Jump to content

Unknown application installed/uninstalled


Recommended Posts

We received (see below) the following from one of our agents (followed up by a similar 1 new application has been uninstalled with the same lack of details).

Our client claims they ran an regular monthly update for a database application on that server, but this is the first time I've seen this kind of alert from Pulseway.

I've looked at the event logs for the time period when the alerts came out & I'm not seeing anything particular.

The only thing recently (5/18) installed the Shopping App by Ask (which I'm not particularly excited about).

Anyone else ever run into this kind of thing?

--

Hi Engineering,

1 new application has been installed on computer '****MachineNameRedacted****' in group '****GroupNameRedacted****'

Application Name:
Version: Unknown
Publisher: Unknown

Regards,
Pulseway Server

EventLog.png

RecentInstalls.png

Link to post
Share on other sites
  • 2 weeks later...
  • Administrators

Hi David,

We monitor the registry root key for uninstall and it's possible that there was some software that tested the access rights to see if they can create the registry values and then removed them, Pulseway might have caught that bogus data.

Do let us know if this happens again.

Paul

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Similar Content

    • By OnsiteITservices
      Using USB external hard drive as backup devices and each drive can be recognized if manually added to the notifications/storage screen but I need to know if there is a way to set this to be automatic when the drive is replaced either daily or weekly.  Also, where would this be set globally for are servers being monitored. Currently have 8.6.8.
       
      Thank you,
      Todd Kollars
      Onsite IT Services
    • By Canadian Dental Services
      Hi all,
      I recently did a clean upgrade to Windows 10 on 2 WKSTs previously running Windows 7 with Pulseway installed.  I am now at a loss as to how to re-add these units to my Pulseway instance.
      I see they are still showing up in the “Deployment Successful” tab under “Discovery & Deployment”.
      Is there a way to re-add these units without manually installing the Pulseway app on these WKSTs?
    • By RingTailedLemur7
      Hello, I have a question about the Pulseway app. When the pc is on all of the commands work great and are perfect for managing the pc. But I am attempting to turn on my pc when I am away from my home and then be able to fully control it like I was there. The issue is how the wake up command from sleep or from powered down will not work even when on my home network. How can I fix this. Also a side question, is there a way I would be able to see a live view of the screen or does it only allow screenshots of the screen. Thanks
    • By DQuiram
      We reinstalled Pulseway on a re-imaged system and after the install we noticed issues. In the patch mgmt section, the status was "assign failed" in red. We rebooted the system and then the service was not starting. We checked the service, it was set to start automatically and in the event log it was generating this error: "Service cannot be started.  The handle is invalid"  We removed the system from Pulseway, uninstalled, and reinstalled. Service is starting normally, but still getting the same issue of the patch policy failing to assign. I tried moving the system to another group that did not have a patch policy at all and got the same result. 
    • By Brant
      I've implemented a script that retrieves and stores the Windows Build Version number to a custom field in the system overview.   It works fine on MOST systems.  However, there are a small number systems that are unable to run the script.  The error message displayed includes: Start-Process : This command cannot be run due to the error: The system cannot find the file specified.
      I used the "Insert Output Variable Code" in the script and verified that it includes the inserted text "Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable  .....".
      For some reason, a few systems do not seem to have the environment variable PWY_HOME set.
      It appears that these systems are using the Enable PowerShell User Impersonation option under Pulseway Manger > Settings > Runtime.
      What is the easiest way to make sure that all of my systems have the PWY_HOME variable set so that any future scripts will not fail because of a missing environment variable?
      Thanks,
      Brant
×
×
  • Create New...