Un auth.uninstal of avg antivirus on a workstation

Good morning guys and gals,
I work at a plant nursery in the Netherlands were someone did a illegal uninstal of avg antivirus on a work station(we have no admin to control things)I checked the log of the windows xp pro to see how late it was done.
I only found out the last day it was still working.
Is there a way to find out the time it was uninstalled?
Grtz and thanks.

Hi there HotSpot,

I am not aware of any logging in XP that would tell you when something was uninstalled.

The most certain tool for this is eNcase, which is a law enforcement forensics tool. It is very expensive but you might be able to get a time limited trial.

Otherwise I would suggest that you look at data recovery tools which should find the deleted application and give you "last modified" information, which should be the time and date of deletion.

//off topic

Quote:

---

I work at a plant nursery in the Netherlands

---

Do you sell cacti and succulents, and do you export to the United Kingdom?

Thx nihil!
EnCase would be nice.(no money)
Data recovery would do the trick,i think.
Thx thx

Hi there HotSpot,

I think that you need to look at your user profiles and permissions? :eek:

What I don't understand is why someone would want to uninstall the anti virus? generally you would just turn it off?

That got me thinking (yeah I know, but it does happen sometimes:D) I use AVG, and it currently wants to update itself from version 7.5 to 8.0

Is it possible that this uninstallation might be the result of a failed upgrade attempt?

Just a thought :)

We think,someone trying to harm the guy who s playing our admin his good name(wich he isn t officially)
And maybe a failed update from 7.5 to 8.0,but it looked like avg was never installed(no map left over on c)is this pos.after a failed update?

Quote:

---

Originally Posted by HotSpot

We think,someone trying to harm the guy who s playing our admin his good name(wich he isn t officially)
And maybe a failed update from 7.5 to 8.0,but it looked like avg was never installed(no map left over on c)is this pos.after a failed update?

---

Someone trying to do harm could do a whole lot worse than installing AVG.

You might try looking in HKEY_CLASSES_ROOT in the Registry (run Regedit) a lot of applications don't totally clear their registry entries when you uninstall them ;)

The entries start with "AVG" and if there is a 7 then that is AVG 7.5

In theory a failed update could have the effect described, as it would uninstall the old version first.

thx guys for all the info....i think,we wait en see if this also happens without updating to another version.Grtz all

Hi HotSpot,

I have just done the update and it does uninstall 7.5 first. I then ran a file recovery tool and it did show the old file and when it got deleted.

Try looking in system restore. Usually things such as installation or uninstallation are recorded there.