Jump to content

Cannot uninstall ESET and keep admin permissions


Recommended Posts

ESET has the power to lock me out of my own "my documents" folder and every settings system within it. I can' turn this off by adjusting "Real-Time & Machine Learning Protection," all choices to either "Cautious" of "Off."

Whenever these changes revert OR if I decide to uninstall ESET....eset removes my admin permissions on the way out!?? Am I being forced to keep this software on my PC and pay a price to...I dunno PAY A RANSOM" to use my PC?!

please advise on how to properly uninstall eset without destroying all my user/admin permissions.

Link to post
Share on other sites
  • Administrators

ESET doesn't change permissions on files or folders whatsoever. Please describe the situation before installing ESET and after installation. What is different? Before installing ESET you were able to access the "My documents" folder and after installation (without changing any settings) access to the folder was blocked? Does pausing real-time protection make a difference?

Link to post
Share on other sites

C:\Users\%username%\Documents

 

technically it's everything under this particular %username% but lets use documents as an example:

 

with these settings:

image.png.8044a2ab527d3692c7c6f25992e95545.png

 

I get the error "You'll Need to provide administrator permission to delete this file"

When I allow admin permission by either running as admin or selecting "yes" with the admin symbol I get:

"You need permission to perform this action" permission from "%Desktopname%\%username%"

When I turn everything to it's lowest setting, either cautious or off, I am then able to delete the same file without any prompts or blockage.

When I uninstall ESET completely I receive the same error/permission prompts and am unable to adjust any permission/folder settings to gain access to this folder.

 

 

Link to post
Share on other sites

It appears to me that somehow all subdirectories under C:\Users\%username%\AppData\ have been changed to full Admin level access. This would explain why you are receiving the same Win access alerts with Eset uninstalled.

Note that on Win 10, the default account setup runs as a Local Limited Admin. This means you run normally under Standard User account privileges and the OS issues a UAC prompt to allow for escalation to full Admin privileges as required.

Edited by itman
Link to post
Share on other sites

I can troubleshoot that particular suggestion but in the interim, why would ESET change that particular admin level access. It's not something I adjusted, it changed when I installed ESET?

Or, would you argue that it was something else that adjusted those permissions?

Link to post
Share on other sites
13 minutes ago, DanielJ said:

but in the interim, why would ESET change that particular admin level access.

@Marcos already answered this. The answer is no. Eset does not change file permissions.

15 minutes ago, DanielJ said:

Or, would you argue that it was something else that adjusted those permissions?

Yes.

Note however there are other third party security apps such as VoodooShield that uses Win icacls.exe process to perform such activity. Much worse, it doesn't fully revert the permission modifications it made when it is uninstalled.

Link to post
Share on other sites
3 hours ago, DanielJ said:

When I turn everything to it's lowest setting, either cautious or off, I am then able to delete the same file without any prompts or blockage.

This makes no sense whatsoever.

I have all settings set to the highest level, Aggressive, and have never seen the behavior described manifest. I am running under the default limited admin account in Win 10.

Edited by itman
Link to post
Share on other sites

One thing you can verify is what your existing C:\Users\%username%\AppData\ folders permissions are. As shown in the below screen shot, the limited admin account I run under has Full Control:

Eset_Permissions.png.178eaa936da4209e455afe7a269002ea.png

Link to post
Share on other sites
Posted (edited)

I have all the same permissions set up with no avail.

image.png.f0705f12c2835186e914d89fd32d4e79.png

I concede that something else strange may be happening but I am not convinced that it's not ESET because everything works fine IF ESET is installed and I have the appropriate levels set. How could it be something else.

If eset is "resolving" this issue by being installed how can I believe it's not changing permissions when it's the one variable that is allowing or disallowing me to change these folders?

Edited by DanielJ
Link to post
Share on other sites
2 hours ago, DanielJ said:

I have all the same permissions set up with no avail.

Not exactly. My Win 10 installation was a fresh install.

The fact I see "Everyone" listed under Group or user names leads me believe that perhaps you ran something like Tweaking.com utility: https://www.tweaking.com/ to reset Win permissions back to default values?

Edited by itman
Link to post
Share on other sites

Are you saying that if I manually remove everyone it'll fix my problem? I'm not sure how that has to do with your user permissions and my user permissions are identical

Additionally they don't change for me when I have ESET installed and when I don't BUT my ability to add/remove/edit items in my documents folder does change.

THE ONLY VARIABLE IS ESET.

