Can't get fresh install of Secure Endpoint, nor can I uninstall. HELP!

[amaraolimb]

Hello, I woke up this morning to some of my apps not working, this was not after an update or a new install of the software. It seems certain apps are being shut down by the virus protection which is suddenly Secure Endpoint instead of Windows Defender.

I never purchased or downloaded this software onto my personal device.
No idea how it got here, and when I tried to uninstall it, it required a password. My admin password for my login was insufficient, so I attempted to delete the files manually. Unfortunately, now this program is in place of the original antivirus, and there is no way for me to open the app because it is no longer on the computer. Additionally, it seems I need to be a business to redownload a trial of the app. 

I am very confused and frustrated. Is there any way to get an install of this program just so I can uninstall it and remove it from my computer?

[Marvin Rhoads]

It could have been added to your Cisco Secure Client as part of a corporate VPN setup. There is no way Cisco can install the software themselves without some system to which you connect having been configured to deploy the Secure Endpoint client module.

You could possibly do a system restore to a previous snapshot if you haven't disabled that feature in Windows.

[amaraolimb]

The system restore I have is only for today, after this was inexplicably installed. Given that i don't have any work accounts on my personal desktio I'm stumped. Its possible that because my parents and i share a microsoft account, that they added a work account to the desktop they used, but I don't see how it could have a program install on my desktop? 

[Kasun Bandara]

hi @amaraolimb , is this laptop managed under corporate policies? if so there can be limits to remove/install software in your device which needs your company admin's support. 

[amaraolimb]

No there is not. This is my personal desktop, not associated with any company or business, which is why this is so perplexing 

[Kasun Bandara]

@amaraolimb hi, ok. do you have admin permission to your laptop? if your laptop is not part of any corporate MDM or any other software which blocking the admin permission, you should be able to do uninstall and re-install. normally, secure client need to be installed by any previous user or owner and its not any default software installed in fresh laptop/PC. 

[amaraolimb]

I have admin permissionn and it's requiring a password that isn't my admin password. I have no idea what that password could be

[Matthew Franks]

Connector protection passwords are not generally the same as the admin password and can be set per policy in Secure Endpoint. As I suggested in another comment, you should probably open a TAC case so they can provide information on which organization has installed Secure Endpoint on your machine. Then, we can try to coordinate communication to get it removed.

Thanks,

-Matt

[amaraolimb · Accepted solution]

I finally found what it was! It was a trojan horse disguising itself as a Cisco program. I had to wipe my drive as it was preventing internet access, and it would automatically start even if I used the most elevated privileges to stop it service side. I'm glad to know that there was realistically no way for me to get this service as this is a personal machine. I'll be on the lookout if something like this ever happens again. Thank you for the help!

[Matthew Franks]

Would you be able to provide any more information on this trojan? We would like to investigate something pretending to be our service.

Thanks,

-Matt

[Matthew Franks]

If you can open a case with TAC, they can gather some information and determine which organization installed Secure Endpoint. Then, you can reach out and ask them to uninstall it remotely. You mentioned there is an uninstall password, so you won't be able to do it locally unless you somehow have the password.