Jump to content
pcguy

O&O Syspectr reporting 2 installs of NOD32 installed

Recommended Posts

I have 3 computers at a location. All three are Windows10 1903 that are 4 months old. I use O&O Software Syspectr to monitor these computers. However Syspectr is reporting that there are 2 installations of "ESET Security is active and up-to-date ". If i remote into the computer and use the Windows uninstall of NOD32 Antivirus off this computer then one of these entries in Syspectr disappears.

Syspectr support simply tells me " We take this to heart, but have to stress again that we only read the information from windows. " and " We use the Windows API only"  to determine what software is installed and that I should contact Eset. My question is why is Syspectr reporting 2 installations of Eset Antivirus on all three machines. They are all at 13.0.22.0.

Share this post


Link to post
Share on other sites

I asked them whether they check the Windows Registry or directories on the hard drive and all I got back was " No, we use the Windows API only. Contact ESET for further support with this issue please. "

Share this post


Link to post
Share on other sites

They can get information about the product name from HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductName and ProductVersion. I recall it's also possible to query WMI.

Share this post


Link to post
Share on other sites

I can remote in again to one of these machines perhaps later tonight when they are not in use and check the key. I had already looked at the registry for anything glaringly wrong but could not spot anything. This was after O&O could not provide me any further information where they were seeing these duplicate NOD32 entries.

Share this post


Link to post
Share on other sites
9 hours ago, Marcos said:

They can get information about the product name from HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductName and ProductVersion. I recall it's also possible to query WMI.

Well I looked at that key on one of the problem machines and Product Name is "ESET NOD32 Antivirus" and ProductVersion is " 13.0.22.0". For some reason Syspectr reports two entries like  

47ed86f4fff0f4641c9ee9768a6aaf67.png ESET Security is active and up-to-date

Share this post


Link to post
Share on other sites

You can try uninstalling ESET, running the Uninstall tool in safe mode and then installing v13 from scratch. Not sure if it will make any difference in reporting by the said sw though.

Share this post


Link to post
Share on other sites

I thought of doing that too however I would probably want to do that when I am physically there as the warning for the tool indicates it can screw up the network settings. Something I do not need to happen if I am remoting into the computer. Well thanks for the help.  Will have to try the uninstall the next time I am onsite.

Share this post


Link to post
Share on other sites

I discovered what the issue was. In fact the issue showed up on this computer as well. I noticed that when I did a WMI query on root/SecurityCenter2  for Classaname AntivirusProduct  I got the following result

O&O Nod32 Issue WMI Query.jpg

I had to issue the following commands

sc config winmgmt start= disabled
net stop winmgmt
Winmgmt /salvagerepository %windir%\System32\wbem
Winmgmt /resetrepository %windir%\System32\wbem
sc config winmgmt start= auto

Once that was done then O&O showed only one instance of Eset installed

Edited by pcguy

Share this post


Link to post
Share on other sites

It seems that NOD32 Antivirus is creating these duplicate entries at least on Windows10 machines. I did a query on a system here that had upgraded in place to the current 13.0.22.0 and it too had the above two entries in WMI in AntivirusProduct Class and it did not have the O&O product installed.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...