CSA 4.0.3.736 and TrendMicro Virus Scan

Question

Hello,
has anyone made a policy for TrendMicro Virus Scanner? When I update the the Virus Scanner, always the Trojan Detection Rule triggers. Which process downloads and tries to execute the upgrade.exe? I guess the "tmlisten.exe". I made a exception but that does not work!
Any ideas?

Answer 1

From TAC:
If you see a message similar to this (the actual downloaded executable may be different in your case):
The program 'C:\Program Files\CA\Common\ScanEngine\Incoming\iv_nt86.exe' was recently downloaded and attempted to execute. The user was queried whether to allow this operation. The user chose 'Terminate (as default)'
and you want to exclude the application that did the downloading from the Trojan Detection Rule, there are some steps you must do.
The exclusion in the Trojan Detection rule is for the application that actually did the downloading - NOT the actual downloaded file. The message says that iv_nt86.exe was recently downloaded. Therefore, the file that was downloaded is iv_nt86.exe. We do not know what actually did the downloading in this instance most likely because the process was terminated before we could find out. To find out which application did the downloading, set up a File Monitor Rule where the application class is "all applications" that attempt to "read and write" the file "iv_nt86.exe" (no quotes around these values). Then once this file is accessed, you will see in the event log which application is doing the downloading of the file. Then exclude that application that downloaded iv_nt86.exe in the Trojan Detection Rule.