Trend Micro Officescan status now gets updated on some devices.

smusser · 2011-04-12T09:50:47.000Z

Ben.B (Spiceworks) wrote:

Sam5252:

here is the screenshot from security center

something clearly isn’t right with the scanning.

Out of the 26 that show “unknown” status how many are running a desktop OS (XP/Vista/7)?

Any servers running 2003/2008 server should show up in this list, because Spiceworks can’t get up-to-date status (there’s not Windows Security Center to report the info).

That will also include server 2000. Yes, they still exist…lol. At least in my network.

MarkT94 · 2011-04-12T10:32:13.000Z

@Ben - scans performed, and the package file has been sent to you. Thanks again!

jeremyb · 2011-04-12T11:38:01.000Z

I was running a clean install of Beta 5, and I sent in a copy of logs to you for the vPro today as well.

Spiceworks Beta 5 is temporarily running on an XP machine (small company - no test environment), and is scanning only my Win7 x64 machine. (Also the vPro machine).

It’s showing both machines as up-to-date and unknown.

It was file {43740}.

timjackson4638 · 2011-04-12T13:15:09.000Z

In the earlier beta, I found that with some clients I had to run a manual rescan from the inventory screen for the AV to update correctly. After the manual scan, the full scans detected those clients properly.

So I am just curious about the others Trend v10 installs - what build are you at? My Officescan server is at build 2812.

jeremyb · 2011-04-12T13:30:34.000Z

Ah-Ha! Success!

A manual rescan of each device and then a full network rescan did it. Not sure what the real fix was, I’d done this before multiple times…

Attached is proof of the elusive 100% updated plug-in.

I also can not tell you what our sever build is, we don’t host it. - Long winded story there. But we are Client Version 10.0 SP1

Edit: although I suddenly realized that the Client program no longer shows up… so not really a fix, more of an ignored problem? Oh I dunno anymore!

smusser · 2011-04-12T13:35:19.000Z

I think they have the detection for OfficeScan now fixed.

Tomorrow I am going to try a clean install, then import some old data into SW and then run manual re-scans. I hope to see positive results.

Edit: Just realized today is Windows Update day. Re-focus on WSUS for now. Back to the beta after this round is complete!

john-rehill · 2011-04-12T23:44:31.000Z

Just did another install of Beta V with migrated data.

Full scan no change.

With an individual scan, it removed the second listing with no mark against it and now just lists one Trend AV as up-to-date.

As for the full name, before I had the links for “Devices with Trend Micro OfficeScan Antivirus Antivirus” and “Devices with Trend Micro OfficeScan Client Antivirus”

The one left now links to “Devices with Trend Micro OfficeScan Antivirus Antivirus” which is strange as in the registry I can find “Trend Micro OfficeScan Client” but not “Trend Micro OfficeScan Antivirus”.

Plus, numbers wise, the AV AV is 220 while the Client AV listing is 239!!

Strange.

Ben-B-Spiceworks · 2011-04-13T15:50:32.000Z

Mark Tinder wrote:

@Ben - scans performed, and the package file has been sent to you.

The logged info on 040 is strange - finder sees that it is duplicating the AV info, removes it, and then for some reason re-adds it. Have you tried deleting this device and rescanning it?

108 and 115 appear to be reporting the AV name in Windows Security Center, but the status isn’t available there. What does Security Center show on the device itself?

I didn’t see a rescan log for sys100 - is that one resolved now?

sam5470 · 2011-04-13T21:29:05.000Z

Hi Steve M

This was a CLEAN install of beta V, then I took backup of my prod. DB and copied it across to my test server (and beta V upgraded this backup DB successfully).

I’ve just run a re-scan on one of the machines that was showing the double-up of trend, and the problem remains the same.

Any other suggestions?

Update - running a full network scan now and will see if the device get’s “refreshed” after doing so.

**Update #2 - after running a FULL network scan there is no difference - still a double-up in the configuration tab on the workstation that i checked previously"

Ben-B-Spiceworks · 2011-04-14T15:28:19.000Z

Sam5252 wrote:

I’ve just run a re-scan on one of the machines that was showing the double-up of trend, and the problem remains the same.

Any other suggestions?

Send me your logs and I’ll take a look at why this is still doubling-up. I’ll PM you with details.

MarkT94 · 2011-04-15T07:10:36.000Z

@Ben - I took a look at 108 and 115. First I deleted them and rescanned - no change. Then I went to look at Security Center…oddly enough, Security Center does not recognize Trend Micro OfficeScan, even though the AV program is shown in the system tray, is online, and up to date.

I found this post you commented on from a while back:

http://community.spiceworks.com/topic/94236-windows-7-pro-32-64-bit-all-show-antivirus-none-detected-in-inventory?page=2

The truly odd thing, this is two laptops out of 20 with identical builds, the other 18 have no problems with Security Center and Trend Micro. I have tried looking at what other software is running on these machines that might cause a conflict, but the only program that is common to both, and not on the other 18, is Carbonite. I would not think Carbonite would cause a Security Center issue. I tried disabling Carbonite, did a reboot, same issue with Security Center - likely confirmation that Carbonite is not my culprite.

