logo
Welcome Guest! To enable all features please Login or Register.

Notification

Icon
Error

Options
Go to last post Go to first unread
jtomlinson  
#1 Posted : Thursday, March 29, 2018 6:55:40 PM(UTC)
jtomlinson


Rank: Newbie

Joined: 3/2/2015(UTC)
Posts: 6
United States
Location: Grand Blanc, MI

Thanks: 1 times
We have a client with a couple different computers with ScreenConnect installed where the ScreenConnect service will not launch. I've done quite a bit of digging into the issue and found that the file ScreenConnect.ClientService.exe was missing. I was able to transfer that file to these computers but the service still would not launch. So I tried reinstalling and had the same issue.

After much more digging I found that transferring this file to the computer, into any folder, the file would be deleted within 10-15 seconds. Even with renaming the file and changing the file extension, the file would still get removed in 10-15 seconds. I did find that if I opened the EXE in a text editor and changed some of the bytes the file would not get removed.

I did see that these computers were running this software, which I think is what is removing the file. https://www.cylance.com/en_us/home.html - has anyone else seen this before? Can anyone think of a way to get around this? I'm assuming this software is running a file system watcher to look for new files and when it sees files with a specific signature it removes them.
SoCo_Systems  
#2 Posted : Wednesday, April 4, 2018 11:44:57 AM(UTC)
SoCo_Systems


Rank: Advanced Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 1/29/2014(UTC)
Posts: 109
Man
United States
Location: Indianapolis, IN

Was thanked: 16 time(s) in 16 post(s)
It sounds like Cylance is doing its job, detecting your SC install as an unapproved Remote Access client, and removing it. You will need to find a way to create an exemption within that software.
Users browsing this topic
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.