Business Security Forum

[jeradhollerbach]

Same problem here ... On one of my 80 plus workstations (possibly more, the only one I have noticed to this point) running Windows XP Pro SP3 (in a Trend Micro WFBS v 6 SP 1 environment) the Trend Micro realtime scan engine starts up but then stop right away. If I go into the administrative tools/services and manually restart the realtime scan engine it will then stay running as long as the computer is running. I have verified that the odbcbcp.dll is located in the c:\windows\system32 directory ... Hopeful someone has found a solution for this!

[PCGTech]

GerardR,

Have you made any progress with this? This has been affecting our company too. One note I would like to make on these machines that are having this issue is that it started after we created a group policy that locked our user's homepage. We noticed this after we ran a MalwareBytes scan and it picks this setting up as a false/positive called hijack.homepage. It sees this as a threat and lets you remove it.

[Mod Note: Removed content that could harm an operators computer - Reg Edit]

[jayd]

Hi Jeradhollerbach,

You can try to request for HF that will retry initial 3 times for vsapi. In this manner we can avoid realtime scan to stop randomly.

HF 1727 for WFBS 6.

HF 2272 for WFBS 6 SP1.

Thank you,

GerardR

[NicolasN]

I am experiencing the same issues on our WFBS Adv 6 installation on SBS 2003 SP2.  The Trend Micro Client/Server Security Agent RealTime Scan service stops of its own accord and without any errors being shown in the system or application event logs.  The agent icon turns red.  Manually restarting the service from the Computer Management console is always successful.

This only occurs on our SBS server itself, and not on the Windows 7, Windows XP SP3, or Windows XP SP2 clients.  The has only appeared since upgrading from WFBS Adv 5.1 to WFBS Adv 6.0 (although not immediately) and was not resolved by installing SP1 for WFBS.

As previously recommended in this thread, I have checked and odbcbcp.dll is found in System32.

I suspect that it may be an system resources issue due to our daily backup running each night.  We are backing up approx 160Gb every night to an external USB disk.  I have not way of confirming this since there are no errors shown in the event logs to pinpoint the time when the service stops so that I cn try to detect a pattern.

I will try the autopcc.exe -f trick and see if it helps although I doubt it.

@gerardr: Where can we find a description for HF 1727/2272, and where can we download them?

Thanks.

[NicolasN]

Ok, I can confirm it does not seem to be related to our backup schedule. Backup ran last on Friday night, and the Trend Service was still running fine on Sunday morning according to the server performace report.

I have run the autopcc.exe -f and restarted the server.

Any suggestions?

[jayd]

Hi NicolasN,

Here are the overview of the hotfix 1727 and 2272

For WFBS 6
HF 1727
   This hot fix resolves the following issue:

   Issue:    The Trend Micro Client/Server Security Agent RealTime Scan
             service failed to start due to the following error:
             The service did not respond to the start or control request
             in a timely fashion.
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   Solution: The hot fix 1727 will add retry behavior in the
             Client/Server Security Agent to avoide realtime scan
             stopping intermittently.

For WFBS 6 SP1

HF 2272
1. Overview of this Hot Fix Release
   This hot fix resolves the following issue:

   Issue:   The Ntrtscan of Client/Server Security Agent may crash when
            initial VSAPI and get pattern information
           
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   Solution:After applying this hot fix, the Worry-Free Business Security
            Scan Engine is updated to version 9.160.1006 and the problem
            would be fixed

You can also request for a debug build of ntrtscan.exe first to support engineer before applying the hotfix.

Please call us on the number below closest to your region

For US and Canada customer: 1-888-608-1009

For Australia : 1800-201-122

For New Zealand: 0800-888-190

Thank you,

GerardR

[FTL]

Gerardr

Where can i obtain those hotfixes from please?

I am experienceing the same problem as NicholasN on a SBS 2003 box.

Real time scanner service just stops randomly, manually restarting sorts it but i cannot sit in front of the server all day every day watching and waiting for the RT Scanner to stop to manually restart.

Thanks

[NicolasN]

Hello Gerard,

HF 2272 sound like it could be the one I am looking for.  I am going to do some further investigating to see if it is only crashing during pattern updates, which is what I understand HF 2272 addresses...

This is the current version info (ignoring patterns) on the affected SBS machine:

Main program: 16.0.2122

Virus scan engine (32-bit): 9.100.1001

Spyware scan engine (32-bit): 6.2.3012

URL filtering engine: 3.0.1029

Smart feedback engine: 2.5.1028

Anti-rootkit driver: 2.80.1063

Virus cleanup engine: 6.2.1016

Common firewall driver (32-bit): 5.8.1092

Thanks,

Nicolas

[NicolasN]

I have upgraded to WFBS 6.0 SP2.  Please install from your server console, not from remote desktop, if you don't want issues with the Plug-In Manager. I'll report how it goes...

[jayd]

Hi FTL,

Please call us on the number below closest to your region to request for hf

For US and Canada customer: 1-888-608-1009

For Australia : 1800-201-122

For New Zealand: 0800-888-190

Thank you,

GerardR