1. Critical Patch Release Information

Resolved Known Issues

This Critical Patch resolves the following issue(s):

Issue 1 (SEG-2184), (SEG-2185), (SEG-2187), (SEG-2189), (SEG-2443)

An issue related to the Trend Micro OfficeScan Firewall driver may cause multiple Privilege Escalation and Pool Corruption vulnerabilities.

Solution:

This critical patch updates the Trend Micro OfficeScan Firewall driver to resolve the vulnerabilities.

Enhancements

The following enhancements are included in this Critical Patch:

Enhancement 1 (SEG-26512)

This critical patch enables the OfficeScan XG Patch 1 agent program to support Windows 10 (version 1803) April 2018 Update.

Files Included in this Release

     A. Files for Current Issue(s)
     -------------------------------------------------------------------
     Filename                                               Build Number
     ------------------------------                         ------------
     OfficeScan\PCCSRV\
     -------------------------------------------------------------------
     AutoPcc.exe                                            12.0.0.1876
     AutoPccP.exe                                           12.0.0.1876
     CGIResUTF8.dll                                         12.0.0.1876	 
     CGIShare.dll                                           12.0.0.1876
     libNetCtrl.dll                                         13.0.0.1716
     OfcPfwCommon.dll                                       13.0.0.1716

     OfficeScan\PCCSRV\Admin\
     -------------------------------------------------------------------
     loadhttp.dll                                           13.0.0.1716
     tmxfalcon.cfg
     OSCETSCLog.dll                                         13.0.0.1716

     OfficeScan\PCCSRV\Admin\Utility\ClientPackager\
     -------------------------------------------------------------------
     ClnExtor.ini
     ClnPack.ini
     OfcPfwCommon.dll                                       13.0.0.1716

     OfficeScan\PCCSRV\Admin\Utility\EdgeServer\
     -------------------------------------------------------------------
     *.*

     OfficeScan\PCCSRV\Admin\Utility\IpXfer\
     -------------------------------------------------------------------
     IpXfer.exe                                             13.0.0.1716
     IpXfer_x64.exe                                         13.0.0.1716	 
	 
     OfficeScan\PCCSRV\Admin\Utility\listDeviceInfo\
     -------------------------------------------------------------------
     listDeviceInfo.exe                                      6.2.0.1154

     OfficeScan\PCCSRV\Admin\Utility\PolicyExportTool\
     -------------------------------------------------------------------
     CGIResUTF8.dll                                         12.0.0.1876

     OfficeScan\PCCSRV\Admin\Utility\ServerMigrationTool\
     -------------------------------------------------------------------
     ServerMigrationTool.exe                                12.0.0.1876
	 
     OfficeScan\PCCSRV\Admin\Utility\SQL\
     -------------------------------------------------------------------
     *.*
     libSQLDatabaseUpgrade.dll                              12.0.0.1876

     OfficeScan\PCCSRV\Admin\Utility\TMVS\
     -------------------------------------------------------------------
     TMVS.exe                                               12.0.0.1876

     OfficeScan\PCCSRV\Admin\Utility\VSEncrypt\
     -------------------------------------------------------------------
     VSEncode.exe                                           12.0.0.1876
	 
     OfficeScan\PCCSRV\Admin\Autopcc.cfg\
     -------------------------------------------------------------------
     ApNT.ini
     ApNT_X64.ini

     OfficeScan\PCCSRV\CmAgent\
     -------------------------------------------------------------------
     CGIResUTF8.dll                                         12.0.0.1876
     OfcCMAgent.exe                                         12.0.0.1876
     ProductLibrary.dll                                     12.0.0.1876
     ProductUI.zip

     OfficeScan\PCCSRV\Download\
     -------------------------------------------------------------------
     ClnPack_files.xml

     OfficeScan\PCCSRV\Download\Engine\
     -------------------------------------------------------------------
     BMdriver_x32.sig
     BMdriver_x32.zip
     BMdriver_x64.sig
     BMdriver_x64.zip
     bmservice_x32.sig
     bmservice_x32.zip
     bmservice_x64.sig
     bmservice_x64.zip
     falcon32.sig
     falcon32.zip
     falcon64.sig
     falcon64.zip

     OfficeScan\PCCSRV\Download\Pattern\
     -------------------------------------------------------------------
     falconcfg.zip

     OfficeScan\PCCSRV\Download\Product\
     -------------------------------------------------------------------
     DlpLite_Common.zip
     DlpLite_Common_x64.zip

     OfficeScan\PCCSRV\Engine\
     -------------------------------------------------------------------
     TmAegisSysEvt.dll                                     2.976.0.1295
     TMBMCLI.dll                                           2.976.0.1295
     TMBMSRV.exe                                           2.976.0.1295
     tmcomeng.dll                                          2.976.0.1295
     TmEngDrv.dll                                          2.976.0.1295
     TMPEM.dll                                             2.976.0.1295
     tmwlutil.dll                                          2.976.0.1295
     tmCfwApi.dll                                           5.83.0.1038
     tmHash.dll                                             5.83.0.1038
     TmPfw.exe                                              5.83.0.1050
     TmPfwApi.dll                                           5.83.0.1050
     TmPfwRul.dll                                           5.83.0.1038 
     TmSysEVt.dll                                            7.0.0.1160
     tmxfalcon.dll                                           1.2.0.1031

     OfficeScan\PCCSRV\Engine\X64\
     -------------------------------------------------------------------
     TmAegisSysEvt.dll                                     2.976.0.1295
     TMBMCLI.dll                                           2.976.0.1295
     TMBMSRV.exe                                           2.976.0.1295
     tmcomeng.dll                                          2.976.0.1295
     TmEngDrv.dll                                          2.976.0.1295
     TMPEM.dll                                             2.976.0.1295
     tmwlutil.dll                                          2.976.0.1295
     tmCfwApi.dll                                           5.83.0.1038
     tmHash.dll                                             5.83.0.1038
     TmPfw.exe                                              5.83.0.1050
     TmPfwApi.dll                                           5.83.0.1050
     TmPfwRul.dll                                           5.83.0.1038 
     TmSysEVt.dll                                            7.0.0.1160
     tmxfalcon.dll                                           1.2.0.1031

     OfficeScan\PCCSRV\SRS\
     -------------------------------------------------------------------
     SRService.exe                                           3.1.0.1035

     OfficeScan\PCCSRV\WSS\
     -------------------------------------------------------------------
     iCRCService.exe                                         3.1.0.1035

     OfficeScan\PCCSRV\Pccnt\
     -------------------------------------------------------------------
     ClientConsole.zip
     NTMonRes.dll                                           12.0.0.1876
     NTRtScan.exe                                           13.0.0.1716

     OfficeScan\PCCSRV\Pccnt\Common\
     -------------------------------------------------------------------
     com.trendmicro.tmopfirefox.ext.json
     com.trendmicro.tmopfirefox.ext@trendop.xpi
     CCSF_WIN32.zip
     CNTAoSMgr.exe                                           2.3.0.1422
     fcWofieUI.dll                                          13.0.0.1716
     libNetCtrl.dll                                         13.0.0.1716
     loadhttp.dll                                           13.0.0.1716
     NTRmv.exe                                              13.0.0.1716
     ofc_loadhttp.dll                                       13.0.0.1716
     OfcCCCAUpdate.exe                                      13.0.0.1716
     OfcPfwCommon.dll                                       13.0.0.1716
     OfcPfwSvc.dll                                          13.0.0.1716
     PccNTMon.exe                                           13.0.0.1716
     TmListen.exe                                           13.0.0.1678
     TmListen.dll                                           13.0.0.1716
     TmListenShare.dll                                      13.0.0.1716
     TmSock.dll                                             13.0.0.1716
     TmSSClient.exe                                         13.0.0.1716
     TmopCfg.dll                                             3.0.0.1044
     Tmopcfscan.dll                                          3.0.0.1044
     TmopCtl.dll                                             3.0.0.1044
     TmopDbg.dll                                             3.0.0.1044
     TmoppeEvts.dll                                          3.0.0.1044
     TmoppeHosF.dll                                          3.0.0.1044
     TmoppePDP.dll                                           3.0.0.1044
     TmoppeSAL.dll                                           3.0.0.1044
     TmoppeSsF.dll                                           3.0.0.1044
     TmoppeUrlF.dll                                          3.0.0.1044
     TmoppeVS.dll                                            3.0.0.1044
     TmopphHttp.dll                                          3.0.0.1044
     TmopphMsn.dll                                           3.0.0.1044
     TmopphPop3.dll                                          3.0.0.1044
     TmopphSmtp.dll                                          3.0.0.1044
     TmopphYmsg.dll                                          3.0.0.1044
     TmopPlgAdp.dll                                          3.0.0.1044
     Tmopsent.dll                                            3.0.0.1044
     TmopsmHttp.dll                                          3.0.0.1044
     TmopsmIm.dll                                            3.0.0.1044
     TmopsmMail.dll                                          3.0.0.1044
     TmopChromeMsgHost32.exe                                 2.0.0.1094
     TmopExtIns.exe                                          2.0.0.1094
     TmopIEPlg.dll                                           2.0.0.1094
     TmOsprey.dll                                            2.0.0.1094
     Upgrade.exe                                            13.0.0.1716
     tmCfwApi.dll                                           5.83.0.1038
     TmFpHcEx.exe                                           5.83.0.1038
     tmHash.dll                                             5.83.0.1038
     TmPfw.exe                                              5.83.0.1050
     TmPfwApi.dll                                           5.83.0.1050
     TmPfwCtl.dll                                           5.83.0.1050
     TmPfwCtl_xp.dll                                        5.83.0.1038
     TmPfwRul.dll                                           5.83.0.1038
     tmwfpapi.dll                                           5.83.0.1038
     tmufeng                                                 3.9.0.1012

     OfficeScan\PCCSRV\Pccnt\Disk1\
     -------------------------------------------------------------------
     *.*

     OfficeScan\PCCSRV\Pccnt\Drv\
     -------------------------------------------------------------------
     tmactmon.cat
     tmactmon.inf
     tmactmon.sys                                          2.976.0.1293
     tmevtmgr.cat
     tmevtmgr.inf
     tmevtmgr.sys                                          2.976.0.1293
     tmcomm.cat
     tmcomm.inf
     tmcomm.sys                                              7.0.0.1160
     tmeevw.cat                                               
     tmeevw.inf                                               
     tmeevw.sys                                              3.0.0.1005
     tmncieco.dll                                            3.0.0.1064	 
     tmnciesc.cat                                             
     tmnciesc.inf                                             
     tmnciesc.sys                                            3.0.0.1064
     tmlwf.cat
     tmlwf.inf
     TMLWF.sys                                              5.83.0.1038
     tmlwfins.exe                                           5.83.0.1038
     tmwfp.cat
     tmwfp.inf
     TMWFP.sys                                              5.83.0.1051
     tmwfpins.exe                                           5.83.0.1038
     tmusa.cat
     tmusa.inf
     tmusa.sys                                               3.0.0.1025

     OfficeScan\PCCSRV\Pccnt\Drv\X64\
     -------------------------------------------------------------------
     tmactmon.cat
     tmactmon.inf
     tmactmon.sys                                          2.976.0.1293
     tmevtmgr.cat
     tmevtmgr.inf
     tmevtmgr.sys                                          2.976.0.1293
     tmcomm.cat
     tmcomm.inf
     tmcomm.sys                                              7.0.0.1160
     tmeevw.cat                                               
     tmeevw.inf                                               
     tmeevw.sys                                              3.0.0.1005
     tmncieco.dll                                            3.0.0.1064	 
     tmnciesc.cat                                             
     tmnciesc.inf                                             
     tmnciesc.sys                                            3.0.0.1064
     tmlwf.cat
     tmlwf.inf
     TMLWF.sys                                              5.83.0.1038
     tmlwfins.exe                                           5.83.0.1038
     tmwfp.cat
     tmwfp.inf
     TMWFP.sys                                              5.83.0.1051
     tmwfpins.exe                                           5.83.0.1038
     tmusa.cat
     tmusa.inf
     tmusa.sys                                               3.0.0.1025

