Jump to content

Eset Inspect Detection


Go to solution Solved by Marcos,

Recommended Posts

Hello together

I have distributed Eset antivirus and inspect to clients in our company.
Now I get 3 messages from these clients in Eset inspect every day at exactly the same time:

 
Suspicious script interpreter started - cscript [F0447b]
 
cscript.exe (3880)
//B //nologo "C:\Windows\TEMP\.eset-66311189630874\uacinstall.vbs"
 

Suspicious PowerShell Script - Behavior [D1202]

cscript.exe (3880)

//B //nologo "C:\Windows\TEMP\.eset-66311189630874\uacinstall.vbs"

 

Process cscript.exe creates an external network connection [A0500b]

cscript.exe (3880)

//B //nologo "C:\Windows\TEMP\.eset-66311189630874\uacinstall.vbs"

 

I don't understand exactly what uacinstall.vbs does. From Eset protect and inspect it looks like everything is installed and other messages come in. So Eset seems to be working.

 

Thanks for the answer!

Link to comment
Share on other sites

  • Administrators
  • Solution

uacinstall.vbs is dropped by the management agent script installer. You can create an exception for it.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...