Antivirus and EDR
This page is for IT administrators who run antivirus or endpoint detection on workstations. It lists what the host installs and the behaviour an endpoint product may report.
Windows
Section titled “Windows”Signing
Every host executable and DLL is signed by Computle Limited. The host updater refuses a file with any other signer. The drivers are Microsoft attestation-signed.
Folders
| Folder | Contents |
|---|---|
C:\Program Files\Computle\Remotle\bin\ |
Executables and DLLs |
C:\Program Files\Computle\Remotle\drivers\ |
Driver packages |
C:\ProgramData\Computle\Remotle\ |
Logs, saved settings and staged updates |
C:\ProgramData\Computle\Broker\ |
The host’s certificate and trust roots |
C:\ProgramData\Computle\CrashDumps\ |
Crash dumps, readable by administrators only |
Processes
| Process | Runs as | Purpose |
|---|---|---|
ComputleRemotleService.exe |
SYSTEM, service ComputleService |
Supervises the host |
ComputleSessionServer.exe |
Local Service, service ComputleSessionServer |
Runs each session |
ComputleBroker.exe |
SYSTEM, service ComputleBroker |
Connection to Computle |
ComputleCaptureWorker.exe |
SYSTEM, service ComputleCaptureWorker |
Capture when nobody is signed in |
ComputleClockSync.exe |
Local Service, service ComputleClockSync |
Sets the clock from the connecting device |
ComputleUSBClient.exe |
SYSTEM, service ComputleUSBPresent |
Presents the client’s USB devices |
ComputleUpdater.exe |
SYSTEM, service ComputleUpdater |
Host updates |
ComputleEnrolment.exe |
SYSTEM, service ComputleEnrolment |
The host’s identity with Computle |
ComputleRemotleServer.exe |
The signed-in user’s session | Screen capture and encoding |
ComputleRemotleDisplay.exe |
The signed-in user’s session | Virtual monitor layout |
ComputleInputController.exe |
The signed-in user’s session | Applies keyboard, mouse and clipboard input |
DLLs loaded into Windows processes
| DLL | Loaded by | Purpose |
|---|---|---|
ComputleShellButton.dll |
StartMenuExperienceHost.exe |
Adds a Computle entry to the Start menu |
ComputleCredentialProvider.dll |
LogonUI.exe |
A sign-in tile for silent logon. It performs no authentication itself. |
softcam.dll, ComputleMfCameraSource.dll |
Windows Frame Server | The client’s camera, as a camera on the workstation |
ComputleIdd.dll |
WUDFHost.exe |
The virtual display driver |
Drivers
| Driver | Class | Purpose |
|---|---|---|
Computle Virtual Display Adapter (ComputleIdd) |
Display | Virtual monitors |
Computle Virtual HID Mouse (ComputleVhidMouse) |
HID | Pointer input |
Computle Virtual Audio (ComputleAudioDriver) |
Media | Speakers and microphone for the session |
Computle USB VHCI (ComputleVhci) |
USB | The client’s USB devices |
Behaviour an endpoint product may report
| Behaviour | Detail |
|---|---|
Remote thread into StartMenuExperienceHost.exe |
ComputleRemotleService.exe loads ComputleShellButton.dll into the Start menu process with CreateRemoteThread, and unloads it the same way. |
| Debug privilege | ComputleRemotleServer.exe and ComputleCaptureWorker.exe enable the debug privilege to open the driver host process WUDFHost.exe and share the virtual display’s frame buffer. |
| Processes started in the user’s session | The services start ComputleRemotleServer.exe, ComputleRemotleDisplay.exe and ComputleInputController.exe in the signed-in user’s session. |
| Synthetic input | ComputleInputController.exe injects keyboard and mouse input from the client. |
| Credential provider registration | The installer registers ComputleCredentialProvider.dll under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers. |
| PowerShell during install | The installer runs host-setup.ps1 as SYSTEM to install drivers (pnputil, devcon), register COM servers (regsvr32), create services and set folder permissions (icacls). |
| Display changes | During a session the host adds virtual monitors and changes the display layout. |
Network
The host makes outbound connections only, over UDP and TCP. The installer adds no inbound firewall rules and removes any left by an earlier version. See Network Requirements.
Files
| Path | Contents |
|---|---|
/usr/lib/computle-host/ |
computle-hostd, computle-host-updated, computle-login, computle-greeter-logon, bundled libraries |
/usr/bin/computle-session |
The session agent |
/usr/lib/computle/computle-usb-attach |
Attaches the client’s USB devices |
/usr/lib/computle-enrolment/ComputleEnrolment |
The host’s identity with Computle |
/etc/computle/ |
Configuration |
/var/lib/computle/ |
State, certificates |
/var/log/computle/ |
Local logs, when turned on |
pam_computle_logon.so in the PAM module directory, /etc/pam.d/computle-logon |
Silent logon |
/usr/share/gnome-shell/extensions/[email protected] |
A GNOME Shell extension for the pointer |
Services
computle-hostd runs as the computle-host account. computle-session runs in each user’s GNOME session. computle-host-updated, computle-usb-attach@, computle-render-grant@, computle-kms-capture@ and computle-greeter-logon run as root, socket-activated where there is a socket unit.
Behaviour an endpoint product may report
| Behaviour | Detail |
|---|---|
| Kernel modules | The package loads vhci-hcd (USB devices), v4l2loopback (camera) and uinput (input), and adds udev rules for them. |
| Polkit rule | computle-host is allowed one action, org.freedesktop.timedate1.set-time, to set the clock from the connecting device. |
| GNOME Shell extension | Enabled for every user and the login screen through a locked dconf setting. |
| PAM service | computle-logon signs a named user in when a client connects to a workstation with nobody signed in, only where an administrator has configured it. |
| SELinux | The binaries are labelled bin_t. |