Forum Discussion

crcurran's avatar
crcurran
Active Contributor
7 years ago

'Kaspersky Software Updater' keeps installing, but I got rid of Kaspersky AV

I kept finding it on workstations here and there.  I would uninstall thinking I missed it, but I continued to find it.  I thought maybe there was a remaining workstation acting as a repository and in...
  • GlennD's avatar
    GlennD
    7 years ago

    Hi crcurran,

     

    I understand your concern and would like to reassure you and all of our Central customers, that we closely monitor and review all 3rd party software that we use.  Disabling the Automatic Updates feature will result in the software being removed but, there is also a One2Many script that you can run. I have shared your feedback with the product team.

     

rjp-sh's avatar
rjp-sh
Active Contributor

On many of my users I have recently noticed that 'Kaspersky Software Updater' was installed around the last week of August. As my users do not have permissions to install software and because most of them have this it I can only assume that with the latest LogMeIn updates that this software was installed by them.  With the controversy surrounding Kaspersky it seems this is a bad move on LogMeIn's part - to auto install controversial software on customers machines with no warning or notification. 

 

If people would like to opt-in to this service that seems fine - but to automatically take this step it seems to be a breach of trust on LogMeIn's part.  Is there a way to opt out of this service and remove this software from the LMI Central Control Panel?

 

vinemt's avatar
vinemt
Active Contributor
8 years ago

It looks like LogMeIn autoinstalled Kaspersky Software Updater without asking. Additionally, it was installed in an insecure manner introducing a vulnerability on every machine on my network. It installed the KSU service and gave "Everyone" control over the service therefore unprivileged users can modify the properties of this service, allowing an unprivileged, local attacker to execute arbitrary code or commands as SYSTEM.

 

https://support.microsoft.com/en-us/help/914392/best-practices-and-guidance-for-writers-of-service-discretionary-acces

 

https://msdn.microsoft.com/en-us/library/ms685981(VS.85).aspx

 

This is Unacceptable. Additionally, there doesn't seem to be a silent uninstaller, which means every system must be visited.

 

LogMeIn - where do you get off autoinstalling Kaspersky software onto our machines?

  • vinemt's avatar
    vinemt
    Active Contributor
    8 years ago

    Silent uninstall string is

    msiexec.exe /x{DEEDA858-A9B4-4212-8873-2F2CE2706E68} /qb

     

    It may be part of their new 3rd party software updater system, so if you use that check for further guidance. We don't.

    I'll post back if the software recurs after this removal.

     

    Edit 10/27/17 - So far, no recurrance of the installs.

    • DNA3e8's avatar
      DNA3e8
      New Member
      7 years ago

      From the registry the new guid...

       

       

      MsiExec.exe /X{EB3EB252-23C8-4E03-89DA-3D9BC479BB69} /qb