mtrento

Hi, There is a method but you have to remove registry entries by hand. Fortunately i made a script partly based on informations i found on various internet sites and forums. I used this script to delete manually the agent since removing it from the console does not remove it completely. After executing it you can re install the agent or any other version but it will register itself as a new entry in the console the old entry must be also removed manually. Good Luck @echo off rem first try to start the official uninstall wmic product where name="ESET Management Agent" call uninstall /nointeractive rem manual delete of agent rem Use at your own risk sc stop EraAgentSvc sc delete EraAgentSvc del /F /S /Q "C:\Program Files\ESET\RemoteAdministrator\" del /F /S /Q "C:\ProgramData\ESET\RemoteAdministrator\" reg delete HKEY_LOCAL_MACHINE\SOFTWARE\ESET\RemoteAdministrator\Agent /f reg delete HKEY_CLASSES_ROOT\Installer\Products\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\ /v C:\Windows\Installer\{B454B5C8-5C87-4F24-B9F5-2A9A199F08F5}\ /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8C5B454B78C542F49B5FA2A991F9805F /f rem eset 6.5 reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B454B5C8-5C87-4F24-B9F5-2A9A199F08F5} /f rem agent ESET Management Agent 7.0.577.0 reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9BF80F33-FAA3-4F96-9CE6-ECCC808CA7BA} /F reg delete HKEY_CLASSES_ROOT\Installer\Features\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_CLASSES_ROOT\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f reg delete HKEY_CLASSES_ROOT\Installer\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f reg delete "HKEY_CLASSES_ROOT\Installer\Products\07F21F149AF55F34494F355BE44BEE4C" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\07F21F149AF55F34494F355BE44BEE4C" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\07F21F149AF55F34494F355BE44BEE4C" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{41F12F70-5FA9-43F5-94F4-53B54EB4EEC4}" /f

hi , If you're running xp in virtual machines , be aware that there are random issues with eraagent.exe taking 100%cpu. The only "viable" option is to downgrade the agent to 6.5 as there won't be any fixes released In my case ,trying to remove the agent 7.x from the esmc console end up with a partial removed software . i had to manually remove the software by editing registry , removing services ...... Good luck

hi, i just received the answer of the support: note :i have provided memory dumps and all required logs:

hello, you can block usb devices by category on windows with proper gpo. https://social.technet.microsoft.com/Forums/lync/en-US/7bfcee6b-bbdf-4fb2-af71-81c8d15d4339/block-all-makemodel-of-usb-devices-except-for-one?forum=winserverGP

hello, I am struggling with this random issue aswell . every day i receive a call from some users complaining for a slowdown of their virtual pc. The agent version is 7.0.577.0 , i had issue with previous version too. only a reboot can fix (temporally) the issue i have provided a memory dump of the process. regards edit : i opened a support ticket [Ticket#5049737] , as per instructions received , i generated a full memory dump of the machine. note: as this issue occurs on a random basis and because the machine is virtual, i used the suspend trick to obtain the memory dump