Categories

  • Announcements regarding the VulnDetect project

    Archived
    14
    Topics
    123
    Posts

    T

    Version 3.4.0.0 is the latest Stable release.

    It can be downloaded from here:
    https://vulndetect.com/dl/agents/secteerSetup-3.4.0.0.exe
    https://vulndetect.com/dl/agents/secteerSetup-3.4.0.0.msi

  • Post requests for apps that are missing

    Added App Requests
    339
    Topics
    1.6k
    Posts

    OLLI_SO

    Name of the app:
    Patch My PC Home Updater

    Developer:
    Patch My PC

    Website:
    https://patchmypc.com/home-updater

    Download Site:
    https://patchmypc.com/home-updater

    Version number displayed in the app:
    5.0.0.1

    App-Icon:

    PatchMyPC-HomeUpdater_Icon.png

    Here the information extracted from the EXE file:

    File name and path: C:\Program Files\Patch My PC\Patch My PC Home Updater\PatchMyPC-HomeUpdater.exe Product Name: Home Updater Internal Name: ModernHomeUpdater.ClientApp.dll Original Filename: ModernHomeUpdater.ClientApp.dll File Description: PatchMyPC-HomeUpdater Company: Patch My PC Legal Copyright: Legal Trademarks: Comments: Home Updater by Patch my PC File Version String: 5.0.0.1 File Version: 5.0.0.1 Product Version String: 5.0.0.1+67a30fe2f01252c0c02a46d5698b58f615bcc224 Product Version: 5.0.0.1

  • Post requests for apps that you wish to see updated automatically

    22
    Topics
    35
    Posts

    OLLI_SO

    Please add Keeper Password Manager to the Auto-Patching process, so it is automatically updated (when I select it).
    I post one app in one topic, so we can keep the topics smaller.

    For Keeper Password Manager there is a Choko package available:
    https://community.chocolatey.org/packages/keeper

  • Announcements regarding the VulnDetect project

    39
    Topics
    39
    Posts

    T

    Can I uninstall the Agent using the Agent and Custom Software?

    Yes, that is doable, although you won't be able to see the correct state in the Job Activity, because the system won't be able to report back to the backend.

    Here is a PowerShell script that does that:

    # Set environment variables for 32-bit and 64-bit Windows $ProgramData = $env:ProgramData $SecTeer = "SecTeer VulnDetect" $myTaskPath = "\$SecTeer\" if ($env:PROCESSOR_ARCHITECTURE -eq "x86") { $agentRegPath = 'Registry::HKLM\Software\SecTeer\Agent' $appRegPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" $ProgramFiles = "${env:ProgramFiles}" } else { $agentRegPath = 'Registry::HKLM\Software\WOW6432Node\SecTeer\Agent' $appRegPath = "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" $ProgramFiles = "${env:ProgramFiles(x86)}" } $SecTeerPath = Join-Path -Path $ProgramFiles -ChildPath $SecTeer # Determine the uninstall method - prefer EXE uninstaller if available $command = if (Test-Path -Path "$SecTeerPath\unins000.exe") { Join-Path -Path $SecTeerPath -ChildPath "unins000.exe" } elseif (Test-Path -Path "$SecTeerPath\unins001.exe") { Join-Path -Path $SecTeerPath -ChildPath "unins001.exe" } else { $null } # Launch the uninstaller if found, attempt MSI removal otherwise if ($command) { try { $processSpecs = New-Object System.Diagnostics.ProcessStartInfo $processSpecs.FileName = $command $processSpecs.RedirectStandardError = $True $processSpecs.RedirectStandardOutput = $True $processSpecs.UseShellExecute = $False $processSpecs.Arguments = "/VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /NOCANCEL" $process = [System.Diagnostics.Process]::Start($processSpecs) $process.WaitForExit() } catch { Write-Warning "Failed to start the uninstaller process: $_" } } else { try { Uninstall-Package -Name "$SecTeer" -Force -ErrorAction SilentlyContinue } catch { Write-Warning "Failed to uninstall the package: $_" } } # Remove all scheduled tasks related to SecTeer VulnDetect $scheduleTasks = @( "SecTeer VulnDetect*", "SecTeerVulnDetectAgentStateMonitoring", "SecTeerVulnDetectMaintenance*" ) foreach ($taskName in $scheduleTasks) { try { Get-ScheduledTask -TaskName $taskName -TaskPath "\" -ErrorAction SilentlyContinue | Unregister-ScheduledTask -Confirm:$false } catch { Write-Warning "Failed to unregister task $taskName: $_" } } # Clear registry remnants in Add/Remove Programs try { Get-ItemProperty "HKLM:\$appRegPath" | Where-Object { $_.DisplayName -like "$SecTeer*" } | Remove-Item -Force -ErrorAction SilentlyContinue } catch { Write-Warning "Failed to remove registry remnants: $_" } # Purge leftover files and folders try { $folderToRemove = Join-Path -Path $ProgramData -ChildPath $SecTeer Remove-Item -Path $folderToRemove -Recurse -Force -ErrorAction SilentlyContinue } catch { Write-Warning "Failed to remove folder $folderToRemove: $_" } Write-Output "$SecTeer has been successfully removed."