     OfficeScan\PCCSRV\Pccnt\Win64\X64\
     -------------------------------------------------------------------
     CCSF_X64.zip
     fcWofieUI.dll                                          13.0.0.1716
     libNetCtrl_64x.dll                                     13.0.0.1716
     loadhttp.dll                                           13.0.0.1716
     NTRmv.exe                                              13.0.0.1716
     NtrtScan.exe                                           13.0.0.1716
     ofc_loadhttp_64x.dll                                   13.0.0.1716
     OfcCCCAUpdate.exe                                      13.0.0.1716
     OfcPfwCommon_64x.dll                                   13.0.0.1716
     OfcPfwSvc_64x.dll                                      13.0.0.1716
     PccNTMon.exe                                           13.0.0.1716
     TmListen.exe                                           13.0.0.1678
     TmListen_64x.dll                                       13.0.0.1716
     TmListenShare_64x.dll                                  13.0.0.1716
     TmSSClient.exe                                         13.0.0.1716
     TmopCfg.dll                                             3.0.0.1044
     Tmopcfscan.dll                                          3.0.0.1044
     TmopCtl.dll                                             3.0.0.1044
     TmopDbg.dll                                             3.0.0.1044
     TmoppeEvts.dll                                          3.0.0.1044
     TmoppeHosF.dll                                          3.0.0.1044
     TmoppePDP.dll                                           3.0.0.1044
     TmoppeSAL.dll                                           3.0.0.1044
     TmoppeSsF.dll                                           3.0.0.1044
     TmoppeUrlF.dll                                          3.0.0.1044
     TmoppeVS.dll                                            3.0.0.1044
     TmopphHttp.dll                                          3.0.0.1044
     TmopphMsn.dll                                           3.0.0.1044
     TmopphPop3.dll                                          3.0.0.1044
     TmopphSmtp.dll                                          3.0.0.1044
     TmopphYmsg.dll                                          3.0.0.1044
     TmopPlgAdp.dll                                          3.0.0.1044
     Tmopsent.dll                                            3.0.0.1044
     TmopsmHttp.dll                                          3.0.0.1044
     TmopsmIm.dll                                            3.0.0.1044
     TmopsmMail.dll                                          3.0.0.1044
     TmopExtIns.exe                                          2.0.0.1094
     TmopExtIns32.exe                                        2.0.0.1094
     TmopIEPlg.dll                                           2.0.0.1094
     TmopIEPlg32.dll                                         2.0.0.1094
     TmOsprey.dll                                            2.0.0.1094
     TmOsprey32.dll                                          2.0.0.1094
     TmSock_64x.dll                                         13.0.0.1716
     upgrade.exe                                            13.0.0.1716
     tmCfwApi.dll                                           5.83.0.1038
     TmFpHcEx.exe                                           5.83.0.1038
     tmHash.dll                                             5.83.0.1038
     TmPfw.exe                                              5.83.0.1050
     TmPfwApi.dll                                           5.83.0.1050
     TmPfwCtl.dll                                           5.83.0.1050
     TmPfwCtl_xp.dll                                        5.83.0.1038
     TmPfwRul.dll                                           5.83.0.1038
     tmwfpapi.dll                                           5.83.0.1038
     tmufeng                                                 3.9.0.1012
     OSCETSCLog_64x.dll                                     13.0.0.1716

     OfficeScan\PCCSRV\Private\
     -------------------------------------------------------------------
     DlpClc.xml

     OfficeScan\PCCSRV\Web\Service\
     -------------------------------------------------------------------
     CGIResUTF8.dll                                         12.0.0.1876
     CGIShare.dll                                           12.0.0.1876
     CmdHLClient.dll                                        12.0.0.1876
     CmdHOConsole.dll                                       12.0.0.1876
     cme_dll.dll                                             6.2.0.1189
     cme_vxe_dll_static.dll                                  6.2.0.1189
     DbServer.exe                                           12.0.0.1876
     libCmdHndlrClientV2.dll                                12.0.0.1876
     libCmdHndlrConsoleV2.dll                               12.0.0.1876
     LogCache.dll                                           12.0.0.1876
     OfcCCCAUpdate.exe                                      12.0.0.1876
     OfcDownload.dll                                        12.0.0.1876
     OfcEdgeAgent.exe                                       12.0.0.1876
     OfcNotifyQueue.dll                                     12.0.0.1876
     OfcPfwCommon.dll                                       13.0.0.1716
     OfcService.exe                                         12.0.0.1876
     OSCEIntegrationService.exe                             12.0.0.1876

     OfficeScan\PCCSRV\Web_OSCE\Web\CGI\
     -------------------------------------------------------------------
     cgiGetClient.exe                                       12.0.0.1876
     CGIResUTF8.dll                                         12.0.0.1876
     cgiRqUpd.exe                                           12.0.0.1876
     CGIShare.dll                                           12.0.0.1876
     isapiClient.dll                                        12.0.0.1876
     isapiClientx64.dll                                     12.0.0.1876
     isapiClientX86.dll                                     12.0.0.1876
     OfcPfwCommon.dll                                       13.0.0.1716	 

     OfficeScan\PCCSRV\Web_OSCE\Web_console\CGI\
     -------------------------------------------------------------------
     CGIResUTF8.dll                                         12.0.0.1876
     CGIShare.dll                                           12.0.0.1876
     cgiChkMasterPwd.exe.exe                                12.0.0.1876
     cgiShowActiveDirectory.exe                             12.0.0.1876
     cgiShowClientAdm.exe                                   12.0.0.1876
     cgiShowComplianceReport.exe                            12.0.0.1876
     cgiShowLogs.exe                                        12.0.0.1876
     cgiShowNotify.exe                                      12.0.0.1876 
     cgiShowServerAdm.exe                                   12.0.0.1876
     cgiShowSummary.exe                                     12.0.0.1876
     cgiWebUpdate.ini
     fcgiOfcDDA.exe                                         12.0.0.1876
     OfcPfwCommon.dll                                       13.0.0.1716

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\aegis\
     -------------------------------------------------------------------
     data_protection.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\Auth\
     -------------------------------------------------------------------
     admin_account_info.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\clientmag\
     -------------------------------------------------------------------
     client_ofsc_services.htm
     client_urlfiltering_profiles.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\common\
     -------------------------------------------------------------------
     ln_clientmag.js

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\common\l10n\
     -------------------------------------------------------------------
     l10n.dlp.js
     l10n.logs.js
     l10n.serveradm.js

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\common\dlp\
     -------------------------------------------------------------------
     dlp_FileAttr_addedit.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\common\serveradm\
     -------------------------------------------------------------------
     server_proxy.htm

     OfficeScan\PCCSRV\WEB_OSCE\Web_console\HTML\dlp\
     -------------------------------------------------------------------
     dlp_FileAttr_addedit.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\logs\
     -------------------------------------------------------------------
     log_client_update_detail.htm
     logs_bm_view.htm
     logs_dac_view.htm
     logs_network_malware_view.htm
     logs_pfw_view.htm
     logs_spyware_view.htm
     logs_suspicious_file_view.htm
     logs_trendx_view.htm
     logs_virus_view.htm
     logs_WebSecurity_view.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\notify\
     -------------------------------------------------------------------
     notify_standardalert.htm

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\root\
     -------------------------------------------------------------------
     logon.htm.htm
	 
     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\widget\
     -------------------------------------------------------------------
     db_controller.php
     help_proxy.php

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\widget\inc\class\proxy\
     -------------------------------------------------------------------
     HttpTalk.php

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\widget\repository\widgetPool\wp[number]\inc\
     -------------------------------------------------------------------
     config.php

     *wp[number] depends on user's environment, it would be wp1, wp2...etc

     OfficeScan\PCCSRV\Web_OSCE\Web_console\HTML\widget\repository\widgetPool\wp[number]\interface\
     -------------------------------------------------------------------
     analyzeWF.php

     *wp[number] depends on user's environment, it would be wp1, wp2...etc

     OfficeScan\PCCSRV\Web_OSCE\Web_console\RemoteInstallCGI\
     -------------------------------------------------------------------
     cgiGetNTDomain.exe                                     12.0.0.1876
     CGIOCommon.dll                                         12.0.0.1876
     CGIResUTF8.dll                                         12.0.0.1876
     CGIShare.dll                                           12.0.0.1876

     OfficeScan\PCCSRV\WSS
     -------------------------------------------------------------------
     iCRCService.exe                                        3.1.0.1035
      
    B. Network Traffic Required in Deployment Estimated size (in terms of bandwidth) of deployed agent files in this hot fix.
      - 32-bit agent total = 70.1 MB
      - 64-bit agent total = 94.4 MB

                        

2. Documentation Set

To download or view electronic versions of the documentation set for this product, go to http://docs.trendmicro.com

  • Online Help: The Online Help contains an overview of features and key concepts, and information on configuring and maintaining the product.

To access the Online Help, go to http://docs.trendmicro.com

  • Installation Guide (IG): The Installation Guide contains information on requirements and procedures for installing and deploying the product.
  • Administrator's Guide (AG): The Administrator's Guide contains an overview of features and key concepts, and information on configuring and maintaining the product.
  • Getting Started Guide (GSG): The Getting Started Guide contains product overview, installation planning, installation and configuration instructions, and basic information intended to get the product 'up and running'.
  • Support Portal: The Support Portal contains information on troubleshooting and resolving known issues.
  • To access the Support Portal, go to http://esupport.trendmicro.com

3. System Requirements

1. Trend Micro OfficeScan 12.0 XG - GM - Patch 1 Build 1556 - English - Windows - x32-x64

4. Installation/Uninstallation

Installing

To install:

  1. Copy the hotfix executable file to a temporary folder on the server, for example, "C:\temp".
  2. Double-click the file. The modules are automatically copied to the correct destination.

This hotfix installation package automatically rolls back the OfficeScan server to its previous configuration if there are problems during installation. If you encounter problems after installation, do a manual rollback.

Uninstalling

To manually roll back to the previous build:

  1. Locate the backup folder that the hotfix package created in the "\PCCSRV\Backup\HotFix_B1876" directory.
  2. Stop the OfficeScan Master Service.
  3. Stop the OfficeScan CMAgent Service.
  4. Copy the backup modules to the original folders.
  5. Start the OfficeScan CMAgent Service.
  6. Start the OfficeScan Master Service.

5. Post-installation Configuration

No post-installation steps are required.

NOTE: Trend Micro recommends that you update your scan engine and virus pattern files immediately after installing the product.

6. Known Issues

Known issues in this release:

Known Issue 1

Before deploying this Critical Patch to OfficeScan agents running Windows 10 "April 2018 Update" (v1803), you must add some process exceptions to the Behavior Monitoring Approved List. OfficeScan agents that do not have an updated Approved List may encounter a blue screen of death (BSOD) after applying the Critical Patch. For more details, refer to the following KB: https://success.trendmicro.com/solution/1119990

7. Release History

Prior Hotfixes


Only this hotfix was tested for this release. Prior hotfixes were tested at the time of their release.

Issue 1 of Hotfix 1640

(SEG-1256)

The OfficeScan Behavior Monitoring feature may cause certain computers to lock up intermittently.

Solution:

This hotfix updates the Behavior Monitoring Service module to resolve the issue.

Issue 2 of Hotfix 1640

(SEG-3260)

The OfficeScan Behavior Monitoring feature may block Adobe Acrobat Reader intermittently.

Solution:

This hotfix updates the Behavior Monitoring UMH addon module to resolve the issue.

Issue 3 of Hotfix 1640

(SEG-4711)

The OfficeScan server cannot check the signature on a Control Manager policy if the policy settings contain non-ASCII characters.

Solution:

This hotfix enables the OfficeScan server to handle non-ASCII strings in Control Manager policies to ensure that the server can check the signature of these policies.

Issue 4 of Hotfix 1640

(SEG-3830)

The OfficeScan User Mode Hooking (UMH) function may trigger a false alarm when users access a specific website.

Solution:

This hotfix updates the OfficeScan User Mode Hooking module to resolve this issue.

Issue 5 of Hotfix 1640

(SEG-4824)

DLP generates duplicate violation event logs when users send an email message using Outlook.

Solution:

This hotfix enables the DLP multipart feature in Outlook to prevent duplicate violation event logs when users send email messages in Outlook.

Issue 6 of Hotfix 1640

(SEG-4985)

The executable image hashing takes too much time to complete which may cause a timeout issue while an application connects to its server.

Solution:

This hotfix updates the Network Security Components to ensure that Trend Micro's firewall will asynchronously compute the hash value of the executable image that initiated a connection. While the firewall computes the hash, all rules of the Application Filter will be unavailable until the hash value is computed, preventing the system from blocking the application from its connection.

Issue 7 of Hotfix 1640

(SEG-4008)

The information in the "Message" field in Administrator Notifications cannot be saved successfully if the field contains a tab delimiter.

Solution:

This hotfix updates the OfficeScan server files to ensure that the information can be saved successfully.

Issue 8 of Hotfix 1640

(TT-359239)

The OfficeScan Web Reputation feature blocks normal access to websites if the endpoint also has the Symantec Data Loss Prevention application running.

Solution:

This hotfix updates the OfficeScan agent module to ensure that the OfficeScan Web Reputation feature does not conflict with the Symantec Data Loss Prevention application.

Issue 9 of Hotfix 1640

(SEG-1266)

The UMH driver may block a certain application from running from a UNC path when the "Enable program inspection to detect and blocked compromised executable files" option is enabled.

Solution:

This hotfix updates the UMH driver to ensure that the application can run from a UNC path while the "Enable program inspection to detect and blocked compromised executable files" option is enabled.

Issue 10 of Hotfix 1640

(SEG-2425)

It takes a long time to load a remote PST file in Microsoft(TM) Outlook(TM) when DLP is enabled.

Solution:

This hotfix ensures that Outlook can load remote PST files normally when DLP is enabled.

Issue 11 of Hotfix 1640

(SEG-4948)

The upload of files from an SMB path to the Internet may stop unexpectedly when DLP is enabled.

Solution:

This hotfix adds an SMB checking mechanism that enables DLP to check if a file is from an SMB path before it attempts to access the file information. If the source file is an SMB file, DLP then Impersonates to facilitate the download.

