pcguy 1 Posted November 15, 2019 Share Posted November 15, 2019 I have 3 computers at a location. All three are Windows10 1903 that are 4 months old. I use O&O Software Syspectr to monitor these computers. However Syspectr is reporting that there are 2 installations of "ESET Security is active and up-to-date ". If i remote into the computer and use the Windows uninstall of NOD32 Antivirus off this computer then one of these entries in Syspectr disappears. Syspectr support simply tells me " We take this to heart, but have to stress again that we only read the information from windows. " and " We use the Windows API only" to determine what software is installed and that I should contact Eset. My question is why is Syspectr reporting 2 installations of Eset Antivirus on all three machines. They are all at 13.0.22.0. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,069 Posted November 15, 2019 Administrators Share Posted November 15, 2019 What registry value does the sw monitor? Link to comment Share on other sites More sharing options...
pcguy 1 Posted November 15, 2019 Author Share Posted November 15, 2019 I asked them whether they check the Windows Registry or directories on the hard drive and all I got back was " No, we use the Windows API only. Contact ESET for further support with this issue please. " Link to comment Share on other sites More sharing options...
Administrators Marcos 5,069 Posted November 15, 2019 Administrators Share Posted November 15, 2019 They can get information about the product name from HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductName and ProductVersion. I recall it's also possible to query WMI. Link to comment Share on other sites More sharing options...
pcguy 1 Posted November 15, 2019 Author Share Posted November 15, 2019 I can remote in again to one of these machines perhaps later tonight when they are not in use and check the key. I had already looked at the registry for anything glaringly wrong but could not spot anything. This was after O&O could not provide me any further information where they were seeing these duplicate NOD32 entries. Link to comment Share on other sites More sharing options...
pcguy 1 Posted November 16, 2019 Author Share Posted November 16, 2019 9 hours ago, Marcos said: They can get information about the product name from HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductName and ProductVersion. I recall it's also possible to query WMI. Well I looked at that key on one of the problem machines and Product Name is "ESET NOD32 Antivirus" and ProductVersion is " 13.0.22.0". For some reason Syspectr reports two entries like ESET Security is active and up-to-date Link to comment Share on other sites More sharing options...
Administrators Marcos 5,069 Posted November 16, 2019 Administrators Share Posted November 16, 2019 You can try uninstalling ESET, running the Uninstall tool in safe mode and then installing v13 from scratch. Not sure if it will make any difference in reporting by the said sw though. Link to comment Share on other sites More sharing options...
pcguy 1 Posted November 16, 2019 Author Share Posted November 16, 2019 I thought of doing that too however I would probably want to do that when I am physically there as the warning for the tool indicates it can screw up the network settings. Something I do not need to happen if I am remoting into the computer. Well thanks for the help. Will have to try the uninstall the next time I am onsite. Link to comment Share on other sites More sharing options...
pcguy 1 Posted November 19, 2019 Author Share Posted November 19, 2019 (edited) I discovered what the issue was. In fact the issue showed up on this computer as well. I noticed that when I did a WMI query on root/SecurityCenter2 for Classaname AntivirusProduct I got the following result I had to issue the following commands sc config winmgmt start= disabled net stop winmgmt Winmgmt /salvagerepository %windir%\System32\wbem Winmgmt /resetrepository %windir%\System32\wbem sc config winmgmt start= auto Once that was done then O&O showed only one instance of Eset installed Edited November 19, 2019 by pcguy Link to comment Share on other sites More sharing options...
pcguy 1 Posted November 23, 2019 Author Share Posted November 23, 2019 It seems that NOD32 Antivirus is creating these duplicate entries at least on Windows10 machines. I did a query on a system here that had upgraded in place to the current 13.0.22.0 and it too had the above two entries in WMI in AntivirusProduct Class and it did not have the O&O product installed. Link to comment Share on other sites More sharing options...
pcguy 1 Posted October 30, 2020 Author Share Posted October 30, 2020 Looks like I will have to issue the above series of commands on a bunch of Windows10 computers using NOD32 and O&O Syspectr as they are showing the same error multiple antivirus applications installed. Link to comment Share on other sites More sharing options...
Recommended Posts