  • Detection errors and issues should be posted here

    Solved Detection Issues
    425
    Topics
    1.8k
    Posts

    G

    @Tom
    Again: 16.0.18025.20104 & 16.0.18025.20096 are unknown
    f77cf35e-6dff-4e04-bca1-5cd569251034-image.png
    ea92801d-dcf2-484b-b637-a767ae54e5ce-image.png
    Hope this helps.
    Regards.

  • Detection errors and issues should be posted here

    Solved Bundling Issues
    43
    Topics
    143
    Posts

    OLLI_SO

    About WSCC

    I am using WSCC (Windows System Control Center) to download and update the following tools:

    MiTeC Utilities NirSoft Utilities Other Utilities Sysinternals Suite

    At the download site of WSCC the portable versions are offered on top, installers are offered below the portable versions.
    I am also using the portable version of WSCC.

    Set-Up of WSCC

    When you extract the portable version to any folder and start it, then a Wizard shown, that helps users setting WSCC up correctly.

    In the first step you can select, what tools you want to install:
    1b597bb9-d6d6-417b-a113-5a891bbfb417-image.png

    For each tool set (like Sysinternals Suite) you can select various options (lie the installation path):
    6abbe750-8ce8-46cd-98ca-2fce8073bb0f-image.png

    The default folders for the tools are:

    %WSCCFOLDER%\Apps\MiTeC Utilities %WSCCFOLDER%\Apps\NirSoft Utilities %WSCCFOLDER%\Apps\Other Utilities %WSCCFOLDER%\Apps\Sysinternals Suite

    For the MiTeC Utilities, the NirSoft Utilities and also the Other Utilities you can also define, if

    only the 32-Bit version should be installed (default option) only the 64-Bit version should be installed both versions (32-Bit and 64-Bit) should be installed

    Default Settings
    c89507e0-288e-49ed-b1d5-c1fe1a8f8a75-image.png

    My Settings
    6de20d91-4a1d-4e3a-966c-e77398ac2df1-image.png
    I selected to install both versions (32-Bit and 64-Bit) support VulnDetect.

    Bundle MiTeC Utilities

    The 32-Bit version and also the 64-Bit version of the MiTeC Utilities are all stored in the same folder.
    Here only the following two applications have a 32-Bit version and also a 64-Bit version:

    %WSCCFOLDER%\Apps\MiTeC Utilities\NetScanner.exe %WSCCFOLDER%\Apps\MiTeC Utilities\NetScanner64.exe %WSCCFOLDER%\Apps\MiTeC Utilities\XMLView.exe %WSCCFOLDER%\Apps\MiTeC Utilities\XMLView64.exe

    It should be easy to bundle them with one rule:

    %WSCCFOLDER%\Apps\MiTeC Utilities\{Application}.exe %WSCCFOLDER%\Apps\MiTeC Utilities\{Application}64.exe

    Please consider, that in the future some more MiTeC tools might have both versions!

