AParker asked a question.
Our organization has recently enabled PowerShell logging, and have noticed that intermittently our devices and servers start a CPU-Z instance via PowerShell, and then when it finishes it will close and wipe the instance. We are just looking to confirm, is this part of the Snow Inventory Agent logging the computer details as part of the scan?
Hi ,
To make it short: Yes we do use CPUID to gather additional CPU information.
This can be turned off (in return will lower the quality of CPU information retrieved) in the snowagent.config under system settings with hardware.scan.enable_cpuid set to false.
Let me know if you want more information regarding this.
Best Regards
Geoffrey Macquet
Customer Success Manager EMEA
This answer helped us a lot because a process called "cpuz148_x64.sys" was marked as suspicious during a Windows Server scan that took place while the Snow Inventory Agent was busy. So I was able to reproduce that this file is created in the Windows Temp folder during every scan. Thanks a lot!
It may be related to this: https://nvd.nist.gov/vuln/detail/CVE-2021-27579 - I recommend disabling CPUID in the config
Hi @Christoph Feiden and @Alex Parker you are most welcome! I just edited my old post as the formatting was weird after the community migration.
This is correct, basically you can observe when the agent actually is scanning - the cpuidsdk dll will pop up in the agents folder and disappear after the scan is done. I use this "method" to know when the scan went through 😉
Best Regards
Geoffrey Macquet
Customer Success Manager EMEA
Hi @Geoffrey Macquet ,
thanks for the answer.
Do you maybe have additional information what goes missing if I disable it? Is there a documentation available?
Thanks and best regards,
Rainer
Hi @Ashley Collinge , thanks for the hint. Already disabled since last week.
Best regards, Rainer
Thanks for sharing the link. An new search shows me that Snow has reacted already and published this article in the "knowledge" section: https://community.flexera.com/s/article/Snow-Inventory-Agent-for-Windows-vulnerability-000015758
Hi ,
To make it short: Yes we do use CPUID to gather additional CPU information.
This can be turned off (in return will lower the quality of CPU information retrieved) in the snowagent.config under system settings with hardware.scan.enable_cpuid set to false.
Let me know if you want more information regarding this.
Best Regards
Geoffrey Macquet
Customer Success Manager EMEA