Issue 12 of Hotfix 1640

(SEG-4800)

It takes a long time to copy files using the RDP clipboard when DLP is enabled.

Solution:

This hotfix resolves the issue by adding the RDP process "mstsc.exe" into the approved list.

Issue 13 of Hotfix 1640

(SEG-5807)

The Listdeviceinfo tool cannot get information from the following external devices:

  • LaCie Rugged THB USB3 SCSI Disk Device.
  • Seagate(R) Backup+ Hub BK SCSI Disk Device.
  • Seagate BUP BL SCSI Disk Device.

Solution:

This hotfix resolves this tool issue.

Issue 14 of Hotfix 1640

(SEG-3749)

The TmListen.exe service of the OfficeScan agent stops unexpectedly when Web Reputation Service is running.

Solution:

This hotfix updates the OfficeScan agent programs to prevent TmListen.exe from stopping unexpectedly.

Issue 15 of Hotfix 1640

(SEG-4620)

The agent grouping status switches off unexpectedly after AD synchronization.

Solution:

This hotfix updates the OfficeScan server files to ensure that the agent grouping status remains the same after AD synchronization.

Issue 16 of Hotfix 1640

(SEG-5561)

The OfficeScan agent keeps its old build number even after applying all the latest hotfixes.

Solution:

This hotfix ensures that the TmListen service checks the "hotfix_history.ini" file and updates the build number during start up.

Issue 17 of Hotfix 1640

(SEG-5527)

On computers running on the Microsoft(TM) Windows(TM) 10 platform, the DLP network filter driver is installed with the TDI network filter driver.

Solution:

This hotfix updates the operating system version determination mechanism to ensure that the correct driver is installed. This hotfix also provides a WFP driver replacement mechanism that replaces the TDI driver with the correct driver.

Issue 18 of Hotfix 1640

(SEG-6408)

The DLP module may not work normally while other programs are uploading files to the Internet.

Solution:

This hotfix ensures that the DLP module works normally when other programs are to uploading files to the Internet.

Issue 19 of Hotfix 1640

(SEG-5843)

When the DLP multipart scan feature is enabled, all violations triggered in Microsoft Outlook for different users appear under the first login user.

Solution:

This hotfix enables the DLP module to check the process owner according to process ID before scanning to ensure that each violation appears under the correct user account.

Issue 20 of Hotfix 1640

(SEG-2791)

BSOD occurs when the "Suspicious Connection Settings" are enabled.

Solution:

This hotfix updates the Network Content Inspection Engine to prevent the BSOD issue.

Issue 21 of Hotfix 1640

(SEG-3830)

The OfficeScan User Mode Hooking (UMH) function may trigger a false alarm when users access a specific website.

Solution:

This hotfix updates the OfficeScan User Mode Hooking module to resolve this issue.

Issue 22 of Hotfix 1640

(SEG-5202)

The OfficeScan Behavior Monitoring feature may cause certain operating systems to stop unexpectedly when users launch an Intel driver packed as a self-extracting RAR file.

Solution:

This hotfix updates the Behavior Monitoring Service module to resolve the issue.

Issue 23 of Hotfix 1640

(SEG-4800)

It takes a long time to copy files using the RDP clipboard when DLP is enabled.

Solution:

This hotfix resolves the issue by adding the RDP process "mstsc.exe" into the approved list.

Issue 24 of Hotfix 1640

(SEG-2425)

It takes a long time to load a remote PST file in Microsoft(TM) Outlook(TM) when DLP is enabled.

Solution:

This hotfix ensures that Outlook can load remote PST files normally when DLP is enabled.

Issue 25 of Hotfix 1640

(TT-348875)

A USB floppy disk drive cannot be added into the exception list of removable storage devices in the DLP Policy Settings.

Solution:

This hotfix ensures that users can add USB floppy disk drives into the DLP exception list of removable storage in the DLP Policy Settings.

Issue 26 of Hotfix 1640

(TT-355419)

The Lumension Heat patching software may stop unexpectedly when DLP is enabled.

Solution:

This hotfix resolves the issue by preventing DLP from excluding the following two processes:

  • XMLDeltaParser.exe
  • DAgent.exe

Issue 27 of Hotfix 1640

(SEG-5807)

The Listdeviceinfo tool cannot get information from the following external devices:

  • LaCie Rugged THB USB3 SCSI Disk Device
  • Seagate(R) Backup+ Hub BK SCSI Disk Device
  • Seagate BUP BL SCSI Disk Device

Solution:

This hotfix resolves this tool issue.

Issue 28 of Hotfix 1640

(TT-357926)

DLP does not block the most current webmail sites like "Outlook.com".

Solution:

This hotfix resolves this issue.

Issue 29 of Hotfix 1640

(TT-356728)

DLP blocks the Exodus Jabber program unexpectedly.

Solution:

This hotfix ensures that the Exodus Jabber program works normally when DLP is enabled on the endpoint machines.

Issue 30 of Hotfix 1640

(TT-358910)

Microsoft Access (.mdb) files cannot be recovered to USB storage from the DLP backup folder.

Solution:

This hotfix ensures that DLP can successfully recover Microsoft Access (.mdb) files.

Issue 31 of Hotfix 1640

(SEG-4948)

The upload of files from an SMB path to the Internet may stop unexpectedly when DLP is enabled.

Solution:

This hotfix adds an SMB checking mechanism that enables DLP to check if a file is from an SMB path before it attempts to access the file information. If the source file is an SMB file, DLP then Impersonates to facilitate the download.

Issue 32 of Hotfix 1640

(TT-358095)

DLP does not block users from dragging and dropping files on to current webmail sites such as "Outlook.office.com" or "Outlook.live.com in Google Chrome.

Solution:

This hotfix ensures that OfficeScan can effectively block sensitive information from leaking when users use Google Chrome to access webmail sites.

Issue 33 of Hotfix 1640

(SEG-6008)

The 32-bit installer generated by the Client Packager tool does not work.

Solution:

This hotfix ensures that users can install OfficeScan clients using the 32-bit installer package generated by the Client Packager tool.

Issue 34 of Hotfix 1640

(SEG-3077)

The "Suspicious Object List Setting page" has a wording error.

Solution:

This hotfix corrects the wording of the "Suspicious Object List Setting" page.

Issue 35 of Hotfix 1640

When using the Microsoft SQL database, OfficeScan may receive ADO exception errors caused by a NULL value passing onto a stored procedure.

Solution:

This hotfix updates the OfficeScan file to prevent this issue from occurring.

Issue 36 of Hotfix 1640

Microsoft Internet Explorer stops responding when it transfers files using Microsoft SharePoint.

Solution:

This hotfix resolves this issue.

Issue 37 of Hotfix 1640

(SEG-7410)

When Data Loss Prevention (DLP) detects that sensitive information was sent through an email message, the OfficeScan agent generates a blank "Activity/Channel" log.

Solution:

This hotfix resolves this issue.

Issue 38 of Hotfix 1640

(SEG-7412)

Multiple Data Loss Prevention (DLP) violation events appear after the first user justification window. This issue occurs when users send sensitive content using Microsoft(TM) Outlook.

Solution:

This hotfix resolves this issue by refining the timestamp recording mechanism of the sent email item. After applying this hotfix, the system only records the timestamp after it returns the user justification action to filter out the incorrect triggered email event caused by Microsoft Outlook.

Issue 39 of Hotfix 1640

(SEG-6632)

The agent grouping status switches off unexpectedly after AD synchronization.

Solution:

This hotfix updates the OfficeScan server files to ensure that the agent grouping status remains the same after AD synchronization.

Issue 40 of Hotfix 1640

(SEG-3830)

The OfficeScan User Mode Hooking (UMH) function may trigger a false alarm when users access a specific website.

Solution:

This hotfix updates the OfficeScan User Mode Hooking module to resolve this issue.

Issue 41 of Hotfix 1640

When using the Microsoft SQL database, OfficeScan may receive ADO exception errors caused by a NULL value passing onto a stored procedure.

Solution:

This hotfix updates the OfficeScan file to prevent this issue from occurring.

Issue 42 of Hotfix 1640

(VRTS-1014)

A vulnerability may allow a remote unauthenticated attacker to send CGI requests to run "fcgiOfcDDA.exe" on the OfficeScan server and trigger " fcgiOfcDDA.exe " to stop unexpectedly. When this happens, a large number of dump files are generated which can eventually take up a large portion of disk space.

Solution:

This hotfix resolves the vulnerability.

Issue 43 of Hotfix 1640

(VRTS-1022)

A vulnerability may allow a remote unauthenticated attacker to send CGI requests to run "cgiRqUpd.exe" on the OfficeScan server and trigger "cgiRqUpd.exe" to stop unexpectedly. When this happens, a large number of dump files are generated which can eventually take up a large portion of disk space.

Solution:

This hotfix resolves the vulnerability.

Issue 44 of Hotfix 1640

(SEG-7829)

The list of supported platforms in the "Additional Service Settings" page of the OfficeScan XG web console does not include the new Windows Server 2016 platform.

Solution:

This hotfix adds the new Windows Server 2016 platform to the supported platform list on the "Additional Service Settings" page.

Issue 45 of Hotfix 1640

(SEG-7354)

The OfficeScan agent keeps its old build number even after applying all the latest hotfixes.

Solution:

This hotfix ensures that the TmListen service checks the "hotfix_history.ini" file and updates the build number during start up.

Issue 46 of Hotfix 1640

(VRTS-994)

Attackers may be able to launch Pre-Auth Server Side Request Forgery attacks through the "help_Proxy.php" functionality.

Solution:

This hotfix resolves this issue by updating the "help_Proxy.php" file and hard-coding it to connect to the Trend Online Help page.

Issue 47 of Hotfix 1640

(SEG-4418)

OfficeScan clients running on Windows platforms stop responding while shutting down or restarting.

Solution:

This hotfix prevents this issue by improving the way processes read information using the lookaside list when the Unauthorized Change Prevention Service is de-initializing.

Issue 48 of Hotfix 1640

(SEG-7825)

The Outbreak Prevention Policy cannot block access to SMB shared folders.

Solution:

This hotfix enables OfficeScan to terminate the current connection when enabling the Outbreak Prevention Policy to help ensure that the policy can block access to SMB folders successfully.

Procedure:

To enable the new service settings:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following key and set its value to "1".
  • [Global Setting]
  • cnqConnectionTermination=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro \PC-cillinNTCorp\CurrentVersion\Misc.
  • Key: cnqConnectionTermination
  • Type: DWORD
  • Value:
    • 0 = OfficeScan does not support network re-establish
    • 1 = OfficeScan supports network re-establish

NOTE: This function works only on computers that retrieve its IP address from the DHCP server automatically.

Issue 49 of Hotfix 1640

(SEG-7580)

An issue prevents users from adding another gateway IP address for an endpoint location.

Solution:

This hotfix ensures that users can configure additional gateway IP addresses for an endpoint location.

Issue 50 of Hotfix 1640

(VRTS-986)

A vulnerability may allow a remote unauthenticated attacker to download the "crypt.key" file from the OfficeScan server through HTTP requests.

Solution:

This hotfix resolves the vulnerability.

Enhancement 1 of Hotfix 1640

(SEG-5670)

This hotfix enables DLP Endpoint SDK 6.0 to support Chrome 58.0.3029.81.

Enhancement 2 of Hotfix 1640

(SEG-6057)

This hotfix enables DLP Endpoint SDK 6.2 to support Chrome 58.0.3029.81.

Enhancement 3 of Hotfix 1640

(SEG-4910)

This hotfix enables Administrators to use an apostrophe (') in the "Description" text box when they add or modify a web console account.

Enhancement 4 of Hotfix 1640

(SEG-6057)

This hotfix enables DLP Endpoint SDK 6.2 to support Chrome 58.0.3029.81.

Enhancement 5 of Hotfix 1640

This hotfix enables Data Loss Prevention Endpoint SDK 6.0 to support Google(TM) Chrome version 59.0.3071.86

Enhancement 6 of Hotfix 1640

This hotfix enables Data Loss Prevention Endpoint SDK 6.2 to bypass iTunes blocking and so that iPhone can still be charged while Device Control is enabled.

Procedure:

To configure the new setting for DLP:

  1. Install this hotfix (see "Installation").
  2. Open the "dlp.ini" file in the "\PCCSRV\Private\" folder on the OfficeScan server.
  3. Under the "Configure" section, manually add the "bypass_itunes_nonstor_usb_dc" key and set its value.
  • [Configure]
  • bypass_itunes_nonstor_usb_dc=true
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and click "Agents > Agent Management > Select domains or agents > Settings > DLP settings".
  3. Click "Save" to deploy the settings to agents. The OfficeScan server deploys the settings to OfficeScan agents and adds the following key in the "dsa.pro" file in the "\Windows\System32\dgagent\" folder: bypass_itunes_nonstor_usb_dc=true

Enhancement 7 of Hotfix 1640

This hotfix provides additional details in the Component Update Details log files. It includes the following information:

  • Domain Hierarchy of endpoint
  • IP Address of endpoint

Enhancement 8 of Hotfix 1640

This hotfix enables Data Loss Prevention Endpoint SDK 6.2 to support the following Google(TM) Chrome versions:

  • Google(TM) Chrome version 58.0.3029.110m.
  • Google Chrome version 59.0.3071.86

Enhancement 9 of Hotfix 1640

This hotfix enables Data Loss Prevention Endpoint SDK 6.2 to support the following Google(TM) Chrome versions:

  • Google Chrome version 58.0.3029.110m.
  • Google Chrome version 59.0.3071.86

Issue 1 of Hotfix 1656

(SEG-9014)

An issue related to the OfficeScan UMH driver triggers BSOD.

