June 8th, 2008, 05:16 AM
Un auth.uninstal of avg antivirus on a workstation
Good morning guys and gals,
I work at a plant nursery in the Netherlands were someone did a illegal uninstal of avg antivirus on a work station(we have no admin to control things)I checked the log of the windows xp pro to see how late it was done.
I only found out the last day it was still working.
Is there a way to find out the time it was uninstalled?
Grtz and thanks.
June 8th, 2008, 09:16 AM
Hi there HotSpot,
I am not aware of any logging in XP that would tell you when something was uninstalled.
The most certain tool for this is eNcase, which is a law enforcement forensics tool. It is very expensive but you might be able to get a time limited trial.
Otherwise I would suggest that you look at data recovery tools which should find the deleted application and give you "last modified" information, which should be the time and date of deletion.
Do you sell cacti and succulents, and do you export to the United Kingdom?
I work at a plant nursery in the Netherlands
June 8th, 2008, 09:38 AM
EnCase would be nice.(no money)
Data recovery would do the trick,i think.
June 8th, 2008, 11:26 AM
June 8th, 2008, 12:24 PM
We think,someone trying to harm the guy who s playing our admin his good name(wich he isn t officially)
And maybe a failed update from 7.5 to 8.0,but it looked like avg was never installed(no map left over on c)is this pos.after a failed update?
June 8th, 2008, 02:01 PM
Someone trying to do harm could do a whole lot worse than installing AVG.
Originally Posted by HotSpot
“Everybody is ignorant, only on different subjects.” — Will Rogers
June 8th, 2008, 02:31 PM
You might try looking in HKEY_CLASSES_ROOT in the Registry (run Regedit) a lot of applications don't totally clear their registry entries when you uninstall them
The entries start with "AVG" and if there is a 7 then that is AVG 7.5
In theory a failed update could have the effect described, as it would uninstall the old version first.
June 8th, 2008, 02:52 PM
thx guys for all the info....i think,we wait en see if this also happens without updating to another version.Grtz all
June 8th, 2008, 05:40 PM
I have just done the update and it does uninstall 7.5 first. I then ran a file recovery tool and it did show the old file and when it got deleted.
June 8th, 2008, 07:17 PM
Try looking in system restore. Usually things such as installation or uninstallation are recorded there.
By cheyenne1212 in forum Miscellaneous Security Discussions
Last Post: February 1st, 2012, 01:51 PM
By dalek in forum Spyware / Adware
Last Post: December 15th, 2005, 10:37 PM
By TSR in forum AntiVirus Discussions
Last Post: July 3rd, 2004, 09:19 PM
By hellforgedangel in forum Newbie Security Questions
Last Post: April 29th, 2004, 10:58 PM
By muffinman in forum AntiOnline's General Chit Chat
Last Post: May 29th, 2003, 04:52 PM