Business Security Forum

[KB8]

The TMWhite CPR pattern version 0.680.09 that will address your case is now available at the
following link:

http://www.trendmicro.com/ftp/products/pattern/intellitrap/cpr/tmw680.zip

This will update the Intellitrap Exception Pattern to version 0.680.09

To deploy this pattern file simply extract the contents of
the tmw680.zip file to the following directory on the OfficeScan Server:

…\Program Files\Trend Micro\OfficeScan\PCCSRV

That would shortly deploy to your Officescan Clients.

If you want to do it manual on the client itself, you can extract on the working client folder ( e.g. \Officescan Client\ )

Reload All TrendMicro services for this take effect.

I hope this helps...

-Gary

[greggmh123]

Try this site:

http://esupport.trendmicro.com/srf/SRFMain.aspx

[zeros]

Still says PAK_ScramUPX and deletes the file.

IntelliTrap Exception Pattern 0.683.00 Tmwhite.683

Try again trend micro...

[Mod Note: Removed .exe file to conform to the guidelines]

[zeros]

Remvoed the link to the file... okay heres the page with the latest version of tdsskiller

http://support.kaspersky.com/faq/?qid=208280684

Still need this whitelisted. I'm going to have our business partners contact trend micro since this seems to be a major issue with trend's inability to whitelist something in a timely fashion. Oh btw we have roughly 100k computers with office scan on them.... not a "small" business by any means...

[ChrisKo]

I use tmwhite pattern 0.685 and the file is not detected anymore.

By the way, the file is dated 08/11/2011, so it is a new version and has to be whitelisted again.

It is not a "inability to whitelist something" from Trend...

As workaround for future versions, you may exclude TDSSKiller.exe from beeing scanned by OfficeScan.

Regards 

[zeros]

Ah I see they did update the file recently....

So I need to notify trend micro every single time this file is updated. Which is understandable givin the nature of whitelists. I just wish there was an easier way to get something whitelisted.

Thanks for the quick responce.

Just updated the signatures from the server, downloaded the file. Officescan did not delete it. YAY!