08-04-2011 07:06 PM
The TMWhite CPR pattern version 0.680.09 that will address your case is now available at the
This will update the Intellitrap Exception Pattern to version 0.680.09
To deploy this pattern file simply extract the contents of
the tmw680.zip file to the following directory on the OfficeScan Server:
…\Program Files\Trend Micro\OfficeScan\PCCSRV
That would shortly deploy to your Officescan Clients.
If you want to do it manual on the client itself, you can extract on the working client folder ( e.g. \Officescan Client\ )
Reload All TrendMicro services for this take effect.
I hope this helps...
08-06-2011 12:40 AM
Try this site:
08-16-2011 06:02 AM - last edited on 08-16-2011 02:17 PM by JSMO
Still says PAK_ScramUPX and deletes the file.
IntelliTrap Exception Pattern 0.683.00 Tmwhite.683
Try again trend micro...
[Mod Note: Removed .exe file to conform to the guidelines]
08-17-2011 10:33 AM
Remvoed the link to the file... okay heres the page with the latest version of tdsskiller
Still need this whitelisted. I'm going to have our business partners contact trend micro since this seems to be a major issue with trend's inability to whitelist something in a timely fashion. Oh btw we have roughly 100k computers with office scan on them.... not a "small" business by any means...
08-17-2011 03:01 PM
I use tmwhite pattern 0.685 and the file is not detected anymore.
By the way, the file is dated 08/11/2011, so it is a new version and has to be whitelisted again.
It is not a "inability to whitelist something" from Trend...
As workaround for future versions, you may exclude TDSSKiller.exe from beeing scanned by OfficeScan.
08-17-2011 03:48 PM - edited 08-17-2011 03:52 PM
Ah I see they did update the file recently....
So I need to notify trend micro every single time this file is updated. Which is understandable givin the nature of whitelists. I just wish there was an easier way to get something whitelisted.
Thanks for the quick responce.
Just updated the signatures from the server, downloaded the file. Officescan did not delete it. YAY!