Technical Tidbits

On September 5, I published the first Too Many Trojan’s post about TrendMicro reporting windows files and program files as Trojan’s and quarantining them.

Well, it happened again! Today!

I sent my analysis files to TrendMicro via our PartnerNet but I think I have the culprit found! I wanted to put this out there so you know and I did alert Trend to this possibility.

I believe the running of TeaTimer from Spybot Search and Destroy is the problem. I just tested my theory and so far the problem seems resolved.

1. Turn off TeaTimer.

2. Delete the files under C:\Program Files\Trend Micro (and then your software - mine was under Internet Security) named: lpt$vpn. There will be at least one if not more. Any file starting with that name delete.

3. Reboot your computer.

4. Update Trend again.

5. It will require you to reboot one more time.

6. Re-scan and you should find that it does not quarantine any other files.

If you cannot reboot in normal windows mode, Trend has the directions to reboot in safe mode here:

http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1038089&id=EN-1038089

And if this does become the reason for the problem, remember it was posted here first! We always keep you ahead of security!

written by Admin \\ tags: infected system files, Internet Security Pro, spybot, spybot S&D, spybot search and destroy, system files, TeaTimer, Trend Micro, trendmicro, TROJ_Generic, TROJ_Generic.adv, TROJ_Generic_adv

If you have TrendMicro Internet Security Pro and have done a scan to find that you have far too many TROJ_Generic and/or TROJ_Generic.adv files in your quarantine - and you look at the list finding Windows Systems files, you DO NOT have a Trojan in your computer system. This is a newly discovered problem in TrendMIcro pattern file updates and you need to fix the problem.

The fix currently may or may not work in all cases. If this fix does not work for you, you must call customer support to get additional assistance.  Home / Home Office Users: +1 (800) 864-6027, SMB +1 (888) 762-8736

The Fix:

1. Go to MY COMPUTER and double-click to open the C Drive.

2. Go to PROGRAM FILES and find the TREND MICRO folder.

3. Find all files named: lpt$vpn (they will also have a dot (.) and a 3-digit number after them. As in, lpt$vpn.521 or similar.

4. Delete all files named in this manner.

5. Reboot your machine.

6. Open Trend and click the UPDATE NOW button. (You may have to reboot again.)

7. Run a scan.

If the false Trojan files do not appear again, you have fixed the problem.

If the false Trojan’s appear again, the problem is still there and you must call customer support.

written by Admin \\ tags: infected system files, Internet Security Pro, system files, Trend Micro, trendmicro, TROJ_Generic, TROJ_Generic.adv, TROJ_Generic_adv