HP Support Assistant trying to use SNMP to discover network devices

[jwckauman]

Once a week, the HP Support Assistant running on my computer sends out a SNMP broadcast in an attempt to discover other devices that it might be able to add to "my devices" and help support.  This is causing some errors on some of the devices because we have locked down SNMP in a few places, and my Support Assistant doesn't have the credentials to query those devices.  Is there a way to prevent HP Support Assistant from doing this weekly scan for devices via SNMP?  I like having Support Assistant available for diagnosing issues on my PC and printer, but i don't need this device scan feature.  How do i stop it?  If you can't help, i'll have to just uninstall the software and not use it. 😞

[BrianMcQuaig]

HP needs to address this IMMEDIATELY!

Because none of the documentation says that it does this scanning, and because we are a secure network and want to remain so...we are now having to re-image all of our HP laptops just to ensure there's no malware attached to this utility.

I'm not paying $99 to get a support specialist to tell me what the white paper and the documentation for HP Support Assistant should be telling us.

HP SUPPORT: Does this software scan SNMP ports within a network? Can this feature be turned off? Where in the documentation does it describe this feature and the reasons for it?

[Ferg311]

I agree 100% with the 2 above statements.

This issue is causing my APC UPS to send emails stating:

Informational Events - System: Detected an unauthorized user attempting to access the SNMP interface from172.17.11.111"

 

I was able to create this by running the follow.  

But the issue is that this runs automatically. It runs schedule task or when the HP Support is Updated.

UPDATE:

I was able to create event by running the follow Task.  

PC Health Analysis  (

"C:\Program files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe /L Analysis"

The issue I have is that there is no setting to turn this off without checking health.   I want to recieve updates, but I don't want it to go and find HP products (printers on the network).   The other issue I have is that it hits it 6 times!! 

This must have been a new feature in the past year.

[TanerH]

Agreed.

I first noticed this because my APC UPSes started complaining.  I don't think it's alway been like this, so it must have been a recent update to the HP software.

HP: Please allow us to disable this, thanks.

[PipingRockIT]

I am upvoting this, as we get daily emails from our APC UPS's. And they send a dozen or so emails each. HP, allow us to disable this option!

[PipingRockIT]

Hey HP, any response to this?

[Ed_Scherer]

These are a real nuisance. We've got 4 UPSes with network management cards (APC AP9619) that each complain via e-mail about this SNMP probe, issued by 5 different HP computers running HP Support Assistant. That's a lot of nuisance e-mails.

I finally configured the UPSes to not send e-mails for this event, but I'd rather fix this at the source rather than kluging it by disabling a useful security-related notification.

In case it's of use to others who want to disable the APC Network Management Card e-mails (at least using the same generation of firmware on this rather old APC network card), you can turn off the generation of the e-mails via the network card's web UI using the Administration tab, Notification group, Event Actions / by event in the left pane, then in the System Events colum, the Security entry. Then in the Informational Events in the right pane, you'll see a "System: Detected an unauthorized user attempting to access the SNMP interface" link. Click it, and clear the check boxes for any logs or e-mails you'd like to disable. Apply, and Bob's your uncle.

[TanerH]

While I could disable the email alerts from our UPSes, that is clearly not the correct solution.  In fact, I am glad they sent me email, since I don't want things randomly scanning my network "for me".  I'll assume they are nefarious, unless it's something i initiated, myself.

HP - please let us know how to disable this auto-scanning of the network and incessant probing of SNMP hosts...

[MichelleST]

I'm surprised to find this post, as I've noticed the identical problem. We have an HP Omen PC (IP 192.168.1.132)  that does these SMNP scans of our network, and triggers the APC UPS Network management alert as well. At first I thought it was something compromised that was scanning our network, but learned via this post that it was this one PC.

Name     : Smart-UPS RT 1500 XL

Location : Kamloops Datacentre

Contact  : Admin

http://192.168.1.113

Serial # : [edit]

Device Ser #: [edit]

Date: 03/17/2018

Time: 18:43:33

Code: 0x0004

Informational - System: Detected an unauthorized user attempting to access the SNMP interface from 192.168.1.132.

[turnerjos]

At the risk of "me-tooing" the question, the situation seems to have worsened since the question was first opened.

The HP Support Assistant is no longer listed as an uninstallable component by Windows. At this stage, I'm tempted to characterize this package as malware.