1

Under control panel -> programs and features, I see CrowdStrike Windows Sensor was installed recently, but I did not install it. I can't actually find the program anywhere on my computer. What can I do to see where this program came from, where it is installed, if it is running, and if it is legit?

I should add that is an old work computer. I haven't connected to the work network in some time, so I thought that meant I wouldn't be getting updates, but I guess that assumption could be flawed.

Improve this question
4
  • 1
    First time user here, can you offer anything more helpful than a downvote? Perhaps a comment explaining why this is a poor question.
    – Learning2Code
    Apr 3, 2017 at 19:12
  • Check here: kb.mit.edu/confluence/display/istcontrib/… and if it's not available to uninstall from those options, reinstall the app and then check to see if the uninstall option is available from add remove programs... ist.mit.edu/crowdstrike/falcon ... Otherwise, reach out to the vendor for their cleanup tool to uninstall from Windows when the option is not available to do so but you know 100% for sure the software is installed...
    – Vomit IT - Chunky Mess Style
    Apr 3, 2017 at 19:49
  • @ModeratorImpersonator Thank you, that is helpful for uninstalling, but I really would like to determine how it got there in the first place.
    – Learning2Code
    Apr 4, 2017 at 15:07
  • You know the history of the PC so asking how something happened to your PC is 100% guessing by anyone other than you or those who have had physical possession of it. Unless you're a computer forensic scientist and spending the hours getting the data from your machine, you will likely never know. I'm sure you could figure it out though if you spent the time doing so, learning, etc. sure you could, go for it!! Otherwise, chaulk it up to a one-time mystery, resolve the problem, and move on to the next chapter of your book.... the Holy Book... can I get an Amen!!
    – Vomit IT - Chunky Mess Style
    Apr 4, 2017 at 15:47

3 Answers 3

Reset to default
1

How did you get in the first place? Chances are it was pushed to your system by your system administrator. CrowdStrike is an AntiVirus product typically used in corporate/enterprise environment. The installer log may have been overwritten by now but you can bet it came from your system admins.

You can run

sc query csagent

to view its running status,

netstat -f

to see CS sensor cloud connectivity, some connection to aws.

There may be some remnants of logs in these locations: 

%LOCALAPPDATA%\Temp
%SYSTEMROOT%\Temp

CS is installed in:

C:\Windows\System32\drivers\CrowdStrike

Improve this answer
0

CrowdStrike is an AntiVirus program. Likely your work uses it and probably it has always been on your computer, or at least since the last time you connected to your work environment. There is a setting in CrowdStrike that allows for the deployed sensors (i.e. the one on your computer) to automatically update. If the computer in question was connected to the internet, then likely it simply auto updated on it's own because a new version of the Windows Sensor was available.

Improve this answer
-1

you can used WMI (Win32_Product)and grep for this patern "Crowdstrike","CrowdStrike, Inc." or used WMI (Win32_Service) and grep for this patern csagent is running

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .