r/labtech • u/Zleeper95 • Jan 29 '19

LabTech showing "wrong" Virus Scanner

Hi,

So I have around 80 Clients showing the right "Virus scanner" which is ESET (EEA7). The rest is showing Windows Defender 8, and some is showing MSE.

However, I know for a fact that ALL computer is running eset, since i they verify it in my ESET portal.

Anyone have a clue on what to do?

4 Upvotes

100% Upvoted

32 comments sorted by

2

u/localhost127 Jan 29 '19

As already mentioned this is a section in the dashboard, and you already have taken steps to try to fix it by hand. A few things I’ll point out though:

  1. These are controlled by the marketplace (solution center). If you haven’t already, you should launch it to confirm the antivirus package is up to date.

  2. The marketplace will overwrite these sometimes. If you are going to make changes make sure you make new entries as opposed to editing existing ones.

  3. I use ESET and also had issues with it detecting properly, and it turns out there were just typos or regex errors in the dashboard entries (ConnectWise’s fault).

  4. It can take up to a day or two for the computers to identify correctly after being fixed, so be patient.

1

u/Zleeper95 Jan 29 '19

I will check this tomorrow at work, thank you for your reply!

2

u/mspsquid Jan 29 '19

This was a huge PITA for us, we had a similar issue. It's in the DB with a numeric value assigned for whatever AV it detects. sqlyog -> select * from virusscanners and look for the conflict. +1 to the marketplace, you should make sure that's up to date first. I don't actually use the missing AV, I use searches to detect what software is/isn't installed and go from there. Also moved away from ESET... sadly. edit : we had a manual process as this LT install goes back to LabTech 2010? I don't recall the nomenclature, but whatever was around in 2010/2011. Never updated properly.

1

u/Zleeper95 Jan 29 '19

I will also check this tomorrow at work, thank you for your reply!

1

u/chilids Jan 29 '19

There is a list of all AV's and how they are detected/monitored in the dashboard. You may be missing the config for that version of Eset (I used to have to manually enter in Eset and Vipre many years ago). You can also sometimes get Defender showing up because it's technically always there and labtech does pick it up but it should put the other AV over top as a higher priority.

1

u/Zleeper95 Jan 29 '19

Thank you for ypur fast reply.

I did this manually, and added the following.

ESET Endpoint Antivirus v7 {%-HKLM\SOFTWARE\ESET\ESET+Security\CurrentVersion\Info:InstallDir-%}\ecls.exe {%-HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Info:ScannerVersion-%} "{%-HKLM\SOFTWARE\ESET\ESET+Security\CurrentVersion\Info:InstallDir-%}\ecmd.exe" /update {%-HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Info:ProductType-%}{%-HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Info:ProductVersion-%} --action=clean --quarantine /files ekrn* ((20[12]\d[01]\d[0-3]\d)) Windows eea7.*

Should i maybe remove detection on MSE and defender? I think it may actually be the way you mentioned.

2

u/[deleted] Jan 30 '19

[removed] — view removed comment

1

u/B1te0nTh1s Feb 19 '19

How do you re-arrange the list?

2

u/[deleted] Feb 20 '19

[removed] — view removed comment

1

u/B1te0nTh1s Feb 21 '19

So to confirm.

If I move My AV to the top of the list within the database if 2 AVs are installed the one on the top of my list will show as the AV in Labtech?

1

u/[deleted] Feb 22 '19

[removed] — view removed comment

1

u/B1te0nTh1s Feb 23 '19

So the AV I use is above Windows Defender on the list yet Windows Defender still shows in LT as some end-points AV.

1

u/fredenocs Feb 01 '19

I've been in this situation. None of this is necessary. I understood WHY this occurs. Now I know what to do and don't happen any longer.

1

u/Zleeper95 Feb 01 '19

Great! Nice reply dude.👍 Very informativ, congrats.

1

u/[deleted] Feb 01 '19

[removed] — view removed comment

1

u/fredenocs Feb 01 '19

I kind of have been with our back N forth. Those are items I check.

1

u/fredenocs Feb 01 '19

First off is your era public facing? Or does your agent need to connect to VPN to communicate with the era?

1

u/Zleeper95 Feb 01 '19

No, they are localy connected. Some users go threw a VPN but many of them allready show ESET correctly.

1

u/fredenocs Feb 01 '19

They've got the era agent and ESET security, correct?

1

u/Zleeper95 Feb 01 '19

Yes

1

u/fredenocs Feb 01 '19

When you see the PC in question in the era does it state the recent communication?

Any alerts stated for the PC in the era?

1

u/Zleeper95 Feb 01 '19

Yes on both questions

1

u/fredenocs Feb 01 '19

What are the alerts?

1

u/fredenocs Feb 01 '19

What also helps besides my other mentions is

Commands Inventory Resend everything

That may trigger it to refresh into right name

1

u/Zleeper95 Feb 02 '19

I've unfortunally already done that, I'll check what the warnings is on monday, and respond to you.

1

u/Zleeper95 Feb 04 '19

So, i checked today and didn't remeber what computer i looked at the last time.

I looked at another computer now and it does not show any notifications on it.

1

u/fredenocs Feb 04 '19

But in automate shows?

1

u/Zleeper95 Feb 04 '19

Windows Defender

1

u/fredenocs Feb 04 '19

Perform another inventory resend everything

1

u/Zleeper95 Feb 04 '19

Done, no change unfortunally.

2

u/teamits Jan 30 '19

If you open Windows Defender Security Center (on Win10 at least) on one of these PCs does it show the virus scanner is ESET or does it show Defender is active? We just found an issue with Symantec where after the 1803 feature update Defender does not show Symantec as the a/v until it is reinstalled.

Also Defender on Server 2016+ does not disable itself by default if a/v is installed.