if log-File C:\Windows\Logs\SecTeer\secteer.log stopps after "Enumerating MSI data"

cdqEAW67

Not really a bug with secteer but may be a problem with some older/rare msi-Files and so more a hint:

I observed on my machines, that the agent stopped working after "Enumerating MSI data". exe/agent were still running (so no "die" of process/service).

As the agent is running as a service it can't display windows to the users (silent).
When running from a Admin-CMD the Windows Installer comes up with message-windows and i had to fix 2 msi -files: "Windows Installer: The feature you are trying to use is on a network resource that is anavailiable. --> Browse...". One was located on a DVD and one on "C:\Users...\AppData\Local\Temp....". Both from programs i would not request from you to be detected!!

I re-created the files, put them to a persistant location on HDD, followed the instuctions of windows installer and on next run secteer runs on the MSI-Topics with success.

Tom

Hi,

Thanks for reporting this. Sounds like an interesting issue.

Will look at it and see if we can reproduce and work around it.

/Tom

Tom

We have made some changes to how we handle the enumeration of MSI data, we hope this will prevent this behavior.

You can download the latest agent here:
https://vulndetect.com/dl/secteerSetup.exe

Again, thank you for reporting these issues.

cdqEAW67

After making my special-msi unavailiable the 1.0.7.0 is continuing the scan and submits the data (checked with agent and --immediate).
So it's OK now!! :+1:
Thx

Tom

@cdqEAW67 Awesome and thank you