View Full Version : Trend Micro Officescan 8.x UNINSTALLS SPYBOT!!!
I can't believe there's NADA about this out there. I have no idea where to post this, so here it is:
Our organization has been updated with the latest Trend Micro OfficeScan client/server and when we uninstall the older TM, all is well, but as soon as we install the newer TM OS version, it UNINSTALLS SPYBOT WITHOUT WARNING. I *only* noticed this after watching the installer very carefully after wondering why my Spybot installs were going MIA and discovered a quick flash of a screen in the TM installer right before it does its pre-install scan, which says it's uninstalling SSD.
WHAT GIVES?! Can we get some news on this issue? TM is mum and I see nothing here or elsewhere. The best I get is somebody's "Cons:" mention on a download.com or similar downloads page.
Who knows what's goign on and WHY???
If this is prevented in v1.5, I'd like to know. If not, I'd still like to know what's going on...and no one is saying anythign about it???
Someone MOVED this message, but apparently prefers to continue the silence.
Does SS&D CONFLICT with TM?
Does TM CONFLICTwith SS&D?
Does TM think that SS&D is an AFFLICTION?
If I install SS&D v1.5.x+ will IT UNINSTALL TM?!?!
Am I simply caught in some nonsensical "turf war" between SS&D and TM?!?!
ANYONE?!?!
This is nuts! Not even a clue?!
Hello.
No one has a clue, not even PepiMK???
Someone MOVED this message, but apparently prefers to continue the silence.
Does SS&D CONFLICT with TM?
Does TM CONFLICTwith SS&D?
Does TM think that SS&D is an AFFLICTION?
If I install SS&D v1.5.x+ will IT UNINSTALL TM?!?!
Am I simply caught in some nonsensical "turf war" between SS&D and TM?!?!
ANYONE?!?!
This is nuts! Not even a clue?!
I moved your topic to the correct forum, doing such does not imply the same person will answer.
Spybot-S&D has no war with anyone but malware. ;)
It is the weekend, however I am sure the developer will take note of this topic and address any issues with TM.
A forum search will show several topics regarding TM.
http://forums.spybot.info/showthread.php?t=11569
http://forums.spybot.info/showthread.php?p=71799
http://forums.spybot.info/showthread.php?t=9535
Best regards.
I searched forever on *all* forums for "trend micro" and NEVER found any of those threads...but lots of other unrelated musings.
Thanks for pointing them out.
At least someone knows what's going on, and is working on it...contrary to the dearth of info. out there.
TM has a lot of nerve doing this without any warning whatsoever. THEY should have contacted SS&D before they let their product uninstall like this. That's just plain lousy customer support and ignorance of the customer experience.
Give 'em hell, even if politely...!
lovestolaff
2007-10-25, 14:23
Dear Admin:
You're NOT crazy. I have found that there is a conflict between TM Officescan 8 and the new version of Spybot, 1.5. I'm not sure what you mean about Officescan uninstalling Spybot, but on my machine what happens is that each time TM does a scheduled scan, it reverses the changes that SB made to my hosts directory, and identifies those changes as having been made by an adware called memwatcher. It seems unable to distinguish between Spybot having put those bad sites in the forbidden zone, and an adware having opened up the computer to those bad sites. It's really annoying. I can have my spybot protections for a week, but each time the scheduled TM scan comes around, it undoes whatever protections spybot gave to my hosts directory.
Like you, I have found exactly NADA about this. I called up the IT people here to alert them to the problem, and their advice was to uninstall TM Officescan and then reinstall. I have not tried this yet, because I just haven't had time, and I'm not certain it will work. If you go ahead and try that method, could you please let us know if it works?
I am so glad to find SOMEbody else who has noticed this TM/SB problem.:laugh:
spybotsandra
2007-10-25, 15:08
Hello,
We are actually trying to solve this problem with TrendMicro. But there's absolutely no reason for them to uninstall Spybot-S&D.
