past versions page are flagged as a “Trojan:Win32/Vigorf.A” in Windows Security.

How to identify

Opening the v16.4 NG installer will be blocked by Windows Security.

Workaround

  1. Open the “Virus & threat protection” applications on a Windows machine.
  2. From that window you will see a threat blocked and a timestamp. Click on the drop-down where it says “Severe” and then “Actions” followed by “Allow”.



Once complete, re-download the installer and install as normal.


Q How do I report a false positive for PaperCut’s software products?

Certain antivirus apps will allow the user to submit potential false-positives directly with them. Feel free to do so and then us with the following details:

  • The relevant file that is being flagged.
  • The Antivirus app name.
  • The error message and virus type (no harm in providing us a screenshot here)
  • Any other details you feel are relevant

Still have questions? Let us know! We love chatting about what’s going on under the hood. Feel free to leave a comment below or visit our Support Portal for further assistance.


Categories: Security and Privacy

Keywords: antivirus, whitelist, blacklist, flagged, AVG, G DATA, IBM QRadar, McAfee, Norton, Symantec, Trend, Trend Micro, Windows Defender, Windows Security.

Comments