5 Replies Latest reply on Nov 2, 2010 7:22 AM by sundi712

    AV deleting Quickbooks executable?

    Perfetti Rookie

      Has anyone heard of Landesk AV deleteling the Quickbooks file remoteassist.exe?      We have Landesk version 9 sp1.  User has the latest virus defination file an this is the latest version of Quickbooks.  We have spoken with Quickbooks Support and they are pointing to AV.

        • 1. Re: AV deleting Quickbooks executable?
          rmeyer SupportEmployee

          LANDesk AV should not delete the file. It should quarantine it if it detects a virus or spyware on it that it cannot clean. If the file is being deleted, you should open a case with LANDesk support.

          1 of 1 people found this helpful
          • 2. Re: AV deleting Quickbooks executable?
            Apprentice

            Did you ever get this resolved? I did have this happen to a client. LDAV keeps detecting the QuickBooks files, including RemoteAssist.exe, as Risky (a Remote/WinVNC based file) although it is not. It did not delete the files but would Quarantine them. The user can add the files to the Trusted Items list but the next time the computer starts LDAV detects these files again and Quarantines them.

             

            I am using LDv9 SP1. I have the "Scan for risky software in addition to viruses" option enabled in the LDAV settings. I believe that they are using the latest version of QuickBooks. They were ok with just restoring the files upon every restart for now- I haven't had much of a chance to research the issue. The attached screenshot shows the files that are quarantined everytime.

            • 3. Re: AV deleting Quickbooks executable?
              rmeyer SupportEmployee

              The issue is resolved by installing the patch AV-4861790.1-2 or SP2.

              • 4. Re: AV deleting Quickbooks executable?
                Perfetti Rookie

                Thanks all.

                 

                We are planning on installing SP2 to resolve the issue, until then we have a workaround for the user using an exception.

                • 5. Re: AV deleting Quickbooks executable?
                  Apprentice

                  did you use HIPS to create the exception or just the LDAV configuration? We do not have HIPS and unfortunately with LDAV you have to specify the exact path. These Quickbook files are created in the user temp folder when the application runs.

                   

                  Also rmeyer, can this issue be resolved on the client side by just installiing the client patch before we apply SP2 on the core or is SP2 also needed? We will be holding off on upgrading our core until mid or end of November.