Solution:

This hotfix updates the UMH driver to resolve the issue.

Issue 2 of Hotfix 1656

(VRTS-1012)

Remote unauthenticated attackers may be able to query NT domains through the OfficeScan XG "cgiGetNTDomain.exe" process.

Solution:

This hotfix removes the vulnerability.

Issue 1 of Hotfix 1660

(SEG-7249)

The OfficeScan Predictive Machine Learning feature blocks users from publishing documents from Microsoft Outlook.

Solution:

This hotfix changes the share write property of the ATSE to resolve this issue.

Issue 2 of Hotfix 1660

(SEG-7730)

BSOD occurs when users run Microsoft Office on OfficeScan client computers.

Solution:

This hotfix removes an unnecessary string comparison step to ensure that Microsoft Office runs normally on protected computers.

Issue 3 of Hotfix 1660

(SEG-8631)

Sometimes, the Windows Security Center indicates that OfficeScan is not running even when it is enabled and running and sends users an important message to enable the OfficeScan Antivirus.

Solution:

This hotfix updates the OfficeScan agent file to resolve the issue.

Issue 4 of Hotfix 1660

(SEG-9007)

OfficeScan agents display the following message even when the program components are up-to-date. "Update Now: You have not received a new update in 1 days."

Solution:

This hotfix updates the OfficeScan agent program to resolve the issue.

Issue 1 of Hotfix 1666

(VRTS-1115)

Web server details gathered from the banner may allow attackers to search and launch automated attacks from commonly-found web sites which may lead to website defacement or denial of service.

Solution:

This hotfix resolves the vulnerability.

Issue 2 of Hotfix 1666

(SEG-10356)

Users encounter a sharing violation issue related to the ntrtscan and iexplorer processes after enabling the OfficeScan Predictive Machine Learning feature in a computer that has a multiple core CPU.

Solution:

This hotfix changes to add some sharing mode for the file open.

Issue 3 of Hotfix 1666

(SEG-9016)

An issue related to the Unauthorized Change Prevention service can prevent the OfficeScan Device Control feature from applying the correct policies in computers running on the Windows 10 platform.

Solution:

This hotfix allows users to enable OfficeScan to support the detection and termination of processes on USB drives using the "run as admin" feature. This helps resolve the issue.

Procedure:

To enable the new settings:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following key and set its value to "1".
  • [Global Setting]
  • EnableDACTerminate=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.
  4. Restart the Behavior Monitoring service on clients.

Issue 1 of Critical Patch 1680

(VRTS-986)

A vulnerability may allow an attacker to download the specific file from the OfficeScan server through HTTP requests.

Solution:

This critical patch resolves the vulnerability.

Issue 2 of Critical Patch 1680

(VRTS-989)

A PHP file in OfficeScan XG may be vulnerable to an MITM/RCE vulnerability.

Solution:

This critical patch resolves the potential vulnerability.

Issue 3 of Critical Patch 1680

(VRTS-994)

Attackers may be able to launch Pre-Auth Server Side Request Forgery attacks through the specific php functionality.

Solution:

This critical patch resolves this issue by updating the specific php file and hard-coding it to connect to the Trend Online Help page.

Issue 4 of Critical Patch 1680

(VRTS-1012)

An attacker may be able to query NT domains through the OfficeScan XG process.

Solution:

This critical patch removes the vulnerability.

Issue 5 of Critical Patch 1680

(VRTS-1014), (VRTS-1022)

A vulnerability may allow a attacker to send CGI requests to run and stop the OfficeScan XG process unexpectedly.

Solution:

This critical patch resolves the vulnerability.

Issue 6 of Critical Patch 1680

(VRTS-1018)

A vulnerability may allow remote attackers to query PHP information while the specific php file runs.

Solution:

This critical patch secures the information in specific php file.

Issue 7 of Critical Patch 1680

(VRTS-1020)

The OfficeScan XG program may be affected by a host header injection vulnerability.

Solution:

This critical patch resolves the vulnerability.

Issue 8 of Critical Patch 1680

(VRTS-1052)

A vulnerability may allow a attacker to stop the OfficeScan XG process unexpectedly by forcing the specific parameter to exceed that limit.

Solution:

This critical patch resolves the vulnerability.

Issue 9 of Critical Patch 1680

(SEG-11451)

The Realtime Scan is disabled unexpectedly after Autopcc runs.

Solution:

This critical patch ensures that Real-time Scan is not disabled unexpectedly after Autopcc runs.

Issue 10 of Critical Patch 1680

The contents of the CCSF ZIP file cannot be extracted successfully which prevents some OfficeScan agents from updating successfully.

Solution:

This critical patch enables OfficeScan to attempt to extract the contents of the CCSF ZIP file continuously even when other processes are using the file.

Issue 1 of Hotfix 1692

(SEG-11492)

When DLP is enabled on Microsoft(TM) Windows(TM) 10.14393 platforms, "mscorsvw.exe" stops responding.

Solution:

This hotfix resolves the issue by updating the iDLP module to add "mscorsvw.exe" to its approved list.

Issue 2 of Hotfix 1692

(SEG-10631)

The extension names of quarantined files disappear after these files are restored from the quarantine folder. This happens because the file extension name exclusion list is overwritten with an empty string during file restoration.

Solution:

This hotfix enables OfficeScan to restore the complete file extension name exclusion list to ensure that quarantined files are restored with the correct extension names.

Issue 3 of Hotfix 1692

(SEG-11771)

The "file extensions" field under the "File Attributes DLP identifier" section does not accept entries that contain an underscore "_".

Solution:

This hotfix updates the Trend Micro Data Loss Prevention(TM) (DLP) module to enable the "file extensions" field to support the underscore character "_".

Issue 4 of Hotfix 1692

(SEG-6439)

When DLP is enabled on Windows 8.1 platforms, some programs may stop unexpectedly.

Solution:

This hotfix resolves the issue by updating the iDLP module to enable it to retrieve the correct path to the Microsoft "wow64.dll" module.

Issue 5 of Hotfix 1692

(SEG-8975)

An issue prevents the DLP module from parsing sender email address information on OWA web mail.

Solution:

This hotfix adds a function in the iDLP module which helps ensure that it can parse sender information in Office 365 web mail correctly.

Issue 6 of Hotfix 1692

(SEG-10980)

The account and password setting for the external proxy server do not support the hash special character "#".

Solution:

This hotfix resolves a broken jquery Ajax call to ensure that the account and password setting for the external proxy server supports special characters.

Issue 7 of Hotfix 1692

(SEG-11342)

An issue related to the Anti-exploit Protection function might cause Internet Explorer to stop unexpectedly.

Solution:

This hotfix updates the OfficeScan Agent files to resolve the issue.

Issue 8 of Hotfix 1692

(SEG-12076)

The following OfficeScan 12.0 Patch 1 hotfixes are affected by an issue related to the OfficeScan Firewall module which may cause the Firewall service to encounter network access issues and application connection timeout issues.

  • Hotfix 6277
  • Hotfix 6281
  • Hotfix 6292
  • Hotfix 1358

Solution:

This hotfix updates the OfficeScan Firewall to resolve the network access issues.

Procedure:

You must restart the endpoint after applying this hotfix to update the Common Firewall module on affected OfficeScan agents.

Issue 9 of Hotfix 1692

(SEG-7783)

The following OfficeScan 12.0 Patch 1 hotfixes are affected by an issue related to the OfficeScan Firewall module which may cause the Firewall service to encounter network access issues and application connection timeout issues.

  • Hotfix 6277
  • Hotfix 6281
  • Hotfix 6292
  • Hotfix 1358

Solution:

This hotfix updates the OfficeScan Firewall to resolve the network access issues.

Procedure:

You must restart the endpoint after applying this hotfix to update the Common Firewall module on affected OfficeScan agents.

Issue 10 of Hotfix 1692

(SEG-7318)

The following OfficeScan 12.0 Patch 1 hotfixes are affected by an issue related to the OfficeScan Firewall module which may cause the Firewall service to encounter network access issues and application connection timeout issues.

  • Hotfix 6277
  • Hotfix 6281
  • Hotfix 6292
  • Hotfix 1358

Solution:

This hotfix updates the OfficeScan Firewall to resolve the network access issues.

Procedure:

You must restart the endpoint after applying this hotfix to update the Common Firewall module on affected OfficeScan agents.

Issue 11 of Hotfix 1692

(SEG-9646)

There is a compatibility issue between some printers and OfficeScan predictive machine learning.

Solution:

This hotfix fixed the compatibility issue.

Enhancement 1 of Hotfix 1692

(SEG-11404)

This hotfix enables DLP Endpoint SDK 6.0 to support the following Google Chrome versions:

  • Google Chrome 60.0.3112.78
  • Google Chrome 60.0.3112.90

Enhancement 2 of Hotfix 1692

(SEG-12182)

This hotfix enables DLP Endpoint SDK 6.0 to support the following Google Chrome versions:

  • Google Chrome 60.0.3112.78
  • Google Chrome 60.0.3112.90

Enhancement 3 of Hotfix 1692

(SEG-4974)

This hotfix enables OfficeScan to send detected pattern information to the Control Manager server to add to the "Detailed Virus/Malware Information" data view of ad hoc queries. This feature also requires the application of Control Manager Hotfix 3630 or any later hotfix on the Control Manager server.

Issue 1 of Critical Patch 1708

(SEG-9298)

A sharing violation prevents Autopcc from working on computers where the OfficeScan agent is already installed.

Solution:

This critical patch creates a new backup folder to prevent the sharing violation and ensure that Autopcc works normally on OfficeScan agent computers.

Issue 2 of Critical Patch 1708

(SEG-12165)

Users encounter a sharing violation issue related to the ntrtscan and iexplorer processes after enabling the OfficeScan Predictive Machine Learning feature in a computer that has a multiple core CPU.

Solution:

This critical patch changes to add some sharing mode for the file open.

Issue 3 of Critical Patch 1708

(SEG-12255)

In the Windows Server 2003 platform, OfficeScan agents display the following message even when the program components are up-to-date. "Update Now: You have not received a new update in 1 days."

Solution:

This critical patch updates the OfficeScan agent program to resolve the issue.

Issue 4 of Critical Patch 1708

(SEG-11606)

OfficeScan agents receive C&C callback detected alerts for IPs in the approved list.

Solution:

This critical patch resolves a file path issue to help ensure that IPs in the approved list do not trigger C&C callback detected alerts.

Issue 5 of Critical Patch 1708

(SEG-11651), (SEG-3758)

The OfficeScan server cannot register to the EdgeServer when TLS 1.0 is disabled.

Solution:

This critical patch enables the EdgeServer to support TLS 1.1 and 1.2.

Enhancement 1 of Critical Patch 1708

(SEG-9066)

This critical patch enhances the Behavior Monitoring and Predictive Machine Learning features to better detect and prevent ransomware infections from files, and improves the protection against ransomware threats during outbreak situations.

Enhancement 2 of Critical Patch 1708

(SEG-11754)

This critical patch speeds up the approved and blocked list comparison for supported web services, including Dropbox, Google Drive, Gmail, and others.

Enhancement 3 of Critical Patch 1708

(SEG-11495)

This critical patch adds the "Japan: Driving License Number" validator.

Enhancement 1 of Hotfix 1709

(SEG-11641)

This hotfix allows Trend Micro Predictive Machine Learning to detect emerging unknown security risks threats found in suspicious processes or files originating from any channels.

Issue 1 of Hotfix 1714

(SEG-10553)

The OfficeScan agent status information on the Control Manager web console does not match the information in the OfficeScan web console.

Solution:

This hotfix ensures that the OfficeScan agent status information on the Control Manager web console is consistent with the information on the OfficeScan web console.

Issue 2 of Hotfix 1714

(SEG-10964)

The OfficeScan Predictive Machine Learning feature blocks users from publishing documents from Microsoft Outlook.

Solution:

This hotfix moves the file property extraction step to a later stage to ensure that users can publish documents from Microsoft Outlook.

Issue 3 of Hotfix 1714

(SEG-11381)

The OfficeScan agent reports a false positive detection after enabling the Anti-exploit Protection feature.

Solution:

This hotfix updates the OfficeScan agent to prevent the false positive detection.

Issue 4 of Hotfix 1714

(SEG-11966)

BSOD occurs on protected computers running on unsupported Windows versions.

Solution:

This hotfix removes the API hooking mechanism for unsupported Windows versions to prevent BSOD in these computers.

Issue 5 of Hotfix 1714

(SEG-9246)

An issue prevents users from browsing through folders in Huawei smart phones connected to a protected computer when the OfficeScan Data Protection Service is enabled.

