topic Re: EFR Service monitoring variable DLL files in Endpoint

EFR Service monitoring variable DLL files

SWBW_Florian — Thu, 10 Apr 2025 07:25:32 GMT

hey,

our ERP System is creating temporary DLL files in users TEMP directory while navigating to an printpreview window of any datasheet.

this DLL file (temporary, name by coincidence) is watched by EFRService. I can see the monitoring through resmon.exe

unfortunately, sometimes the exclusive access during monitoring takes too much time, so the ERP application cant access the file as it wants to. Its not trying it again, so it fails. if the user is retrying the print-process it works usually.

i need to exclude those files from monitoring. But i dont know how. They are not signed by any certificate and do have flexible names while they are saved in users TEMP directory

how could i manage this?

Thanks for any hint

regards

Florian

Re: EFR Service monitoring variable DLL files

PhoneBoy — Thu, 10 Apr 2025 12:20:21 GMT

Generating random DLL files in a temp directory and they’re not signed?
Not sure you can do that without excluding the temp directory (which is probably a bad idea).

Re: EFR Service monitoring variable DLL files

SWBW_Florian — Fri, 11 Apr 2025 05:46:32 GMT

yes, thats how microsoft is working, obviously ...

we wont exclude the whole TEMP folder. That behaviour is shown on *all* Office PCs ...

there must be a workaround, right?

Re: EFR Service monitoring variable DLL files

PhoneBoy — Fri, 11 Apr 2025 20:28:27 GMT

TAC might have something, but without a unique way to identify those files, I suspect you're in RFE territory.

Having said that, the behavior of that ERM product seems like a potential security vulnerability that should be reported to the vendor.

Re: EFR Service monitoring variable DLL files

tomgo — Mon, 14 Apr 2025 06:46:24 GMT

Did you try using version 88.62 / 88.70?

Re: EFR Service monitoring variable DLL files

SWBW_Florian — Tue, 22 Apr 2025 09:37:17 GMT

i have installed 88.32

but thats more a job at the management engine, right?

Re: EFR Service monitoring variable DLL files

Maxh — Thu, 24 Apr 2025 10:04:01 GMT

I have the same issue with Microsoft Dynamics NAV. Did you find a solution?

Endpoint Version: E88.62

Re: EFR Service monitoring variable DLL files

SWBW_Florian — Thu, 24 Apr 2025 11:28:45 GMT

unfortunately not. We still have the same issues

Re: EFR Service monitoring variable DLL files

lluner — Thu, 24 Apr 2025 16:28:59 GMT

@SWBW_Florian

Have you tried doing the exclusions in the forensic blade?

----------------------------------

Files can excluded from quarantine by these criteria: Certificate, File path, Folder path, MD5 hash, SHA1 hash and File extension.

File and Folder paths can contain wildcards (*).

File and Folder paths cannot contain environment variables.

For example:

C:\Program Files\MyTrustedDirectory\excludeMe.exe

C:\Program Files\MyTrustedDirectory\*.exe

Re: EFR Service monitoring variable DLL files

SWBW_Florian — Thu, 08 May 2025 07:48:44 GMT

yes, i tried it like this:

%UserProfile%\AppData\Local\Temp\fileprefix_*