Un auth.uninstal of avg antivirus on a workstation
Results 1 to 10 of 10

Thread: Un auth.uninstal of avg antivirus on a workstation

  1. #1
    Member
    Join Date
    Sep 2004
    Posts
    32

    Un auth.uninstal of avg antivirus on a workstation

    Good morning guys and gals,
    I work at a plant nursery in the Netherlands were someone did a illegal uninstal of avg antivirus on a work station(we have no admin to control things)I checked the log of the windows xp pro to see how late it was done.
    I only found out the last day it was still working.
    Is there a way to find out the time it was uninstalled?
    Grtz and thanks.

  2. #2
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hi there HotSpot,

    I am not aware of any logging in XP that would tell you when something was uninstalled.

    The most certain tool for this is eNcase, which is a law enforcement forensics tool. It is very expensive but you might be able to get a time limited trial.

    Otherwise I would suggest that you look at data recovery tools which should find the deleted application and give you "last modified" information, which should be the time and date of deletion.

    //off topic

    I work at a plant nursery in the Netherlands
    Do you sell cacti and succulents, and do you export to the United Kingdom?
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  3. #3
    Member
    Join Date
    Sep 2004
    Posts
    32

    Smile

    Thx nihil!
    EnCase would be nice.(no money)
    Data recovery would do the trick,i think.
    Thx thx

  4. #4
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hi there HotSpot,

    I think that you need to look at your user profiles and permissions?

    What I don't understand is why someone would want to uninstall the anti virus? generally you would just turn it off?

    That got me thinking (yeah I know, but it does happen sometimes) I use AVG, and it currently wants to update itself from version 7.5 to 8.0

    Is it possible that this uninstallation might be the result of a failed upgrade attempt?

    Just a thought
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  5. #5
    Member
    Join Date
    Sep 2004
    Posts
    32
    We think,someone trying to harm the guy who s playing our admin his good name(wich he isn t officially)
    And maybe a failed update from 7.5 to 8.0,but it looked like avg was never installed(no map left over on c)is this pos.after a failed update?

  6. #6
    Dissident 4dm1n brokencrow's Avatar
    Join Date
    Feb 2004
    Location
    Shawnee country
    Posts
    1,242
    Quote Originally Posted by HotSpot
    We think,someone trying to harm the guy who s playing our admin his good name(wich he isn t officially)
    And maybe a failed update from 7.5 to 8.0,but it looked like avg was never installed(no map left over on c)is this pos.after a failed update?
    Someone trying to do harm could do a whole lot worse than installing AVG.
    “Everybody is ignorant, only on different subjects.” — Will Rogers

  7. #7
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    You might try looking in HKEY_CLASSES_ROOT in the Registry (run Regedit) a lot of applications don't totally clear their registry entries when you uninstall them

    The entries start with "AVG" and if there is a 7 then that is AVG 7.5

    In theory a failed update could have the effect described, as it would uninstall the old version first.
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  8. #8
    Member
    Join Date
    Sep 2004
    Posts
    32
    thx guys for all the info....i think,we wait en see if this also happens without updating to another version.Grtz all

  9. #9
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hi HotSpot,

    I have just done the update and it does uninstall 7.5 first. I then ran a file recovery tool and it did show the old file and when it got deleted.
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  10. #10
    Senior Member JPnyc's Avatar
    Join Date
    Jan 2005
    Posts
    2,734
    Try looking in system restore. Usually things such as installation or uninstallation are recorded there.

Similar Threads

  1. Windows Error Messages
    By cheyenne1212 in forum Miscellaneous Security Discussions
    Replies: 7
    Last Post: February 1st, 2012, 02:51 PM
  2. Antispyware vs Antivirus
    By dalek in forum Spyware / Adware
    Replies: 9
    Last Post: December 15th, 2005, 11:37 PM
  3. New Version 3.15 of F-Prot Antivirus for Windows
    By TSR in forum AntiVirus Discussions
    Replies: 0
    Last Post: July 3rd, 2004, 10:19 PM
  4. Learning to program from a security point of view
    By hellforgedangel in forum Newbie Security Questions
    Replies: 13
    Last Post: April 29th, 2004, 11:58 PM
  5. I thought this was funny( note the antivirus part)
    By muffinman in forum AntiOnline's General Chit Chat
    Replies: 0
    Last Post: May 29th, 2003, 05:52 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •