if log-File C:\Windows\Logs\SecTeer\secteer.log stopps after "Enumerating MSI data"

cdqEAW67 · 27 May 2019, 21:32

Not really a bug with secteer but may be a problem with some older/rare msi-Files and so more a hint:

I observed on my machines, that the agent stopped working after "Enumerating MSI data". exe/agent were still running (so no "die" of process/service).

As the agent is running as a service it can't display windows to the users (silent).
When running from a Admin-CMD the Windows Installer comes up with message-windows and i had to fix 2 msi -files: "Windows Installer: The feature you are trying to use is on a network resource that is anavailiable. --> Browse...". One was located on a DVD and one on "C:\Users...\AppData\Local\Temp....". Both from programs i would not request from you to be detected!!

I re-created the files, put them to a persistant location on HDD, followed the instuctions of windows installer and on next run secteer runs on the MSI-Topics with success.

Tom · 28 May 2019, 18:21

Hi,

Thanks for reporting this. Sounds like an interesting issue.

Will look at it and see if we can reproduce and work around it.

/Tom

Tom · 6 May 2019, 06:54

We have made some changes to how we handle the enumeration of MSI data, we hope this will prevent this behavior.

You can download the latest agent here:
https://vulndetect.com/dl/secteerSetup.exe

Again, thank you for reporting these issues.

cdqEAW67 · 8 Jun 2019, 13:54

After making my special-msi unavailiable the 1.0.7.0 is continuing the scan and submits the data (checked with agent and --immediate).
So it's OK now!!
Thx

Tom · 8 Jun 2019, 18:00

@cdqEAW67 Awesome and thank you