Solution:

This hotfix enables OfficeScan to discard Huawei smart phone CD ROM device instance to ensure that users can browse folders in a connected Huawei smart phone in MTP mode.

Issue 6 of Hotfix 1714

(SEG-9408)

An issue prevents users from using the Huawei Mobile Broadband Airtel 4G Model device connected to a protected computer when the OfficeScan Data Protection Service is enabled.

Solution:

This hotfix enables OfficeScan to discard the Huawei Mobile Broadband Airtel 4G Model device instance to ensure that users can browse the Internet using the device when the OfficeScan Data Protection Service is enabled.

Enhancement 1 of Hotfix 1714

This hotfix enables DLP Endpoint SDK 6.2 to use the Data Protection Application Pattern to support Google Chrome and the list of approved processes.

Enhancement 2 of Hotfix 1714

(SEG-10766)

This hotfix updates the pop-up message that appears when OfficeScan agents that are being moved to another OfficeScan server have mismatched certificates

Enhancement 3 of Hotfix 1714

(SEG-12808)

This hotfix adds the ""Nigeria: Verve IIN (Issuer Identification Number"" validator.

Issue 1 of Hotfix 1717

The OfficeScan Behavior Monitoring feature may cause certain third-party programs that are in its approved list to stop responding.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Procedure:

To apply and deploy the solution globally:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the "SkipNotificationEvent" key and set its value to "1".
  • [Global Setting]
  • AegisSkipNotificationEvent=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AEGIS
  • Key: SkipNotificationEvent
  • Type: DWORD
  • Value: 1
  1. Restart the OfficeScan agent

Issue 2 of Hotfix 1717

(SEG-11327)

The OfficeScan Behavior Monitoring feature may cause a protected computer to stop responding while the feature checks the file signature on a UNC path.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Issue 3 of Hotfix 1717

(SEG-11705)

The OfficeScan Behavior Monitoring feature may cause performance issues while the protected computer runs certain programs that are in the Behavior Monitoring approved list.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Procedure:

To apply and deploy the solution globally:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the "SkipNotificationEvent" key and set its value to "1".
  • [Global Setting]
  • AegisSkipNotificationEvent=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AEGIS
  • Key: SkipNotificationEvent
  • Type: DWORD
  • Value: 1
  1. Restart the OfficeScan agents.

Issue 4 of Hotfix 1717

(SEG-13146), (SEG-13181)

BSOD occurs while a protected computer starts up because the UMH driver attempts to access a corrupted cache.

Solution:

This hotfix updates the UMH module to resolve the issue.

Issue 5 of Hotfix 1717

(SEG-13293)

The MPS feature of iDLP cannot be disabled on OfficeScan agents.

Solution:

This hotfix provides a way for users to disable the MPS feature on OfficeScan agents.

Procedure:

To disable the email multi part scan mode in the DLP function and globally deploy this setting to all OfficeScan agents:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder of the OfficeScan server.
  3. Under the "Global Setting" section, manually add the following key and set its value to "0".
  • [Global Setting]
  • EnableDlpMPScan=0 NOTE: To enable the setting again, set "EnableDlpMPScan=1".
  1. Save the changes and close the file.
  2. Open the OfficeScan server management console and click "Agents > Global Agent Settings" on the main menu to access the "Global Agent Settings" page.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to agents and adds the following registry entry on all agent computers:
  • Path: HKLM\SYSTEM\SOFTWARE\Wow6432Node\TrendMicro\ PC-cillinNTCorp\CurrentVersion\DlpLite
  • Key: EnableMPScan
  • Type: dword
  • Value: 0 NOTE: The OfficeScan agent needs to reload after enabling/disabling the MPS feature.

Issue 6 of Hotfix 1717

(SEG-13723)

The DLP version appears as 0.0.0 on both the management console and agent console.

Solution:

This hotfix ensures that the correct DLP version appears on both the management console and agent console.

Issue 1 of Hotfix 1721

(SEG-4624)

The OfficeScan Behavior Monitoring feature may cause certain approved third-party programs to take longer to load on protected computers.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Issue 2 of Hotfix 1721

(SEG-11500), (SEG-12079)

DLP Endpoint SDK 6.2 sometimes cannot block users from uploading files that contain sensitive information to "outlook.live.com" and "facebook.com".

Solution:

This hotfix updates the DLP module to enhance support for both websites to ensure that the module can block files with sensitive information from being uploaded onto these websites.

Issue 3 of Hotfix 1721

(SEG-12101), (SEG-12045)

The Trend Micro Unauthorized Change Prevention Service uses up a large amount of CPU resources.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Issue 4 of Hotfix 1721

(SEG-12552)

The OfficeScan manual scan exclusion feature may not work properly while the suspected malware process is still running.

Solution:

This hotfix updates the OfficeScan agent program to resolve the issue.

Issue 5 of Hotfix 1721

(SEG-13772), (SEG-13380)

When the system installs or upgrades the Cisco VPN software, it tries to access some registry keys under the TmLwf registry key, which causes the software installation to fail.

Solution:

This hotfix adds a key to disable the self-protection only function of the TmLwf registry key, which resolves this issue.

Procedure:

To enable the new service settings:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following key and set its value to "1".
  • [Global Setting]
  • SP_DisableTmLwfRegistryKeyProtection=1
  • Value: 1 = Disable TmLwf registry key self-protection only
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\AEGIS
  • Key: SP_DisableTmLwfRegistryKeyProtection
  • Type: DWORD
  • Value: 1 = Disable TmLwf registry key self-protection only 7.Restart the OfficeScan agents

Issue 6 of Hotfix 1721

(SEG-12859)

A user requests for a way to add the following information into DLP log notifications under the digital asset email notifications:

  • Process
  • Source
  • Destination
  • Incident ID

Solution:

This hotfix updates the OfficeScan Master Service to support the following tokens in DLP log notifications.

  • %PROCESS%
  • %SOURCE%
  • %DESTINATION%
  • %VIOLATIONID%

Enhancement 1 of Hotfix 1721

(SEG-12080)

This hotfix provides a way for users to configure OfficeScan agents to automatically disconnect an established connection and to re-establish a connection when the OfficeScan server triggers a network isolation function. Users can move OfficeScan agents to specific domains that are defined to apply network isolation.

Procedure:

To enable the new service settings:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following keys and set values.
  • [Global Setting]
  • PFWPolicyWithConnectionReset=1
  • Value:

    • 0 = OfficeScan does not support network isolation
    • 1 = OfficeScan supports network isolation
  • PFWPolicyWithConnectionResetDomainList=Domain_Name For example: Workgroup, Domain1 Provide a domain name or domain list use for network isolation.
  • PFWPolicyWithConnectionResetDurationInSec=30
  • Value:
    • 0 = Disable connection reset
    • 30 = Rest connection in 30 seconds (default value)
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
  • Key: PFWPolicyWithConnectionReset
  • Type: DWORD
  • Value:

    • 0 = OfficeScan does not support network isolation
    • 1 = OfficeScan supports network isolation
  • Key: PFWPolicyWithConnectionResetDomainList
  • Type: String
  • Value: Domain_name set by user
  • Example: Workgroup, Domain1
  • Key: PFWPolicyWithConnectionResetDurationInSec
  • Type: DWORD
  • Value:

    • 0 = Disable connection reset
    • 30 = Rest connection in 30 seconds

NOTE: Restart the endpoint to update the Common Firewall module of OfficeScan agents.

Enhancement 2 of Hotfix 1721

(SEG-4976)

This hotfix enables the OfficeScan Update Agent to check and verify the MD5 component of all downloaded program files and to automatically re-download or continue the transmission if it detects corrupted files.

Procedure:

To enable the Update Agent to check and verify the MD5 component of downloaded program files and automatically re-download or continue the transmission if it detects corrupted files:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following keys and set each to "1".
  • [Global Setting]
  • UAProgramZipFullCheck=1 (Enabled).
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.

Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ PC-cillinNTCorp\CurrentVersion\Misc.\ or HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ TrendMicro\PC-cillinNTCorp\ CurrentVersion\Misc.\

  • Key: UAProgramZipFullCheck
  • Type: DWORD
  • Value:

    • 0 = Disable
    • 1 = Enable

Enhancement 3 of Hotfix 1721

(SEG-13686), (SEG-13667), (SEG-13707)

This hotfix enables DLP Endpoint SDK 6.2 starts to support the following Google Chrome versions:

  • Google Chrome 60.0.3112.90
  • Google Chrome 60.0.3112.113
  • Google Chrome 61.0.3163.79
  • Google Chrome 61.0.3163.91

Issue 1 of Hotfix 1729

(SEG-13054)

Some OfficeScan agents may not be able to retrieve settings completely from an update agent when there are special characters in the BM exception list.

Solution:

This hotfix ensures that the agents can retrieve the complete settings from an update agent.

Enhancement 1 of Hotfix 1729

(SEG-1056)

This hotfix updates the Trend Micro Osprey Firefox Extension and enables it to support Firefox 51 and later versions.

Issue 1 of Hotfix 1736

(SEG-14538)

Enabling the Browser Exploit Prevention (BEP) feature causes Microsoft Internet Explorer to crash when opening certain websites that were added to the Web Reputation Approved List.

Solution:

This hotfix updates the Browser Exploit Prevention component to resolve the issue.

Procedure:

To apply and deploy the solution globally:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the "DisableJSHook" key and set its value to "1".
  • [Global Setting]
  • DisableJSHook=1
  1. Save the changes and close the file.
  2. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSP\SAL
  • Key: DisableJSHook
  • Type: DWORD
  • Value: 1
  1. Restart the OfficeScan agents.

Issue 2 of Hotfix 1736

(SEG-14855)

Enabling the Browser Exploit Prevention (BEP) feature may cause customers to encounter an error when accessing certain websites that were added to the Web Reputation Approved List.

Solution:

This hotfix updates the Browser Exploit Prevention component to resolve the issue.

Issue 3 of Hotfix 1736

(SEG-13231)

DLP Endpoint SDK 6.2 blocks VirtualBox from launching in Headless Mode.

Solution:

This hotfix updates the DLP module to skip API event inspection from all VirtualBox processes.

Issue 1 of Critical Patch 1737

(SEG-12946)

After moving an OfficeScan agent from one OfficeScan server to another through the web console, the agent might not able to upgrade successfully.

Solution:

This critical patch updates the OfficeScan agent program to resolve the issue.

Issue 1 of Hotfix 1741

(SEG-15121), (SEG-14693)

BSOD occurs when the DLP Endpoint SDK 6.2 module starts the "sftlist.exe" process.

Solution:

This hotfix resolves the issue by updating the DLP module to add a path checking mechanism in Wow64ApcRoutine and enable API event inspection to skip "sftlist.exe" processes.

Issue 2 of Hotfix 1741

(SEG-15268)

Users cannot migrate the OfficeScan database from CodeBase to an SQL server database using an SQL server account password that contains a semicolon ";".

Solution:

This hotfix ensures that users can migrate the OfficeScan database under the scenario described above.

Issue 3 of Hotfix 1741

(SEG-14634)

The Unauthorized Change Prevention Service generates false ransomware alarms and as a result, may block or terminate approved third-party programs.

Solution:

This hotfix prevents the false alarms by removing the file existence check and enabling the Unauthorized Change Prevention Service to match ransomware actions only when an existing file does not have any content.

Issue 4 of Hotfix 1741

(SEG-15119)

OfficeScan cannot register to the Edge Server after the server is upgraded to version 1708. This does not affect freshly-installed Edge Server 1708.

Solution:

This hotfix ensures that OfficeScan can successfully register to the Edge Server.

Enhancement 1 of Hotfix 1741

(SEG-13409)

This hotfix adds a tool that signs the certificate of the OfficeScan Edge Relay Server.

Procedure:

To sign the certificate of the OfficeScan Edge Relay Server:

  1. Install this hotfix (see "Installation").
  2. Copy the "\PCCSRV\Admin\Utility\EdgeServer" folder from OfficeScan installation directory to the OfficeScan Edge Relay server.
  3. Run the "setup.exe" file on the OfficeScan Edge Relay server.
  4. Remove the original root certificate authority (CA) "OsceEdgeRoot".
  5. Create a new root CA "OsceEdgeRoot" by running the following command in a single line:

makecert.exe -n CN=OsceEdgeRoot -pe -a sha256 -len 2048 -is root -ss root -sr localmachine -ir localmachine -cy authority -in "CustomerCA"

  1. Renew the CA using the "keeprootca" parameter with "renewcert" by running the following command in a single line:

OfcEdgeCfg.exe --renewcert --keeprootca --certpwd "YourPassword"

Issue 1 of Hotfix 1744

(SEG-12728)

An issue related to the Behavior Monitoring module causes documents to load slowly.

Solution:

This hotfix resolves the issue so that documents load normally.

Issue 2 of Hotfix 1744

(SEG-15447)

OfficeScan 11.0 Service Pack 1 still blocks the Spyrus USB drive after it is added to the USB exception list.

Solution:

This hotfix resolves the issue by updating the Data Loss Prevention(TM) (DLP) module to ensure that it can parse the device information of the Spyrus USB drive.

