PendingFileRenameOperations

paulnus · Post by **paulnus** » Mon Feb 17, 2020 3:31 pm

Hello,
When starting the "KS Advanced Host Monitor" service, there is a temp file written to C:\Windows\Temp\ that gets created upon service start. This temp file also registers inside the registry as a file that flags the system as needing a reboot via the "PendingFileRenameOperations" within the registry.

Clearly, I will defer to your knowledge about building software and how/when/why this flag is getting set. That said, our update software (Ivanti Endpoint Manager), reads the registry key as indicating the server requires reboot. When this happens, our patches do not get pushed and we go into a continuous reboot cycle.

This particular key will have the value associated of the file that was created on service start.

Code: Select all

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\PendingFileRenameOperations

Example filename: ~ip2C97.tmp

Example Registry:
https://imgur.com/a/TkwDZ0K

In order to see the file in question, one must unclick the "Hide protected operating system files (Recommended)" checkbox.

My question is, is there a reason the "PendingFileRenameOperations" needs to be set? What exactly is it trying to rename?

KS-Soft · Post by **KS-Soft** » Mon Feb 17, 2020 3:47 pm

I have no idea, HostMonitor should not do this.
This happens every time you start service?

HostMonitor version?
Where did you get this HostMonitor? Downloaded from our web site? Downloaded from some hackers forum?

Windows? Service Pack?
Antivirus monitor?

Regards
Alex

paulnus · Post by **paulnus** » Mon Feb 17, 2020 4:03 pm

The registry updates every time the service is restarted. If you stop the service, the temp file disappears but the registry entry remains. If you restart the service, the filename changes to a different random filename. The .tmp file is not able to be deleted due to it being locked by Host Monitor.

Downloaded from your website. Enterprise license.

I'm actually transitioning my server from a 2012R2 server to a 2019 server. Both instances have the same issue. The patching software we are using is new to us, so its not something we would have noticed before today.

version: v11.99
windows: Windows Server 2012R2

version: v12.24b
windows: Windows Server 2019

If I open the .tmp file and review contents there is this blurb at the end.

I P * W o r k s ! C + + E d i t i o n . .

*EDIT*
We are running an anti-virus but I don't feel comfortable sharing publicly. I will check the backend to make sure nothing getting blocked on the server but no alarms went off, which we typically would see.

KS-Soft · Post by **KS-Soft** » Mon Feb 17, 2020 4:21 pm

Oh, this is one of the few 3rd party libraries we use.
I though we fixed this issue years ago. Will check how it came back..

Regards
Alex

KS-Soft · Post by **KS-Soft** » Thu Feb 20, 2020 4:47 am

Fixed in version 12.26, will be available in couple days

Regards
Alex

paulnus · Post by **paulnus** » Tue Feb 25, 2020 4:20 am

Thanks Alex!

PS - The upgrade fixed the issue. Confirmed.

KS-Soft · Post by **KS-Soft** » Tue Feb 25, 2020 7:13 am

You are welcome

Regards
Alex