The GoTo Community is currently experiencing some technical issues affecting new posts and comments. You may need to reload the page you are on before you can post a comment. We are actively working with our service provider and apologize for the frustration.
Forum Discussion
Rainst.exe registry modification
We have observed that the LMIRfsClientNP service was disabled due to a registry modification performed by the process Rainst.exe. Our SIEM solution has alerted us to this activity.
Questions:
- Is this a normal behavior for the Rainst.exe application?
- If so, what is the rationale behind disabling the LMIRfsClientNP service?
1 Reply
Hi kareemsamir
Welcome to the Community, and apologies for the delay as we followed up with our team.
Rainst.exe is part of LogMeIn host software, as well as LMIRfsClientNP.
LMIRfsClientNP is not a Windows 32 service. It is part of the remote file system driver, installed with LogMeIn host software and used for the "Connect Drives" feature during Remote Control session. It's possible the LogMeIn software updated itself and rainst.exe had to stop this driver during update.
Hope this helps!