Issue 1 of Hotfix 1751

(SEG-15468)

Repeated detections of a specific virus in the same file path may cause the Damage Clean Engine (DCE) to merge and create logs incorrectly.

Solution:

This hotfix updates the OfficeScan agent program to resolve this issue.

Issue 2 of Hotfix 1751

(SEG-9262)

The Behavior Monitoring approved list allows all approved programs to run. However, it may not function properly for approved programs started from remote resources, such as UNC paths or mapped drives.

Solution:

This hotfix resolves the issue by updating the Behavior Monitoring service module.

Issue 3 of Hotfix 1751

(SEG-12630)

The Trend Micro Unauthorized Change Prevention Service ("TMBMSRV.exe") may trigger a high CPU usage issue when it receives a large number of event notifications from Windows.

Solution:

This hotfix updates the Behavior Monitoring service module to resolve the issue.

Issue 4 of Hotfix 1751

(SEG-14897)

A new line character in the "Event" column on OfficeScan server System Event Logs may cause the OfficeScan Master Service to stop unexpectedly.

Solution:

This hotfix resolves the issue so that System Event Logs load normally and the OfficeScan Master Service runs properly.

Issue 5 of Hotfix 1751

(SEG-15370)

When the EYES component is updated and the UMH component is not updated, Internet Explorer crashes.

Solution:

This hotfix ensures that the EYES version is checked by the TMUMH Registry and a notification appears if the updated versions are different.

Issue 6 of Hotfix 1751

(SEG-14967)

The DLP module generates some unexpected results while detecting files inside a large compressed file.

Solution:

This hotfix resolves the issue by updating the DLP module and divide the DLP size limitation into parts:

  • For normal files, the file attribute detection upper bound is 10 GB (For CD/DVD, USB and SMB channels only).
  • For files inside compressed files, the file attribute detection upper bound will still be 2 GB.
  • For content detection, the upper bound will remain at 76 MB (For all channels).

Issue 7 of Hotfix 1751

(SEG-8729)

An interoperability issue between the TDI network filter driver and Citrix XenApp on Microsoft(TM) Windows(TM) 7 can cause the Citrix client to disconnect unexpectedly.

Solution:

This hotfix enables users to change the installation of the TDI (saknet.sys) and WFP (dlpnetfltr.sys) network filter driver based on the customized settings.

Procedure:

To configure the new setting for DLP:

  1. Install this hotfix (see "Installation").
  2. Open the "dlp.ini" file in the "\PCCSRV\Private\" folder on the OfficeScan server. 3 Under the "Configure" section, manually add the "enable_wfp" key and set its value to "true".
  • [Configure]
  • enable_wfp = true
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and click "Agents > Agent Management > Select domains or agents > Settings > DLP settings".
  3. Click "Save" to deploy the settings to agents".
  • The OfficeScan server deploys the settings to OfficeScan agents and adds the following key in the "dsa.pro" file in the "\Windows\System32\dgagent\" folder:
  • enable_wfp=true

Enhancement 1 of Hotfix 1751

(SEG-15685)

This hotfix enables the DLP module to support Windows 10 RS 3 possible RTM build (16299).

Enhancement 2 of Hotfix 1751

This hotfix enables the DLP module to support Windows 10 RS 3 Cloud Files Awareness and prevents Data Discovery scan from causing any cloud files (placeholders) to be hydrated.

Issue 1 of Hotfix 1752

(SEG-16832)

Blue Screen of Death (BSOD) may occur after applying Microsoft KB4043961 on computers running on Windows 10 Fall Creators Update (Redstone 3) and protected by OfficeScan XG

Solution:

This hotfix prevents the BSOD issue on affected computers.

Issue 1 of Hotfix 1756

(SEG-14686)

When Trend Micro Smart Feedback is enabled, it shares anonymous threat information with the SPN. However, Predictive Machine Learning does not use anonymous information when sending the SPN feedback information.

Solution:

This hotfix updates the Falcon Core Engine and the OfficeScan agent program to resolve the issue.

Issue 2 of Hotfix 1756

(SEG-14528)

An issue in the DLP module causes a file leak issue for the OneDrive desktop application on Windows 10 RS3.

Solution:

This hotfix updates the DLP module to fix the issue.

Issue 3 of Hotfix 1756

(SEG-14845)

When an agent update stalls, the number of agents in the update queue may reach the number of online agents.

Solution:

This hotfix enables the AddNotifyRecord() function to check the status of an agent before updating the counters and inserting the record into the queue.

Enhancement 1 of Hotfix 1756

(SEG-5076)

This hotfix enables users to configure OfficeScan to allow a user with restricted access to connect to an approved wireless SSID and to block these users from connecting to any wired network. This helps ensure that the user does not connect to both a wireless and a wired network at the same time.

Procedure:

To enable restricted users to connect to an approved wireless SSID and block these users from using any wired network:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following keys and set the preferred value for each.
  • [Global Setting]
  • EnableWhiteListSSID=y
  • 1, enables the approved SSID list
  • 0, (default) disables the approved SSID list
  • WhiteListSSIDCount=x, the number of approved SSID on the list
  • WhiteListSSID_0=abcd, first SSID
  • WhiteListSSID_1=1111, subsequent SSID
  • WhiteListSSID(x-1)=2222, any SSID specified after this key will not be used
  • EnableBlockWiredNetwork=z
  • 1, blocks all wired network interfaces
  • 0, opens all wired network interfaces
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.

NOTES:

  • After blocking wired network interfaces and unloading the agent, you can reconnect these interfaces through the "Windows\Control Panel\Network and Internet\Network Connections" page.
  • When the SSID approved list is enabled, you can see the available wireless network SSIDs after unloading the agent.

Enhancement 2 of Hotfix 1756

(SEG-14528)

This hotfix improves the fine event filtering mechanism for Dropbox to help prevent a high CPU usage issue.

Enhancement 3 of Hotfix 1756

(SEG-11939)

This hotfix adds the following new keys:

  • USB_NONSTOR_EXCEPTION for adding USB non-storage devices into the approved list.
  • FREQ_DEVCTRL_LOGONLY_EVENT to prevent redundant device control violation logs within the specified period in hours.

Enhancement 4 of Hotfix 1756

(SEG-16146)

This hotfix enables DLP Endpoint SDK 6.2 to support version 62 of the Google Chrome web browser.

Enhancement 5 of Hotfix 1756

(SEG-15209)

This hotfix improves the launch speed of Google Chrome on protected computers by removing an unnecessary 32-bit API hook search on the 64-bit platform.

Issue 1 of Hotfix 1763

(SEG-11512)

Internal websites may load slowly when the Unauthorized Change Prevention Service is enabled.

Solution:

This hotfix resolves the issue by updating the Behavior Monitoring service module.

Issue 2 of Hotfix 1763

(SEG-14568)

The OfficeScan Behavior Monitoring feature may cause high CPU usage on protected computers.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Issue 3 of Hotfix 1763

(SEG-16240)

A protected computer may stop unexpectedly when an incorrect policy configuration extension (*.class) is deployed to the DLP services.

Solution:

This hotfix updates the DLP module to update the policy evaluation flow and help ensure that policies are deployed correctly.

Issue 4 of Hotfix 1763

(SEG-14053)

Some Drag-and-Drop and Open File Dialog upload events through a favorite website cannot be blocked in the Google Chrome web browser.

Solution:

This hotfix updates the DLP module to update the Google Chrome URL retrieving procedures and improve the stability of intercepting both Drag-and-Drop and Open File Dialog upload events in Chrome.

Issue 5 of Hotfix 1763

(SEG-13686)

When users enable the file attribute file extension checking, OfficeScan adds an extra "0" after the setting in the configuration file which prevents the settings after this line from working.

Solution:

This hotfix updates the DLP module to prevent it from adding the unexpected file type 0.

Enhancement 1 of Critical Patch 1775

(SEG-17174)

This critical patch enables the OfficeScan XG agent program to support Windows 10 Fall Creators Update.

Issue 1 of Hotfix 1785

(SEG-14536)

The Keyparc Business program may take one minute to open a newly-created file on an encrypted drive on OfficeScan client computers.

Solution:

This hotfix imports new tmcomm drivers to help ensure that the Keyparc Business program can open newly-created files on encrypted drives normally.

Procedure:

To enable the new service settings:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following key and set its value to "1".
  • [Global Setting]
  • TmCommBypassVolDevNormalizeReparse=1 NOTE: Setting this key to "1" prevents OfficeScan from reparsing path normalization to prevent performance drop issues, Blue Screen of Death (BSoD), and other performance issues.
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ services\tmcomm\Parameters
  • Key: BypassVolDevNormalizeReparse
  • Type: DWORD
  • Value: 1 = OfficeScan skips reparsing of path normalization to prevent certain performance issues
  1. Restart the OfficeScan agents.

Issue 2 of Hotfix 1785

(SEG-15975)

A vulnerability may allow remote attackers to query widget information while the specific php file runs.

Solution:

This hotfix secures the information in specific php file.

Issue 3 of Hotfix 1785

(SEG-16144)

The OfficeScan server cannot apply a Control Manager policy if the policy settings contain UTF-8 character.

Solution:

This hotfix enables the OfficeScan server to handle UTF-8 strings in Control Manager policies to resolve the issue.

Issue 4 of Hotfix 1785

(SEG-16824)

An issue prevents the OfficeScan server from deploying the correct local language settings to agents.

Solution:

This hotfix updates the OfficeScan agent program to resolve the issue.

Issue 1 of Critical Patch 1786

(VRTS-1771)

An attacker can use clickjacking on the OfficeScan web management console to trick users into accessing malicious URLs.

Solution:

This Critical Patch resolves the clickjacking vulnerability.

Issue 1 of Hotfix 1788

(SEG-18260)

It may take between five and 10 seconds to upload a file to websites in Microsoft(TM) Internet Explorer(TM).

Solution:

This hotfix resolves the issue by updating the DLP module to allow a user mode response immediately after setting the mapping between the module handle and the URL before uploading a file.

Issue 2 of Hotfix 1788

(SEG-18055)

It may take several minutes to upload a file to websites from a Server Message Block (SMB).

Solution:

This hotfix resolves the issue by updating the DLP module with a re-designed process flow to match with the approved list of websites before scanning.

Issue 3 of Hotfix 1788

(SEG-16168)

OfficeScan blocks a 4G internet modem Alfa 4G Dongle that has been added to the exception list.

Solution:

This hotfix resolves the issue by updating the DLP module to allow users to add USB COM/LPT Ports and USB Modems into the approved list of devices.

Procedure:

To configure the new settings for DLP:

  1. Install this hotfix (see "Installation").
  2. Open the "dlp.ini" file in the "\PCCSRV\Private\" folder on the OfficeScan server.
  3. Under the "Configure" section, manually add the following keys and set all to "true".
  • [Configure]
  • usb_cdrom_exception=true
  • usb_modem_exception=true
  • usb_ports_com_lpt_exception=true
  • USB_NONSTOR_EXCEPTION=true
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and click "Agents > Agent Management > Select domains or agents > Settings > DLP settings".
  3. Click "Save" to deploy the settings to agents. The OfficeScan server deploys the settings to OfficeScan agents and adds the keys in the "dsa.pro" file in the "\Windows\System32\dgagent\" folder.
  4. Logon to the OfficeScan Server Administration Console.
  5. Navigate to "Agents > Agent Management".
  6. Find and select a target agent machine, then go to "Settings > Device Control Settings".
  7. Edit the "Approved devices" under USB storage devices.
  • For the Huawei 4G ethernet card, please add following information to approved device(s):
  • Device 1 (For HUAWEI Mass Storage USB Device)
  • Vendor: HUAWEI
  • Model: *
  • Serial ID: 11A5622E
  • Device 2 (For HUAWEI TF CARD Storage USB Device)
  • Vendor: HUAWEI
  • Model: *
  • Serial ID: 3A867B90*
  • Device 3 (For HUAWEI Mobile Connect - Modem,
  • HUAWEI Mobile Connect - PC UI Interface (COM4))
  • Vendor: HUAWEI
  • Model: *
  • Serial ID: 55B0D40
  1. Save and deploy the device control settings to the target agent.
  2. Restart the OfficeScan agents.

Enhancement 1 of Hotfix 1788

(SEG-17178), (SEG-17479)

This hotfix updates the "listDeviceInfo.exe" to enable it to export the report files in CSV format and to generate both "dlpDeviceReport.htm" and "dlpDeviceReport.csv" in the same folder. The date format in "dlpDeviceReport.csv" is configurable through "ListDeviceInfoFormat.ini".

Procedure:

To configure the date format in "dlpDeviceReport.csv":

  1. Install this hotfix (see "Installation").
  2. Copy the file "\Windows\System32\dgagent\ListDeviceInfo.exe" in any temp folder.
  3. Create a file "ListDeviceInfoFormat.ini" file in the same temp folder. Add or locate the following section:
  • [Format]
  • CustomizeDateFormat=MM/DD-YYYY

NOTES:

  • Default Date format: YYYY/MM/DD, e.g. 2017/11/06
  • CustomizeDateFormat uses YYYY to represent Year, MM for Month and DD for Date
  • YYYY, MM and DD should be included in "CustomizeDateFormat", otherwise it is invalid.
  • Total length need to be up to 10 characters only
  • Separator is not necessary but could be any character, maximum is two characters. For example, MM/DD/YYYY or DD-MM-YYYY

Issue 1 of Hotfix 1793

(SEG-12411)

The Control Manager Endpoint Protection Verification widget displays the status of some OfficeScan agents as "N/A". This happens because Control Manager calls the OfficeScan "cgiGetClient.exe" process to retrieve the agent list but the process can retrieve information about agents in the first layer of a domain only.

