Problem with Track-It! Help Desk Software

Discussion in 'ESET NOD32 Antivirus' started by angelo_lopes, Oct 31, 2008.

Thread Status:
Not open for further replies.
  1. angelo_lopes

    angelo_lopes Registered Member

    Joined:
    Mar 6, 2004
    Posts:
    145
    Location:
    Porto, Portugal
    Track-It! Help Desk Software relies on the process Audit32.exe to audit my network computers hardware and software. Computers keep "collecting" the Audit32.exe icon on the systray, and Task Manager shows lots of Audit32.exe processes running.

    track-it_audit32.png

    The only way to avoid this I found was to Exclude Program Files from being scanned, but this is too dangerous. Any clue?

    Thanks in advance
     
  2. SmackyTheFrog

    SmackyTheFrog Registered Member

    Joined:
    Nov 5, 2007
    Posts:
    767
    Location:
    Lansing, Michigan
    Use FileMon to monitor the ekrn.exe or Audit32.exe process and see what is being scanned to cause this kind of re-initialization loop. To be clear, is Audit32.exe the server service to the application or an endpoint client process? If it is a server process, you should configure Nod32 to exclude the database and log files from scanning or conflicts arise. This is a best-practice for any application running a database.
     
  3. angelo_lopes

    angelo_lopes Registered Member

    Joined:
    Mar 6, 2004
    Posts:
    145
    Location:
    Porto, Portugal
    As far as Numara Software (http://www.numarasoftware.com/Track-It.asp) told us, only Program Files is being scanned. Track-It! looks for .exe files to audit installed software. Audit32.exe is an endpoint client process.
     
  4. SmackyTheFrog

    SmackyTheFrog Registered Member

    Joined:
    Nov 5, 2007
    Posts:
    767
    Location:
    Lansing, Michigan
    If that is the behavior and function of the software, odds are you will just need an exclusion set up for it. It is acting as a sort of scanning engine and will generate a bunch of filesystem activity which can cause conflicts with your AV product, much in the same way running two different antivirus products on the same PC could. The most likely scenario is that Audit32.exe tries to open another .exe file, the Nod32 kernel jumps in and grabs the file to scan and Track-It doesn't handle this gracefully and spawns a new process.
     
Thread Status:
Not open for further replies.