If some parts would conflict, just those parts could be disabled.
It seems that the problem is one of Trendmicro's processes, PcScnSrv.exe, that conflicts with our immunize feature - and Trend Micro wants to turn the immunization off.
That's the way to deactivate the immunization of Spybot-S&D:
Run Spybot-S&D, switch to the "Advanced mode" via the menu bar item "Mode" --> hit "YES" --> select "Tools" in the navigation bar on the left --> "Resident" and there you can untick the checkboxes in front of "Resident SDHelper".
Please have a look at this Trend Micro support solution: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1033903
I'm sorry that there is no other solution at the moment.
Please be patient, we are working on this problem.
This item has also been discussed in our forum:
http://forums.spybot.info/showthread.php?t=9535
@RUAdmin: what do you mean with "your organization"?
Do you use Spybot - Search & Destroy in a corporate environment?
Best regards
Sandra
Team Spybot
RUAdmin, can you please describe what you mean with the fact that office scan is uninstalling Spybot? You are using Spybot 1.5? Which version of OfficeScan are you using?
And to be accurate Trend Micro is working on the problem because its their problem/bug or whatever they want to call it. So we cannot say exactly when it is solved
We are actually trying to solve this problem with TrendMicro. But there's absolutely no reason for them to uninstall Spybot-S&D.
If some parts would conflict, just those parts could be disabled.
Exactly!
Uninstalling without warning is the WORST customer experience possible. Not only did TM leave us clueless, but they did so without warning and by using dynamite to flatten an anthill and without even consulting Safer Networking, apparently. TM's handling of their own lacking programming only adds insult to their moronic injury!
The fact that this has been going on for over a year makes it even worse. And I thought Symantec and McAfee were bad...sheesh!
Maybe it's time to put the warning in the Spybot install as well (check for TM's junk -PcScnSrv.exe- and throw a panel during install or just add it as a warning in an existing file/panel), since TM could care less and treats you guys worse than malware (half of the things Trend finds it can't uninstall - there's some irony)!
I'm sorry that there is no other solution at the moment.
Please be patient, we are working on this problem.
Thanks for the tips and the acknowledgment! The shrugging of shoulders on both sides was maddening...
At least I know it's "known" and I can stop thinking it's just my system (and stop wasting any more time on it).
@RUAdmin: what do you mean with "your organization"?
Do you use Spybot - Search & Destroy in a corporate environment?
No, my organization uses TM, and it is site-licensed for home use as well, which means when I install it on my personal system, it uninstalls my personal install of Spybot. Of course, others have noticed the same thing, and we were all getting nowhere fast until I noticed the TM connection and then tried to figure out why...
RUAdmin, can you please describe what you mean with the fact that office scan is uninstalling Spybot? You are using Spybot 1.5? Which version of OfficeScan are you using?
And to be accurate Trend Micro is working on the problem because its their problem/bug or whatever they want to call it. So we cannot say exactly when it is solved
Ages ago, I installed TM OS v7, then installed SS&D v1.4 and all was well for some time. Within the past year or so, TM released v8 (their first Vista-friendly version, although I'm using XP Pro) and when it installs, it QUICKLY and without any meaningful notification, fully uninstalls SS&D.
I do not know if TM OS v7 would have uninstalled SS&D v1.4 if I had installed them in reverse order, nor do I know if TM OS v8 uninstalls just v1.4 or also v1.5 or even any other SS&D version that may have been installed at the time.
After TM OS v8 uninstalled SS&D v1.4, I installed SS&D v1.5 and all seems OK, so the issue is with TM's installer and it's secretive and unwarranted SS&D prejudice. Seems you were all just as blind-sided by TM as us...
I have seen the same problem with Trend. When I log on to a client pc under administrator privilages a window pops up very quickly uninstalling Spybot. It something about Trend Micro, but it's been too quick to read. Sure enough, looking at the Programs menu, Spybot is gone.