Deleted 040 from inventory and completed a device scan. System readded, but so was the entry under “Not up to Date.” 040 also has an entry under “Up to Date.” So, no change. I looked at Security Center, and there were no alerts regarding AV protection, and OfficeScan was online/up to date per the client console.

Any ideas?

Ben-B-Spiceworks · 2011-04-15T11:21:11.000Z

Mark Tinder wrote:

… but the only program that is common to both, and not on the other 18, is Carbonite. I would not think Carbonite would cause a Security Center issue. I tried disabling Carbonite, did a reboot, same issue with Security Center - likely confirmation that Carbonite is not my culprite.

Mark, this might make sense for Win7 devices, but less so for XP devices.

The updates to Security Center in Vista/7 added the ability to monitor backup solutions, I believe. If so, Carbonite might be writing info into SecurityCenter2 somehow?

C:\> wmic /namespace:\\root\SecurityCenter PATH AntiVirusProduct get * >> %USERPROFILE%\Desktop\avlog.log
C:\> wmic /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get * >> %USERPROFILE%\Desktop\avlog.log

Run these commands on the devices that aren’t returning/displaying AV info. The commands produce a log on the Desktop. Is the AV info there?

Ben-B-Spiceworks · 2011-04-15T11:29:53.000Z

I don’t see any backup related WMI values in SecurityCenter/SecurityCenter2 or the cliv2 namespace, so maybe not.

I don’t suppose you could test out uninstalling Carbonite completely (not just disable/restart)?

MarkT94 · 2011-04-15T11:59:52.000Z

Ha! It’s my boss’s boss’ computer. I’ll see what I can do. I’ll try and run those codes prior to an uninstall as well…just in case.

MarkT94 · 2011-04-15T12:57:17.000Z

Removed Carbonite, then swept the registry (found a few left-overs). Did a reboot, then removed/rescanned 108 in inventory. Carbonite does not show up in the Software inventory, and even after a rescan of the rescan, the laptop still shows up in “Unknown Status.” There is no entry for this device under “Up to Date.”

I went back into Security Center, Win7 still thinks there is no AV software installed. System Tray says otherwise of course, and Spiceworks Software Inventory shows Trend Micro OfficeScan Client.

I am thinking my next step should be to uninstall/reinstall Trend Micro. Possibly a corrupt install?

Ben-B-Spiceworks · 2011-04-15T13:09:18.000Z

Hmm… a TrendMicro reinstall wouldn’t hurt. I’m not sure when the info gets written into WMI, actually.

You can use these commands (above) to find out quickly if Spiceworks is going to be able to “see” up-to-date status or not:

http://community.spiceworks.com/topic/post/728066

a rescan is the same, too, if thats easier for you.

If the results are empty, we aren’t going to be able to see up-to-date status.

Instead, we’ll fall back on the list of software names from the registry (which won’t tell us anything other than AV name and version).

C:\> wmic /node:devicename /user:DOMAIN\username /password:password /namespace:\\root\SecurityCenter PATH AntiVirusProduct get * >> %USERPROFILE%\Desktop\avlog.log
C:\> wmic /node:devicename /user:DOMAIN\username /password:password /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get * >> %USERPROFILE%\Desktop\avlog.log

You can run the commands remotely by adding node, user, and password switches (thought that might help since this is your boss’s computer).

EDIT: boss’s boss*

MarkT94 · 2011-04-15T13:40:30.000Z

Think I’ve figured out what happened.

After uninstalling Carbonite, I uninstalled Trend Micro and verified that the Software Inventory and Dash widget showed the device AV status correctly. Security Center correctly reported no AV software installed.

I reinstalled Trend Micro and verified that Software Inventory, Dash Widget, and Security Center all agreed that Trend was a happy camper again.

I reinstalled Carbonite…(drum roll please)…Software Inventory, Dash Widget and Security Center STILL agreed that Trend was good to go…phfew!

After ponding this problem, I got to thinking. Both 115 and 108 had fake AV issues back in January/February. One was related to something pulled down from Webshots (hate that program), the other was from something else (memory faiding on that one). Best guess, the fake AV program corrupted Trend’s registry entry, causing SW and Security Center to incorrectly see Trend’s status.

I’ll be uninstalling/reinstalling Trend on 115 to verify that my fix is correct.

Ben-B-Spiceworks · 2011-04-15T13:54:47.000Z

Ah - that makes sense. I don’t think I’ve ever seen this before (Security Center failing because of malware).

MarkT94 · 2011-04-18T10:03:46.000Z

Success! I uninstalled then reinstalled the Trend client from the computers. I then completed a rescan of the device (no device deletion required), and Trend reported correctly. I have two more problem children to deal with, but should have everything but my thin clients and servers taken care of on the Security Center widget.

Thanks for the assist Ben.

Ben-B-Spiceworks · 2011-04-18T10:07:02.000Z

Reinstall ftw!