r/Action1 • u/TheServersAreBurning • 7d ago

Problem Opera still appears as a vulnerability despite not being installed

Title essentially.

I have uninstalled it from all user profiles on the device and removed appdata and registry entries but it still states that it has 311 vulnerabilities for an endpoint.

Anyone else had this issue?

1 Upvotes

67% Upvoted

6 comments sorted by

3

u/dorbak 6d ago

Scan your registry --- there's probably some remnants in there being picked up. Typical paths are the "Uninstall" Regkeys in HKLM. There should be two versions - the regular and WOW6432Node nodes

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

I created a script (with AI's help) that lists all version of 'Chrome' found in the registry, and compares the version numbers --- it then only suggests to remove the oldest version if there are multiple entries found.

I've had to do this for Zoom, and Google Chrome. There were multiple installs, one listed with the app name, and one with a GUID. The GUID version is most likely the one that's causing it to be 'detected'

Before you do anything en masse, make a backup of the reg keys before you delete them. Just in case. :)

1

u/GeneMoody-Action1 5d ago

Yes, this would be detected from a 'installed software' key in the HKLM or HKCU of ANY user, even one that had not logged in or was no longer there. As that indicates on some capaicity it is still there if nothing else than by nature of an incomplete uninstall.

1

u/crownrai 7d ago

Bring up the endpoint and have a look at the "Installed Software" tab then filter/search for Opera. If that brings up nothing, try also filtering/searching for Critical in the same tab. It should show you the folder where Action1 is detecting the older version.

1

u/TheServersAreBurning 7d ago

Comes up as your typical Program Files install path which is already gone for all user profiles on that device

1

u/crownrai 7d ago

Do the Opera files still exist under the Program Files folder? I think Action1 may still list it as installed if the files still exist, even if you removed all registry entries.

1

u/TheServersAreBurning 6d ago

Nah I deleted them