Did anyone ever find the reason for this?
This is the client/server version of Trend micro.
Trend Micro tells us that they don't need a reason - Symantec did it, McAfee does it, and we should just f... off.
Still waiting for the lawyers to sort this out, Trend Micro imho has already received a Cease & Decist, but you know how legal steps usually take months to years...
In my opinion, software that forcily removes other legit security software is just malware. Don't want to lower us to their moral level though, even though it's sometimes itching to react the same ugly way ;)
Trend Micro is keen on removing competing software. Load AVG anti-virus, then install Office Scan, and see what happens. Bingo, AVG gone!
I'm assuming they do this to Spybot to eliminate competition between the two detections.
scottt732
2008-02-01, 22:14
I've been struggling with this w/OfficeScan 8 at my org for 6+ months. We recommend SpyBot in addition to Trend. Here's what I've discovered so far...
Search for tmun (no extension) and tmuninst.ptn on the OfficeScan servers. Edit them in notepad and remove the Spybot entry:
[Spybot Search & Destroy 1.3/1.4]
ProductKey = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spybot - Search & Destroy_is1
UninstallKey = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spybot - Search & Destroy_is1
Platform = WinNT
UnloadProgram = GenericUnload
UninstProduct = UninstSpybot13
Support = 1
These appear in several directories as loose files, in several zip files, and in a .cab file. Chime in if you find it anywhere else.
Look here:
Program Files\Trend Micro\OfficeScan\PCCSRV\Admin
Program Files\Trend Micro\OfficeScan\PCCSRV\Download\tmnewpnt.zip
Program Files\Trend Micro\OfficeScan\PCCSRV\Download\tmnewpX64.zip
Program Files\Trend Micro\OfficeScan\PCCSRV\Backup\Patch1.1_B1117\Web_OSCE\Web_console\HTML\ClientInstall\Install.cab
Program Files\Trend Micro\OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\ClientInstall\WinNTWinNT.cab
I think the first dir is used by the client packager, the next 2 are used by OSCE client software update process, and the last 2 are when using the web installer.
Not sure if it's worth affecting these files in the backup directories...
Program Files\Trend Micro\OfficeScan\PCCSRV\Backup\ {{PATCH #}}} \Download\tmnewpnt.zip
Program Files\Trend Micro\OfficeScan\PCCSRV\Backup\ {{PATCH #}}} \Download\tmnewpX64.zip
The web-install cabs are signed & timestamped by Trend. Not sure if this is to make IE happy w.r.t the web installer or to make Trend happy via some integrity checks. If it's the latter, it means no tampering is allowed. If its the former, you could probably get away with it by re-signing the cabs with your own code signing cert (if all of your clients trust your CA certificate) and/or a commercial one.
You'll probably have to rebuild client installers with the Client Packager to prevent them from removing SpyBot after making changes.
P.S., you'll probably have to repeat this every time you patch your OfficeScan servers or write some script/app to do it for you
The described behaviour of the Trend Micro software, if correct is at best rogue behaviour. The simplest and most fitting solution is to change to another product.
This gets worse and worse. While searching for some info about this on Trend Micro's site, I came across a pdf document entitled Defending Against Spyware (http://us.trendmicro.com/imperia/md/content/us/pdf/products/smallbusiness/clientservermessagingforsmb/wp04spyed_060906us.pdf) . Here's something I found in that document:
http://lh5.google.com/JoyfulChristine/R9K_BtPoF6I/AAAAAAAABGM/KIDeB3SJXTo/s400/AnyC00015.jpg
This seems more than unprofessional on Trend Micro's part. I'm a bit surprised!
..c..
i have just installed Trend Worry Free 5.0 (replaces CSM3.6) I have my home pc loaded with this and when it upgraded the client on my pc it unistalled spybot 1.5.2, this is really crap, is there anything that can be done ?