Strange Win 10 Behavior

[alacran]

Have any of you detected this?

Quote

I just upgraded to Win 10 From Win 7.

I am puzzled by the file shown in the below screen shot, R00000000000d.clb, that is being injected into every running process. Only info I can glean from the web is its a necessary file. It certainly didn't exist in Win 7. Appears that when a process starts up in Win 10, svchost.exe is doing the injection but can't determine what service is being used. Is this something to do with Win 10 telemetry?

It is something to do with com+ looking at string details using Process Explorer.

Source: https://www.wilderssecurity.com/threads/strange-win-10-behavior.387503/

EDIT: This is from a post made in Jul 30, 2016.  But it is the first time I read about this.

alacran

Edited April 21, 2017 by alacran

[jaclaz]

I don't think it is Windows 10 specific, it should be a (very old) issue (possibly triggered by the upgrade specifically) connected with CRM logging (whatever it is):

http://www.techsupportforum.com/forums/f8/r0000000000e3-clb-what-is-this-58550.html#post298277

Check if there is some tracing enabled, this might be obsolete, but should give you a start anyway:
https://support.microsoft.com/en-us/help/907490/how-to-enable-tracing-in-microsoft-dynamics-crm

Or check the whole stuff here  :

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680326(v=vs.85).aspx

it answers at least what the heck CRM is, Compensation Resource Manager, which obviously  "provides a quick and easy way to integrate application resources with Microsoft Distributed Transaction Coordinator (DTC) transactions. Using the CRM is an alternative to developing a full Microsoft Transaction Services (MTS) resource manager."

jaclaz

 

 

 

[alacran]

Nice effort Wonko but MS explanation in plain words do not say anything clear, so as this is the actual style for subjects involving Telemetry and privacy violation, I will assume this is something related to privacy violation.

It looks it was written by Cantinflas, in my country we have a verb for this cantinflear (basically say a lot of words and no neaning).

alacran

[jaclaz]

14 hours ago, alacran said:

Nice effort Wonko but MS explanation in plain words do not say anything clear, so as this is the actual style for subjects involving Telemetry and privacy violation, I will assume this is something related to privacy violation.

It looks it was written by Cantinflas, in my country we have a verb for this cantinflear (basically say a lot of words and no neaning).

alacran

Well, actually NOTHING written by MS was EVER actually clear (everywhere but particularly on MSDN), so that doesn't particularly qualify the thing as being "privacy violation" related.

On the other hand these R<something>.clb files have been created on several Windows versions since at least 2003, so if they are actually conneceted wth "privacy violaton" as a one time exception the Windows 10 and the new MS management/policies are not to blame.

jaclaz