PDF XChange Forum

Opening a file on a network shared folder, it opens pdfxeditor and before open the file it shows "Connecting to site..."
checking which traffic has done it try to connect to http://nas/_vti_pvt/service.cnf

Note: The problem appears only when open pdf with no pdfxeditor application already opened.

Hi Idelana,

Thanks for the post - This is a known issue. Please disable the SharePoint plugin under Edit --> Preferences --> Plugins and that should solve the issue.

Thanks,

Hello,

When viewing PDF file on a WebSite from local PC(PDF-XChangeEditor installed), our PaloAlto'IPS detected a packet of access to "GET /_vti_pvt/service.cnf" as an attack.
We tried to disable the SharePoint plugin under Edit --> Preferences --> Plugins, but that packet hsn't disappeared.
Is there any other method to disable that access?

and,,
Why does PDF-XChangeEditor access /_vti_pvt/service.cnf file?

Hi Yoshiyuki,

Thanks for the post - We access that firstly to determine if a file opened is stored in a SharePoint folder and/or a network folder, and secondly to check the version of SharePoint being used. We're improving the way that this is being handled build by build so that it shouldn't cause a slowdown or other issues.

Are you able to add an exception to the Editor to PaloAlto'IPS? If not, is this causing a major issue for you?

Thanks,

Hi Will

We know PDF-XChange Editor is really useful and powerful PDF Editor.
So we would like to clear a doubt.

I checked packets of PDF-XChange Editor opening PDF file on Internet Website by WireShark.
I found the pakets below,
--------------------------------------
GET /_vti_pvt/service.cnf HTTP/1.1
Accept: */*
Content-Length: 0
User-Agent: Session
Host: xxxxxx.xxx.xxxxx.local
Connection: Keep-Alive
--------------------------------------
Please let me know a meaning of why User-Agent is "Session" ?
We heard that some malware send the same packets(User-Agent: Session).
So PaloAlto's IPS function detected that packet as an attack, we heard.

And unfortunately we can't add an exception, and also we can't set IPS signature detecting User-Agent's doubt off because it's useful.
But this is not causing a major issue, we only know why PDF-XChange set User-Agent "Session".

Hi Yoshiyuki,

I've spoken with the development team on this and they've said that the 'User-Agent' is basically just the name of the 'agent' contacting the server. They said that it was strange that your antivirus requires a specific session name as it's not restricted by any standard. We can mimic Firefox or Internet Explorer, etc. if you'd prefer, but there shouldn't be any need.

Thanks,

Hi Yoshiyuki.

We tried to disable the SharePoint plugin under Edit --> Preferences --> Plugins, but that packet hsn't disappeared.
Is there any other method to disable that access?

Note: after disabling (enabling) the plug-ins, you need to restart the editor to take effect..

Cheers.