Jump to content
bigvalboa

Network Share exclusion

Recommended Posts

Hello,

I've got an application that is launched from a network share, is it possible to exclude a network share? It runs fine when the service is stopped, but as soon as it runs it kills my application.

Share this post


Link to post
Share on other sites

Is the application in question physically installed on the the same drive (or different drive letter but same computer) as Immunet or is the app only accessed remotely through your network?

Also, what exactly is the app & what is your Operating System? That info might be helpful along with some documentation screenshots of Immunet's behavior/activity regarding this issue using your preferred screen grab software.

If Immunet & the app share the same computer it should be possible to add an Exclusion rule for it by adding the "exact" file path. If it's only accessed through the network that may be problematic but perhaps not impossible to find a workaround.

Like I mentioned, that extra info & screenshots (if you can provide that) just might make the difference to find an adequate solution for your issue!

Regards, Ritchie...

Share this post


Link to post
Share on other sites

The application is Thomson Reuters Ultratax 18. https://tax.thomsonreuters.com/us/en/cs-professional-suite/ultratax-cs 

The PC is Windows 7 fully updated.

The behavior is that the application crashes (APPCRASH) after beginning to navigate. The application is not actually installed on the PC, it is a network install application and each time the application is launched it is from the UNC path.

I have ran debug logging, and parsed it via amp_scan_debug_log.sh and see several hits for different types of files here:

\\?\C:\Users\username\AppData\Local\Temp\

Obviously I do not want to completely exclude the \Temp folder.

 

Share this post


Link to post
Share on other sites

If you just exclude the exe file or application path on the share, it should work without crashing while being able to access the other files.
unless it is creating temp files, that it needs each time the application is launched - where knowing the exact file name could be difficult.

Share this post


Link to post
Share on other sites

More color, I found that white-listing C:\Users\USERNAME\AppData\Local\Temp solves my issues however very insecure.

 

Is there a way to wildcard whitelist file names? such UTWD10E.tmp UTWC03.tmp. So all .tmp files beginning with UTW?

Share this post


Link to post
Share on other sites
2 hours ago, bigvalboa said:

More color, I found that white-listing C:\Users\USERNAME\AppData\Local\Temp solves my issues however very insecure.

 

Is there a way to wildcard whitelist file names? such UTWD10E.tmp UTWC03.tmp. So all .tmp files beginning with UTW?

Not at the moment, I can put a feature request in to the developers to see if they can't have a whitelist with anything that starts with "UTW" or whatever you want (wildcard characters) , and such.

Is there anyway in the software to have the local/TEMP files be created in another location? If so, point it to a generic folder that you create, and then whitelist that folder so it wouldn't matter the name changes

Share this post


Link to post
Share on other sites
9 minutes ago, bigvalboa said:

Unfortunately the application uses the environment variable for temp %TEMP%

i will put a feature request in then.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×