Ignore AV check with silent all-in-one ESET AV installer

[dffd 0]

Hello,

Apologies if this is in the wrong forum; wasn't sure if this should go here or in the Endpoint Products forum.

My company has a specific requirement to install ESET Endpoint Antivirus on certain computers in addition to the other primary antivirus we deploy across the company. We fully understand that having two antivirus software on the same system can cause system instability and conflicts, and that this isn't technically a supported use case. We're aware of the potential risks, and hope that somebody can help answer this question regardless.

We are trying to silently install ESET Endpoint Antivirus with an ERA-generated all-in-one installer on a computer that currently has another antivirus program installed. We are able to install the software silently when the other antivirus is not installed, and we are able to install ESET graphically when the other AV is installed, but we cannot install ESET silently while the other AV is installed.

The following command properly installs ESET when our other antivirus is NOT installed on the system:

ERA_Installer_x64_en_US.exe --silent --accepteula --avr-disable

That same command does not work when the other AV is installed. The installer initializes, then silently fails. Occasionally a GUI prompt appears that says it's "checking for conflicting applications" immediately before it fails.

If we simply double-click the installation file or omit the "--silent" parameter, we are able to install it through the GUI, though there is a prompt that indicates a conflicting AV was detected on the system (screenshot below).

If we click the "Ignore" button, the installation proceeds as expected, and ESET gets installed successfully.

We believe this is the reason the silent installation fails - a conflicting program is already installed on the system and ESET (rightly) will default to killing the installation rather than ignoring the conflict. A user may choose to ignore the warnings with the installer's GUI, but we haven't been able to find a way to ignore the warnings via a command line silent installation. 

Is there another command line parameter we can pass the all-in-one installer to ignore the other installed antivirus software?

Please let me know if any other information would be helpful. Thank you!

[foneil 342]

Afaik, there is no documented parameter for "--ignore" or something similar to do this. That doesn't mean it's not possible to do though. 

I would like to know what versions of ERA you're on (and which Endpoint version you're installing) since there is a documented Known Issue with silent deployments in ERA 6.5 so I'm interested to see what you're using.

[dffd 0]

Sure, here's that info:

ESET Remote Administrator (Server), Version 6.5 (6.5.522.0)
ESET Remote Administrator (Web Console), Version 6.5 (6.5.388.0)

The all-in-one installer is attempting to install ESET Endpoint Antivirus 6.6.2072.4

What is the known issue with silent deployments in ERA 6.5?

[foneil 342]

I'm trying to confirm that this is still accurate, but according to https://support.eset.com/kb6097/#Silent_Install :

• The "silent" parameter is not functional in ESET endpoint products version 6.5 and later. When using the parameters, the installation is automated, but the GUI is visible during the installation.

Which is why I'm interested to hear that your silent install worked. 

[dffd 0]

Ah, interesting. Our experience is consistent with your bulleted point - when the other antivirus isn't installed, the GUI shows up and quickly flashes away when using the "--silent" parameter, but the installation is automated. That's the main sticking point, really. We're more interested in the installation being automated at this point, even if a 100% silent installation isn't possible. 

The wording of that article makes it sound like it was an intentional decision to get rid of the full silent installation functionality, which seems like an odd decision to me... But it's not really my battle.

[Marcos 5,074]

Honestly, it's really a weird scenario to have 2 AV products installed at a time. Definitely one should be installed only as a second opinion scanner without real-time protection, HIPS and other potentially clashing protection modules disabled. Using 2 AVs at a time may not only result in system instability (freezes, crashes, etc.) but theoretically the AVs may cancel out each other, meaning that malware normally detected by one or both AVs will be able to run undetected by any of them.

[dffd 0]

Thanks for the reply. Yeah, that is exactly our use case. We're using ESET as a secondary scanner for certain types of machines, where our other AV is set up for DLP, real-time protection, etc. Pretty much everything except on-demand scanning is disabled in our ESET policy, and our other AV's policy is configured to not interfere with the ESET scanning processes. System stability hasn't been an issue so far with this configuration.

[MartinK 378]

Could you please check whether Enable ESET AV Remover option was enabled in installer creation wizard? It is configuration checkbox present in advanced section of wizard. If it was enabled, could you try to create new installer without it?

[dffd 0]

Confirmed that the Enable ESET AV Remover option is not enabled in the installer creation wizard.

[dffd 0]

Any other thoughts on this?