EFR Service monitoring variable DLL files

[SWBW_Florian]

hey,

our ERP System is creating temporary DLL files in users TEMP directory while navigating to an printpreview window of any datasheet.

this DLL file (temporary, name by coincidence) is watched by EFRService. I can see the monitoring through resmon.exe

unfortunately, sometimes the exclusive access during monitoring takes too much time, so the ERP application cant access the file as it wants to. Its not trying it again, so it fails. if the user is retrying the print-process it works usually.

i need to exclude those files from monitoring. But i dont know how. They are not signed by any certificate and do have flexible names while they are saved in users TEMP directory

how could i manage this?

Thanks for any hint

regards

Florian

[PhoneBoy]

Generating random DLL files in a temp directory and they’re not signed?
Not sure you can do that without excluding the temp directory (which is probably a bad idea).

[SWBW_Florian]

yes, thats how microsoft is working, obviously ... 

we wont exclude the whole TEMP folder. That behaviour is shown on *all* Office PCs ... 

there must be a workaround, right?

[PhoneBoy]

TAC might have something, but without a unique way to identify those files, I suspect you're in RFE territory.

Having said that, the behavior of that ERM product seems like a potential security vulnerability that should be reported to the vendor.

[tomgo]

Did you try using version 88.62 / 88.70?

[SWBW_Florian]

i have installed 88.32 

but thats more a job at the management engine, right?

[Maxh]

I have the same issue with Microsoft Dynamics NAV. Did you find a solution?

Endpoint Version: E88.62

[SWBW_Florian]

unfortunately not. We still have the same issues

[lluner]

@SWBW_Florian 

Have you tried doing the exclusions in the forensic blade?

---------------------------------- 

Files can excluded from quarantine by these criteria: Certificate, File path, Folder path, MD5 hash, SHA1 hash and File extension.

File and Folder paths can contain wildcards (*).

File and Folder paths cannot contain environment variables.

For example:

C:\Program Files\MyTrustedDirectory\excludeMe.exe

C:\Program Files\MyTrustedDirectory\*.exe

[SWBW_Florian]

hy

yes, i tried it like this:

%UserProfile%\AppData\Local\Temp\fileprefix_*