    Bundle NirSoft Utilities

    The 32-Bit version of the NirSoft Utilities are placed in the folder:

    %WSCCFOLDER%\Apps\NirSoft Utilities

    The 64-Bit version of the NirSoft Utilities are placed in the sub-folder "\x64":

    %WSCCFOLDER%\Apps\NirSoft Utilities\x64

    Here some examples:

    %WSCCFOLDER%\Apps\NirSoft Utilities\AppReadWriteCounter.exe %WSCCFOLDER%\Apps\NirSoft Utilities\x64\AppReadWriteCounter.exe %WSCCFOLDER%\Apps\NirSoft Utilities\DevManView.exe %WSCCFOLDER%\Apps\NirSoft Utilities\x64\DevManView.exe

    It should be easy to bundle them with one rule:

    %WSCCFOLDER%\Apps\NirSoft Utilities\{Application}.exe %WSCCFOLDER%\Apps\NirSoft Utilities\x64\{Application}.exe Bundle Other Utilities

    The 32-Bit version of the Other Utilities are placed in the folder:

    %WSCCFOLDER%\Apps\Other Utilities

    The 64-Bit version of the Other Utilities are placed in the sub-folder "\x64":

    %WSCCFOLDER%\Apps\Other Utilities\x64

    Here some examples:

    %WSCCFOLDER%\Apps\Other Utilities\Everything.exe %WSCCFOLDER%\Apps\Other Utilities\x64\Everything.exe %WSCCFOLDER%\Apps\Other Utilities\putty.exe %WSCCFOLDER%\Apps\Other Utilities\x64\putty.exe %WSCCFOLDER%\Apps\Other Utilities\SumatraPDF.exe %WSCCFOLDER%\Apps\Other Utilities\x64\SumatraPDF.exe

    It should be easy to bundle them with one rule:

    %WSCCFOLDER%\Apps\Other Utilities\{Application}.exe %WSCCFOLDER%\Apps\Other Utilities\x64\{Application}.exe Bundle Sysinternals Suite

    The tools of the Sysinternals Suite are already bundled,
    Means: when you expand the Sysinternals Suite, then you see each tool only once.

    The only exception here is the tool Sysinternals RegDelNull, that is listed twice:

    C:\PortableApps\PortableApps\_WSCCPortable\Apps\Sysinternals Suite\RegDelNull.exe C:\PortableApps\PortableApps\_WSCCPortable\Apps\Sysinternals Suite\RegDelNull64.exe

    @Tom This is a issue, that sould be fixed!

  • This category will be used to keep track of user contributed suggestions

    Implemented Feature Requests
    143
    Topics
    472
    Posts

    OLLI_SO

    I am using the CSV export on a daily base, it is really very useful.
    But sone things should really be improved.

    Recommended Version
    For some tools (like “MiTeC Icon Explorer") the recommended version (5.2.0) is older, than the installed version (5.3.0). In the list of applications you do not show a recommended version.
    In my CSV export I have 15 applications, where the recommended version is different, but only for 3 entries the recommended version is newer.
    Therefore, the recommended version should not be exported, when it is older or equal to the installed version.

    Export Tool Collections
    All tools from "Sysinternals" are bundled as "Sysinternals Suite".
    The whole suite including all apps is not exported.
    You should export the package headline ("Sysinternals Suite") and also all included tools.
    I do not know if it causes trouble when the package headline ("Sysinternals Suite") has an empty column "File".

    Identical naming for Apps in Tool Collections
    All tools from Sysinternals begin with the text "Sysinternals" (like "Sysinternals DebugView" or "Sysinternals Process Explorer") what is great, when you sort the exported CSV.
    Also all tools from MiTeC begin with the text "MiTeC".
    But only some tools from NirSoft begin with the text "NirSoft" and none of the tools from Nenad Hrg begin with "Nenad Hrg".

    Export status "Patch" and "Update"
    In the UAT instance you show the status "Patch" and "Update".
    This status is not yet exported, but it is really very helpful!

    Please consider these suggestions for the CSV export.

  • This category will be used to keep track of bugs reported by users

    Solved Bugs and Issues
    47
    Topics
    277
    Posts

    OLLI_SO

    @GregAlexandre OK, then I mark this issue as solved.

  • Feel free to discuss what was good or bad in Secunia PSI and what you expect from VulnDetect

    17
    Topics
    68
    Posts

    OLLI_SO

    @Tom The first feedback you have now
    😉