What is EFRService.exe?
EFRService.exe is part of End Point Security and developed by Check Point Software Technologies Ltd. according to the EFRService.exe version information.
EFRService.exe's description is "Check Point Endpoint Forensic Recorder service"
EFRService.exe is digitally signed by Check Point Software Technologies Ltd..
EFRService.exe is usually located in the 'C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\' folder.
None of the anti-virus scanners at VirusTotal reports anything malicious about EFRService.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on EFRService.exe:
| Property | Value |
|---|---|
| Product name | End Point Security |
| Company name | Check Point Software Technologies Ltd. |
| File description | Check Point Endpoint Forensic Recorder service |
| Internal name | EFRService.exe |
| Original filename | EFRService.exe |
| Legal copyright | 2009 Copyright Check Point Software Technologies Ltd. |
| Product version | R80 |
| File version | 860047023 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | End Point Security |
| Company name | Check Point Software Technologies Ltd. |
| File description | Check Point Endpoint Forensic Record.. |
| Internal name | EFRService.exe |
| Original filename | EFRService.exe |
| Legal copyright | 2009 Copyright Check Point Softwar.. |
| Product version | R80 |
| File version | 860047023 |
Digital signatures [?]
EFRService.exe has a valid digital signature.
| Property | Value |
|---|---|
| Signer name | Check Point Software Technologies Ltd. |
| Certificate issuer name | Symantec Class 3 SHA256 Code Signing CA |
| Certificate serial number | 61d73145ade15140cee8b9f52ba0df43 |
VirusTotal report
None of the 67 anti-virus programs at VirusTotal detected the EFRService.exe file.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | ed1ff0c9252e929d5803a70d1a357266 |
| SHA256 | 280fef2702cc9fc1250a76dfd6b99b04c518b92e810ce8210ddabf15bb0eace8 |
Error Messages
These are some of the error messages that can appear related to efrservice.exe:
efrservice.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
efrservice.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
Check Point Endpoint Forensic Recorder service has stopped working.
End Program - efrservice.exe. This program is not responding.
efrservice.exe is not a valid Win32 application.
efrservice.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with EFRService.exe?
To help other users, please let us know what you will do with EFRService.exe:
What did other users do?
The poll result listed below shows what users chose to do with EFRService.exe. 91% have voted for removal. Based on votes from 175 users.
NOTE: Please do not use this poll as the only source of input to determine what you will do with EFRService.exe.
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
i open my task manager and this random program is cooking it at 31.8% CPU, and 38.3% memory. Please help this cant be normal, i tried deleting the program but it said that it was open in another window so i couldn't delete. i closed all my windows and it still said the same thing. program name: {{{{{Check Point Endpoint EFR}}}}}} .I go to end the task and it says if it messes up a system function it could cause instability. I dont know if it will do that though. what should i do.
(this was torn from my own reddit post)
# 10 Jul 2018, 21:12
Brando writes
EFRService.exe is installed with/part of ZoneAlarm.
But I disabled automatic startup, and it is still running after reboot.
# 1 Aug 2018, 22:32
Deeron writes
So what exactly is this forensic recorder recording and why is it recording?
# 8 Aug 2018, 13:21
metoo writes
in my case when i reboot the computer, while the desktop loads this program/service takes 1min where i can't do anything, i have to wait it finished to really start using my computer...
(i have zone alarm)
# 2 Sep 2018, 3:43
Cham writes
This service activated once I ran Deep Optimization in Advanced SystemCare and after that it disabled some services and when the next time I tried to connect to internet I found some connecting issues and after while Advanced SystemCare asked permission to access this program and that's how it appeared in my system. I think it changed the connection settings. After realizing this I Restored the changes made by ASC Deep Optimization to default in ASC. But this still appear in my system and Taskbar I didn't try to remove it since it doesn't seem to be a spam. I like to know professional verdict on this file and setting.
# 9 Feb 2019, 7:59
hubs writes
When can we start the lawsuit against Check Point? They are stealing information and preventing us from uninstalling their software. It's a back door and someone is going to learn how to exploit it.
# 21 Apr 2020, 16:37
Joan Jekkins writes
It looks like EFRService.exe is a legitimate file from Check Point Software Technologies, related to their Endpoint Security. It's good to know that none of the antivirus programs flagged it as malicious, which adds peace of mind for those who have it on their systems. However, it’s always smart to keep an eye out for any unusual behavior. I try to learn more about similar security topics, and needed online assistance. There's a helpful video https://www.youtube.com/watch?v=uyK9G2ZvrU4 I came across with the review of best service. It’s always important to be informed to deal with security related files.
# 21 Oct 2024, 4:00
tyler writes