Solution:

This hotfix resolves the issue by updating "cgiGetClient.exe" to support multi-layer domains. This does not affect the current settings because OfficeScan no longer uses this process.

Issue 2 of Hotfix 1793

(SEG-15823)

OfficeScan agents that have been registered to the Edge server and had switched offline before being moved to an office network remain offline. This happens because these agents always attempt to connect to the Edge server instead of to the OfficeScan server.

Solution:

This hotfix ensures that these agents will connect to the OfficeScan server.

Issue 3 of Hotfix 1793

(SEG-17606)

Duplicate violation logs may be generated for certain samples.

Solution:

This hotfix enables OfficeScan to limit the generation of violation events to one for each policy for each file.

Procedure:

To configure the new settings for DLP:

  1. Install this hotfix (see "Installation").
  2. Open the "dlp.ini" file in the "\PCCSRV\Private\" folder on the OfficeScan server.
  3. Under the "Configure" section, manually add the following keys and set all to "true".
  • [Configure]
  • LOG_THROTTLE=true
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and click "Agents > Agent Management > Select domains or agents > Settings > DLP settings".
  3. Click "Save" to deploy the settings to agents. The OfficeScan server deploys the settings to OfficeScan agents and adds the keys in the "dsa.pro" file in the "\Windows\System32\dgagent\" folder.

Issue 4 of Hotfix 1793

(SEG-18012)

OfficeScan may stop unexpectedly while uploading specific Microsoft(TM) PowerPoint(TM) files (.ppt) as an attachment in Gmail using the x64 version of Google Chrome 62.

Solution:

This hotfix resolves the issue by enhancing a checking mechanism to prevent the dsagent from attempting to parse the .ppt file as a header.

Issue 5 of Hotfix 1793

(SEG-18090)

On OfficeScan agents, the "Ntrtscan.exe" process stops repeatedly because it cannot start the VSAPI driver.

Solution:

This hotfix updates the OfficeScan agent program to ensure that "Ntrtscan.exe" starts and works normally.

Issue 6 of Hotfix 1793

(SEG-18356)

On the OfficeScan web console "Data Identifiers" page, the "File Attribute File Extensions" option is always unchecked.

Solution:

This hotfix updates the page script to ensure that the "File Attribute File Extensions" checkbox displays the correct setting.

Issue 1 of Hotfix 1799

(SEG-9205)

The Windows Security Center may not be able to recognize OfficeScan as an antivirus software when OfficeScan Agent Access Restriction is enabled.

Solution:

This hotfix resolves the issue by updating the way an OfficeScan agent reports to the Windows Security Center.

Issue 2 of Hotfix 1799

(SEG-14508)

A high disk I/O utilization performance issue occurs on OfficeScan agents while restarting certain machines.

Solution:

This hotfix adds an option to delay the buildup of the digital signature cache to reduce I/O usage while machines restart.

Procedure:

To apply and deploy the solution globally:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the "DelayLoadGCLCacheEnable" key and set its value to "1".
  • [Global Setting]
  • DelayLoadGCLCacheEnable=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
  • Key: DelayLoadGCLCacheEnable
  • Type: DWORD
  • Value: 1

Issue 3 of Hotfix 1799

(SEG-14967)

The DLP module generates some unexpected results while detecting files inside a large compressed file.

Solution:

This hotfix resolves the issue by updating the DLP module and divide the DLP size limitation into parts:

  • For normal files, the file attribute detection upper bound is 10 GB (For CD/DVD, USB and SMB channels only).
  • For files inside compressed files, the file attribute detection upper bound will still be 2 GB.
  • For content detection, the upper bound will remain at 76 MB (For all channels).

Issue 4 of Hotfix 1799

(SEG-16997)

Data Loss Prevention (DLP) blocks the Skype application.

Solution:

This hotfix updates the DLP module that contains the improved process flow to prevent false positive alerts when the Skype application conducts file access events on its temporary files.

Issue 5 of Hotfix 1799

(SEG-17157)

The DLP module does not catch Gmail draft emails with sensitive information.

Solution:

The hotfix updates the DLP module that enables it to monitor the event when users draft emails in Gmail.

Procedure:

To configure the new setting for DLP:

  1. Install this hotfix (see "Installation").
  2. Open the "dlp.ini" file in the "\PCCSRV\Private\" folder on the OfficeScan server.
  3. Under the "Configure" section, manually add its value.
  • [Configure]
  • monitor_webmail_draft=true
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and click "Agents > Agent Management > Select domains or agents > Settings > DLP settings".
  3. Click "Save" to deploy the settings to agents". The OfficeScan server deploys the settings to OfficeScan agents and adds the following key in the "dsa.pro" file in the "\Windows\System32\dgagent\" folder:
  • monitor_webmail_draft=true
  1. Find a target machine for verification.

Enhancement 1 of Hotfix 1799

(SEG-12388)

This hotfix enables OfficeScan agents to check the pattern version during startup and to compare the pattern version from the registry key with the latest pattern file version in the client's folder. If the two versions are different, OfficeScan agents will then send a component update log specifying the update source as "Manual applied".

Procedure:

To enable the pattern version checking and allow OfficeScan agents to send the component update log with "Manual applied" update source:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan installation directory.
  3. Under the "Global Setting" section, manually add the following key and set it to "1".
  • [Global Setting]
  • ReportPatternFileUpdateManually=1 NOTE: To disable the checking, set " ReportPatternFileUpdateManually=0" or delete the key.
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to clients.
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\
  • Key: ReportPatternFileUpdateManually
  • Type: DWORD
  • Value: 1

Issue 1 of Hotfix 1807

(SEG-15635)

After importing the settings from an OfficeScan 11 server to an OfficeScan XG server, the "CVE Exploit" option disappears from the "Real-time Scan Settings > Action tab > Virus/Malware > Use a specific action for each virus/malware type" page. This option is not available in OfficeScan 11.

Solution:

This hotfix enables the OfficeScan XG server to retrieve this setting from its own "ofcscan.ini" file if this is not specified in the exported settings.

Issue 2 of Hotfix 1807

(SEG-15917)

Restoring quarantined files fails with ".blob" files due to permission issues.

Solution:

This hotfix resolves the issue by opening files using the "rb" (Open file for read) option instead of "r+b" (Open a file for update) to prevent permission issues.

Enhancement 1 of Hotfix 1807

(SEG-19169)

This hotfix enables DLP Endpoint SDK 6.2 starts to support Google Chrome version 63.

Issue 1 of Hotfix 1811

(SEG-19783)

Samples are sent to the Deep Discovery Analyzer server without any host name information.

Solution:

This hotfix ensures that OfficeScan server sends samples to the Deep Discovery Analyzer with the correct source host information.

Issue 2 of Hotfix 1811

(SEG-16028)

When scheduled scan is set to run "Monthly, on the First week day" in a specific time zone, the scheduled scan will run repeatedly in the last daylight saving month.

Solution:

This hotfix helps ensure that the next scheduled scan time is calculated accurately in the last daylight saving month.

Issue 3 of Hotfix 1811

(SEG-18629)

The device control function blocks a USB storage device that is in the approved list.

Solution:

This hotfix updates the OfficeScan program to ensure that the device control function runs normally.

Issue 1 of Hotfix 1816

(SEG-19697)

The performance of protected computers slows down when the engine processes a PostClose event in "\Device\Volume".

Solution:

This hotfix enables OfficeScan to skip PreClose and PostClose events in "\Device\Volume".

Procedure:

To enable enables OfficeScan to skip PreClose and PostClose events in "\Device\Volume":

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the following key and set its value to "1".
  • [Global Setting]
  • tmevtmgr_SkipDeviceVolume=1 NOTE: To disable the setting, set this key to "0" or delete it.
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmevtmgr\Parameters
  • Key: SkipDeviceVolume
  • Type: DWORD
  • Value: 1
  1. Restart the OfficeScan agents.

Issue 2 of Hotfix 1816

(SEG-19613)

The DLP module skips information after an asterisk(*) in the list of approved USB devices under the device control and content filtering feature.

Solution:

This hotfix updates the DLP module to implement wildcard matching with enhanced dynamic programming to enable it to match USB devices correctly.

Issue 3 of Hotfix 1816

(SEG-16164)

If the contents of the Extension File Attribute of a policy exceeds 100 characters, the DLP module on endpoints may not be able to load the policy.

Solution:

This hotfix updates the DLP module to change the current limitation from 100 characters to 512 characters.

Issue 1 of Hotfix 1829

(SEG-20777)

The title on exported Data Loss Prevention(DLP) Log CSV files generated from non-English OfficeScan versions appear garbled.

Solution:

This hotfix ensures that the title of DLP log CSV files exported from non-English OfficeScan versions display normally.

Issue 2 of Hotfix 1829

(SEG-20367)

An issue related to the OfficeScan Behavior Monitoring feature may cause a protected computer to start slowly.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Procedure:

To apply and deploy the solution globally:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder in the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the "SkipDfsClient" key and set its value to "1".
  • [Global Setting]
  • SkipDfsClient=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmactmon\Parameters
  • Key: SkipDfsClient
  • Type: DWORD
  • Value: 1
  1. Restart the OfficeScan agents.

Issue 3 of Hotfix 1829

(SEG-20952)

Under certain scenarios, some OfficeScan processes may stop unexpectedly.

Solution:

This hotfix updates the Behavior Monitoring module to enhance the self-protect feature of OfficeScan processes.

Issue 4 of Hotfix 1829

(SEG-21496)

The firewall's "Quarantine" action in medium security level blocks the FTP session.

Solution:

This hotfix changes the "Quarantine" action to "Drop" in medium security level to resolve the issue.

Issue 5 of Hotfix 1829

(SEG-17840)

The DLP violation log generated for a single violation triggered by Microsoft(TM) Outlook(TM) contains two sets of "activity" and "channelid", one for "Email" and one for "Exchange Client Email".

Solution:

This hotfix removes the information for the parent activity from DLP violation logs.

Issue 6 of Hotfix 1829

(SEG-20881)

32-bit OfficeScan processes may stop unexpectedly on 64-bit platforms.

Solution:

This hotfix resolves the issue by updating how the DLP module matches path names when locating the "wow64.dll" path.

Issue 7 of Hotfix 1829

(SEG-20042)

When an OfficeScan XG client performs the "Clean" action on certain backup files, it may also transfer the files to the "Virus" folder. The files in this folder are sent to the OfficeScan server along with quarantined files.

Solution:

This hotfix prevents OfficeScan XG clients from saving a copy of cleaned BR0 to BRF backup files, for example XXX.BR0, XXX.BR1, XXX.BR2 to XXX.BRF, in the suspected virus folder. This ensures that cleaned files are not sent to the OfficeScan server.

Enhancement 1 of Hotfix 1829

(SEG-19481)

The OfficeScan web console does not display an alert when the Smart Scan Patter is out-of-date.

Procedure:

To enable OfficeScan to show an alert when the Smart Scan Pattern is out-dated and indicate the number of days since the last pattern update:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the following key and set its value to "1".
  • [Global Setting]
  • PatternTooOldSmartScan=1 NOTE: To disable the setting, set this key to "0" or delete it.
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:
  • Path:
  • 32 bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\PatternTooOldSmartScan
  • 64 bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\PatternTooOldSmartScan
  • Key: PatternTooOldSmartScan=1
  • Type: DWORD
  • Value: 1
  1. Restart the OfficeScan agents.

Issue 1 of Hotfix 1836

(SEG-19646)

If administrators install the OfficeScan agent in another drive other than the C: drive, OfficeScan cannot correctly apply the Data Loss Prevention (DLP) hotfix files. Administrators may also lose some file permissions.

Solution:

This hotfix resolves the issue by updating the DLP module by adjusting the working flow when copying and installing DLP hotfix files.

NOTE: Run the batch file ("grant-permission.bat") prior to installing the hotfix. The batch file corrects the necessary DLP file permissions in preparation for the hotfix installation.

Issue 2 of Hotfix 1836

(SEG-19079)

When the firewall security level is set to "High", users can still access websites that are not in the approved list. This happens because the local WCS port is assigned as a trusted port by mistake.

Solution:

This hotfix resolves the issue to ensure that users will be able to access only websites from the approved list when the firewall security level is "High".

Issue 3 of Hotfix 1836

(SEG-19068)

The Plug-in Manager (PLM) agent uses the proxy setting of the system even if a proxy server is unavailable. Thus, the PLM agent connects to an unavailable proxy server and fails to communicate with the OfficeScan server.

Solution:

This hotfix resolves the issue to ensure that OfficeScan agents do not use any proxy setting if there is no proxy server.