 

Link to post
Share on other sites
1 hour ago, DanielJ said:

Are you saying that if I manually remove everyone it'll fix my problem?

Probably not.

The bottom line is this. If Eset was changing file permissions, this forum would be full of like postings about it. You are the only one I have known of to make such a claim.

Link to post
Share on other sites
Posted (edited)

I disagree,

The bottom line is my PC worked before installing ESET and will continue to work with it installed BUT will NOT work if I uninstall it. So I MUST pay $$$$ to ESET if I want to continue using my PC. 

IF there is something else going on I don't know. Perhaps there is another root problem that is causing the issue, like some malware. BUT eset doesn't find any walware or corruption on my PC....so either ESET can't find the root problem or IT IS the root problem. 

<video removed>

Watch me hit all the buttons to "fix" my problem with ESET settings THEN not be able to delete the items in my documents after uninstall eset.

Implying that I'm lying doesn't really help us find the solution. Just because it's not happening to more people does not mean it's not happening to me.

I am 100% willing to admit that I'm misdiagnosing the issue but the evidence/troubleshooting we've do so far does not show any movement on that front.

 

Edited by DanielJ
Link to post
Share on other sites
  • Most Valued Members

Can i just ask do you have any other security programs installed?

Link to post
Share on other sites
Posted (edited)

@danielJ can you create a local admin user and try to access this folder with this new admin user?

Edited by pps
Link to post
Share on other sites
On 6/29/2020 at 9:20 PM, DanielJ said:

I have all the same permissions set up with no avail.

image.png.f0705f12c2835186e914d89fd32d4e79.png

I concede that something else strange may be happening but I am not convinced that it's not ESET because everything works fine IF ESET is installed and I have the appropriate levels set. How could it be something else.

If eset is "resolving" this issue by being installed how can I believe it's not changing permissions when it's the one variable that is allowing or disallowing me to change these folders?

@DanielJ Hello can you give a screenshot after pressing advanced button?

Link to post
Share on other sites

I've done a lot of troubleshooting in here so it's probably jumbled a bit. trying to allow myself or "everyone" or adjusting the Admin permissions. Some of this I've done in safe mode. I only have one created account on the PC which is the bottom principal in this list.

image.png.4fbf8310dc96a2faf6427c142693c1e1.png

Link to post
Share on other sites
  • Administrators

Just to make sure, do you have Anti-Theft disabled and have never enabled it yet?

I'd like to check and compare 2 Procmon logs, one with ESET installed and the other with ESET not installed when the issue allegedly manifests.

Link to post
Share on other sites
21 minutes ago, Marcos said:

Just to make sure, do you have Anti-Theft disabled and have never enabled it yet?

Per the posted video, it appears a trial version of Eset is being used. Can Anti-Theft be enabled in a trial version?

Link to post
Share on other sites
Posted (edited)

I don't believe that eset's Anit-Theft is enabled.

eset_go_Logfile.zipeset_no_Logfile.zip 

attached are the Procmon logs:

"eset_no_logfile" is without eset installed. I attempted to delete an item from my documents while running procmon.

"eset_go_logfile" is with eset installed.I successfully deleted an item from my documents while running procmon.

 

Edited by DanielJ
Link to post
Share on other sites
  • Most Valued Members

The reason I asked if you used any other AV is im wondering if something else could be involved.

I presume windows defender kicks in when eset uninstalls. I don't use it myself but wondering if this could actually be the culprit which would explain why there's no issue when eset is installed as defender gets turned off.

I could be completely wrong. Wondering if @itmancould throw any light on this possibility?

 

Also have you tried when uninstalling Eset then booting into safe mode and using the eset uninstall tool which is designed to remove any leftovers. It could possibly be something has been left behind

You can find this at 

https://support.eset.com/en/kb2289-uninstall-eset-manually-using-the-eset-uninstaller-tool

Link to post
Share on other sites
44 minutes ago, peteyt said:

I presume windows defender kicks in when eset uninstalls. I don't use it myself but wondering if this could actually be the culprit which would explain why there's no issue when eset is installed as defender gets turned off.

I could be completely wrong. Wondering if @itmancould throw any light on this possibility?

The first question is if WD real-time scanning was auto disabled when Eset was installed as is normal procedure?

Also WD  has a  "Controlled folders" option that does restrict access to the user AppData sub-folders. However that is a restriction by app access and has nothing to do with changing default permissions on those folders. Finally, the Controlled Folders option is not enabled by default.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...