Issue 4 of Hotfix 1836

(SEG-16923)

When users click on any "Threat Type" classification in the "Security Risk Detections Over Time" widget, new browser windows do not display properly in the Japanese (JP) version of the Microsoft(TM) Windows(TM) operating system.

Solution:

This hotfix updates the OfficeScan XG server files to resolve this issue.

Enhancement 1 of Hotfix 1836

(SEG-21008)

This hotfix enhances OfficeScan agent automatic network isolation when agent detects the virus by scan engine, the agent will count the virus number in a configurable time range, if the total virus number reach the trigger criteria, the agent will block all incoming and outgoing network traffic.

Procedure:

To enable OfficeScan agent automatic network isolation:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the OfficeScan server installation directory.
  3. Under the "Global Setting" section, manually add the following keys and set its value.
  • [Global Setting]
  • AutoNetworkIsolation=1 NOTE: 0 : disables the automatic network isolation feature.(Default)
  • 1 : enables the automatic network isolation feature.
  • AutoNetworkIsolationVirusTriggerCount=1 NOTE: 1 : Triggers network isolation when agent detects a virus.(Default), accepted value 1~1000
  • AutoNetworkIsolationCountTimeRangeInMinutes=10 NOTE: 10: Time range for virus counting is 10 minutes.(Default), accepted value 1~43200 (30days)
  • AutoNetworkIsolationVirusTypeExceptionList= NOTE: Virus type exception for virus counting, for example, Virus,Joke,Trojans (Default value is empty)
  • AutoNetworkIsolationDurationInMinutes=30
  • Keep network isolation status for 30 minutes.(Default), accepted value 1~43200 (30days)
  • AutoNetworkIsolationAgentExceptionList=
  • Agent host name exception for network isolation.(Default value is empty)
  • Example:ComputerA,ComputerB
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents.
  4. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent computers:

Path:

  • 32 bit:
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\cnqDisableWarning
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationVirusTriggerCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationCountTimeRangeInMinutes
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationDurationInMinutes
  • Type: DWORD
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationVirusTypeExceptionList
  • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationAgentExceptionList
  • Type: String

64 bit:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\cnqDisableWarning
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationVirusTriggerCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationCountTimeRangeInMinutes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationDurationInMinutes
  • Type: DWORD
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationVirusTypeExceptionList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\AutoNetworkIsolationAgentExceptionList
  • Type: String

Enhancement 2 of Hotfix 1836

(SEG-20787)

This hotfix enables DLP to dump full DLP violation logs onto the "dgagent\dumpdir" folder for troubleshooting.

Procedure:

To configure the new settings for DLP troubleshooting:

  1. Add "dump_violation_log=true" to "dsa.pro" and "discovery.pro" before starting the DLP services.
  2. Replicate the scenario where DLP violation occurs.
  3. The violation logs are saved in the following:
  • Content Filter Mode
    • ..\dgagent\dumpdir\DlpViolation.log
  • Data Discovery Mode
    • ..\dgagent\dumpdir\DlpDDViolation.log

Issue 1 of Hotfix 1842

(SEG-19074)

The Ransomware widget dashboard displays inaccurate date information.

Solution:

This hotfix updates the widget time zone setting to resolve this issue.

Issue 2 of Hotfix 1842

(SEG-22245)

OfficeScan deletes the wireless LAN (WLAN) profile using the "Netsh" command.

Solution:

This hotfix verifies if the following registry key exists and to take the necessary actions when applicable:

  • [...\Misc.\WhiteSSID]
  • EnableWhiteListSSID
  • EnableBlockWiredNetwork
  1. if key existed: the system will apply the "Netsh" command to flush WLAN filter list.
  2. if key doesn't exist: OfficeScan will not apply the.

Issue 1 of Hotfix 1844

(SEG-22041)

After a session times out, an Active Directory (AD) account user can logon to the OfficeScan web console again without providing a username and password by refreshing the web page.

Solution:

This hotfix resolves the issue to ensure that AD account users are required to provide the login credentials again after refreshing the web page.

Issue 2 of Hotfix 1844

(SEG-21589)

The Data Loss Prevention(TM) (DLP) module cannot block multiple files transferred by FTP at the same time.

Solution:

This hotfix updates the DLP module to handle the FTP requests correctly.

Issue 3 of Hotfix 1844

(SEG-13599)

When multipart scan is enabled, some information may not appear completely in the violation logs.

Solution:

This hotfix updates the DLP module to ensure that the information in the violation logs are complete.

Issue 4 of Hotfix 1844

(SEG-21896)

Sensitive files may leak from Microsoft(TM) Outlook(TM) Web Application (OWA) 2016.

Solution:

This hotfix updates the DLP module to support OWA 2016 to enable it to prevent sensitive file leakage through this application.

Issue 5 of Hotfix 1844

(SEG-23620)

The DLP services and IMAPI driver may stop responding or stop unexpectedly during CD/DVD burning operations in Microsoft(TM) Windows(TM) Explorer.

Solution:

This hotfix resolves the issue by updating the DLP module to correct the CD/DVD burning cache read operation in DLP services and refines the flow of the CD/DVD burning event wait in IMAPI driver.

Issue 1 of Hotfix 1849

(SEG-22674)

OfficeScan XG EN Hotfix 1842 prevents the OfficeScan agent from deleting the WLAN Profile by checking and configuring the "EnableWhiteListSSID" and "EnableBlockWiredNetwork" settings in "ofcscan.ini". However, the feature will not work if these settings have been configured previously and users need to remove both keys to disable the feature.

Solution:

This hotfix enables users to disable the feature by setting one or both settings to "2".

Issue 2 of Hotfix 1849

(SEG-22812)

An issue prevents the Data Loss Prevention(TM) (DLP) module from detecting violations in Yahoo(TM) mail.

Solution:

The hotfix resolves the issue by enabling the DLP module to perform UTF-8 MIME decoding in Yahoo mail.

Issue 3 of Hotfix 1849

(SEG-23954)

The system information, product information, product version, and entity icon on the OfficeScan web console do not update automatically.

Solution:

This hotfix updates the OfficeScan XG Patch 1 server file to ensure that the system information, product information, product version, and entity icon are updated promptly.

Enhancement 1 of Hotfix 1849

(SEG-23641)

This hotfix enables OfficeScan XG Patch 1 to monitor the web browser's file upload behavior (Open File Dialog and Drag-n-Drop) for the following websites:

  • uploadfiles.io
  • Files.im
  • smallpdf.com

Issue 1 of Hotfix 1852

(SEG-24106)

OfficeScan agents using conventional scan mode and no Internet connection are unable to send Predictive Machine Learning threat queries when 'Use configured Smart Protection Sources for service queries' is enabled.

Solution:

The hotfix resolves the issue by generating the necessary registry values to properly configure the Predictive Machine Learning and 'Use configured Smart Protection Sources for service queries' features.

Issue 2 of Hotfix 1852

(SEG-23578)

The DLP module blocks sensitive data from being saved to Gmail Drafts using Microsoft(TM) Internet Explorer(TM).

Solution:

This hotfix disables the monitor_webmail_draft feature by default so OfficeScan does not block sensitive information from being saved to Gmail Drafts.

Procedure:

To configure the monitor_webmail_draft setting:

  1. Open the "dlp.ini" file in the "\PCCSRV\Private\" folder on the OfficeScan server.
  2. Locate the following setting under the "Configure" section and set the preferred value.
  • [Configure]
  • monitor_webmail_draft=false (default) OfficeScan does not block sensitive information in webmail drafts
  • monitor_webmail_draft=true OfficeScan blocks sensitive information in webmail drafts
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and click "Agents > Agent Management > Select domains or agents > Settings > DLP settings".
  3. Click "Save" to deploy the settings to agents". The OfficeScan server deploys the settings to OfficeScan agents.

Issue 1 of Hotfix 1853

(SEG-19828)

The Microsoft(TM) Windows(TM) 10 services do not start when a protected computer starts.

Solution:

This hotfix implements customized configurations to allow users to enable or disable the VMware ThinApp application detection feature which can help ensure that Windows 10 services start normally.

Issue 2 of Hotfix 1853

(SEG-24227)

When OfficeScan detects a violation in Yahoo Mail US, the email address in the "destination" field on the corresponding violation log is preceded by a comma ",".

Solution:

This hotfix enables OfficeScan to run a null field check to remove the extra comma from the email address in the "destination" field of the violation logs.

Issue 3 of Hotfix 1853

(SEG-24543)

An issue prevents OfficeScan from blocking sensitive information sent through the HTTP(S) in "dlptest.com".

Solution:

This hotfix ensures that OfficeScan can block sensitive information in "dlptest.com" by adding a new formdata pattern for the site.

Issue 4 of Hotfix 1853

(SEG-22651)

An OfficeScan agent computer may stop responding when a certain 3rd-party software is running.

Solution:

This hotfix updates the OfficeScan server files to ensure that the 3rd-party software can run normally in a protected computer.

Issue 1 of Hotfix 1855

(SEG-21738)

Microsoft(TM) added a feature in Microsoft Windows(TM) 10 Fall Creators Update (RS3). After this update, the Windows Defender Security Center can no longer recognize the status of the OfficeScan antivirus and firewall.

Solution:

This hotfix enables the OfficeScan agent to report the "substatus" of both the antivirus and firewall to the Windows Security Center so that the Windows Defender Security Center displays the correct antivirus product status.

Issue 1 of Hotfix 1865

(SEG-25661)

The PccNtMon service does not apply updates to the Local Area Network (LAN) proxy settings to the proxy settings of Predictive Machine Learning when both the Smart Protection Service and Smart Scan are disabled.

Solution:

This hotfix ensures that changes to the LAN proxy settings are automatically applied to the Predictive Machine Learning proxy settings.

NOTE: If you experience this issue, you need to manually save the LAN proxy setting again after applying this hotfix.

Issue 2 of Hotfix 1865

(SEG-26077)

Trend X alerts are disabled unexpectedly.

Solution:

The hotfix prevents OfficeScan from resetting the TrendxAlert registry key when the TmListen service starts if the agent is not a fresh installation.

Issue 3 of Hotfix 1865

(SEG-20967)

The Browser Exploit Prevention (BEP) URL history feature may determine that URL A's parent is URL B and then URL B's parent is URL A. This leads to a dead loop when BEP attempts to retrieve the URL chain.

Solution:

This hotfix resolves the issue to prevent the dead loop.

Issue 1 of Hotfix 1869

(SEG-25651)

Microsoft(TM) Surface(TM) computers where the OfficeScan agent is installed may stop unexpectedly and experience blue screen of death (BSOD) when the Behavior Monitoring feature is enabled.

Solution:

This hotfix updates the Behavior Monitoring module to resolve the issue.

Issue 2 of Hotfix 1869

(SEG-24486)

OfficeScan agents send a sample file even when sample submission is disabled.

Solution:

This hotfix enables OfficeScan agents to always check the "EnableSampleSubmission" key and apply the correct setting so that these agents do not send out sample files when sambple submission is disabled.

Issue 3 of Hotfix 1869

(SEG-27518)

OfficeScan agents with the program inspection feature enabled may encounter issues with third-party programs due to a conflict with the Memory Scan Trigger pattern (tmmst.ptn/tmmst64.ptn).

Solution:

This hotfix updates the OfficeScan agent program to resolve this issue.

Enhancement 1 of Hotfix 1869

(SEG-27654)

A user requests for an API to automate the move and uninstall agent processes.

Procedure:

To enable the new settings:

  1. Install this hotfix (see "Installation").
  2. Open the "Ofcscan.ini" file in the "\PCCSRV\" folder of the OfficeScan server installation directory using a text editor.
  3. Under the "Global Setting" section, manually add the following keys and set both values to "1".
  • [Global Setting]
  • EnableMoveNATClient=1
  • MoveNATClientRemoveEmptyDomain=1
  1. Save the changes and close the file.
  2. Open the OfficeScan web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The OfficeScan server deploys the command to OfficeScan agents and adds the following registry entry on all OfficeScan agent endpoints:
  • Only "EnableMoveNATClient" will be deployed to client, the path:

    • For x64 platforms:
    • HKEYLOCALMACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\
    • For x86 platforms:
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\
  • Key:
  • EnableMoveNATClient
  • Type: REGDWORD
  • Value: 1

8. Contact Information

A license to Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, you must renew Maintenance on an annual basis at Trend Micro's then-current Maintenance fees.

Contact Trend Micro via fax, phone, and email, or visit our website to download evaluation copies of Trend Micro products.

http://www.trendmicro.com/us/about-us/contact/index.html

NOTE: This information is subject to change without notice.

9. About Trend Micro

Smart, simple, security that fits

As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information.

Copyright 2018, Trend Micro Incorporated. All rights reserved.

Trend Micro, OfficeScan, Data Loss Prevention, and the t-ball logo are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other marks are the trademarks or registered trademarks of their respective companies.

10. License Agreement

View information about your license agreement with Trend Micro at: http://www.trendmicro.com/us/about-us/legal-policies/license-agreements/

Third-party licensing agreements can be viewed:

  • By selecting the "About" option in the application user interface
  • By referring to the "Legal" page of the Administrator's Guide