The Trend Client Manual Removal Instructions on Trend’s site.
One thing to keep in mind when it comes to the above instructions when working with 64bit operating systems:
Add the Wow6432Node to any HKLM\Software\* registry changes when removing references to the Trend client.
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book
*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.
We are doing the last of our Trend Micro A/V product removals and replacement with Symantec EndPoint Protection.
Our Trend odyssey has unfortunately been long and very painful:
So painful in fact, we paid for a one year SEP subscription and did the R&R for free at all of our clients that had the Trend product installed at.
The password for this last client is not being recognized. So, our notes must be out of date as the password must have been changed without those notes being updated or perhaps the product hiccupped yet again.
To change that admin password:
We now have the ability to manage if that was what we needed, or now to remove the product completely from all of our workstations and servers on this network.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book
*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.
A while back we had a client that had booked a series of flights online.
A few minutes later, an e-mail with an attachment happened to arrive in his inbox with the airline’s “itinerary”. Without even thinking about it he opened the e-mail and the attachment and that was the point of no return.
The A/V, Trend, did not stop it.
So, we ended up in a bad situation that got worse when we discovered that the local laptop backups were not being done.
We had tried the cloud A/V and spam filtering that Trend had but we ended up having way too much grief with their service.
In comes Own Web Now’s ExchangeDefender.
The analogy we use when explaining why we prefer having the filtering done in the cloud before e-mail enters the corporate network works quite well.
The Anti-Virus program is like a 6’6” 275Lb bouncer that sits close to the front door. They can move about the place with relative ease and have access to all entry points in the place.
For the most part, the bouncer – name him/her whatever – catches any baddies that try to get in through the doors or the windows.
But, every once in a while a slim and short baddie does get by the bouncer because baddie is just too quick and new.
It then takes a bit of training for the bouncer to pick up on the new baddie and squash them at the point of entry. That delay can cause a big problem if the biddies' siblings happen to try and get in too.
With that imagery in mind, we can explain how Vlad’s service is set up to do just that long before the baddie even reaches the door. They get squashed out on the street! ;)
And, because the service is dedicated to this task alone, the filtering that is done will be that much better than anything the Anti-Virus vendors can do in real-time.
This morning, this was in an Inbox:
The file was culled before it reached the corporate network. A file culled out there is a file not clicked on by a user. Leaving that file to some form of Exchange based filtering or the endpoint workstation is a dangerous game we are no longer willing to play.
Given the fact that the cost of the ExchangeDefender service is very minimal relative to the level of services received it is not a difficult sell. We also include the ExchangeDefender service in our Hybrid Managed Services plans to add value to them too.
And, once our clients are onboard with our services and ExchangeDefender they do notice a big difference in the amount of time they no longer spend processing all of the junk e-mail.
Being a partner with Own Web Now is an important part of our business model (previous blog post). As we build up our client’s usage of the OWN services, the more confident we are going forward.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book
*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)
A while back, we blogged about Symantec Endpoint Protection (SEP) and how much of a memory hog it was: SBS on dual Xeon E5345 Quad vs. 5130 Dual Core + Symantec EndPoint Memory Costs.
We just finished our first site A/V migration off of Trend’s Worry Free Business Security back to Symantec’s Endpoint Protection in its MR4 version. In this case, as well as it will be at the other Trend sites we have, we paid for a 1 year gold maintenance SEP agreement for the client’s site, removed the Trend product, and installed SEP at no cost to our clients.
Our Trend odyssey can be read here:
Given our past experience with SEP RTM, the one main concern we had was with memory usage.
We were fortunate that in this case, we had a second server with Windows Server 2008 Standard x64 installed running a number of different roles on the SBS 2003 domain. The box has 16GB of RAM installed, so memory should not be an issue.
Here are a couple of screenshots of SEP up and running on the Win2K8 x64 box:
Symantec Endpoint Protection MR4 x64 Memory Footprint (SEP Client and SEP Management Server): ~200MB
The above screenshot was taken after about 3 days of the server being in production. The memory footprint out of the box was not a whole lot less than that.
Wow! What a huge step down in memory consumption versus the previous versions of the product.
Symantec utilizes SQL Anywhere for their database structures:
SEP MR4 SQL Anywhere Memory Footprint: ~82MB
The combined total RAM usage of the product on the management server is less than 250MB! That is an awesome achievement. Especially since that number includes both the client and management components.
The SEP client on the workstations has also taken a huge step down in its memory consumption:
SEP MR4 Windows Vista Enterprise Client Memory Footprint: ~30MB
SEP MR4 Windows XP Professional Client Memory Footprint: ~15MB
It looks as though both the server and workstation versions were slimmed right down.
Besides the memory footprint reduction, the CPU resources that the server A/V and client workstation A/V uses has been drastically reduced. In our workstation VMs, the client would run around 3-5% of the CPU cycles during intensive usage while on physical laptops and workstations that number would barely approach 1-3% during intensive usage.
On the server side, Live Update is set up to run update checks hourly, and it does seem to be pulling a good number of updates down for each SEP component during those update sessions. So, it looks as though Symantec is also keen on having the product as up to date as possible.
Now, whether our SEP clients remain virus free will be another thing to see yet.
But, given the fact that none of our clients had a virus problem while on Symantec’s previous generation corporate products, we are counting on SEP to keep that virus free legacy alive.
NOTE: We do not install third party firewall components on servers or workstations. We only install the A/V and malware components.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac!
The errors should stop. The big thing is to make sure that both the user name and password do not combine to more than 14 characters. We cannot even do this: domain\Trend since the domain characters will also count.
We have all seen all manners of code slip by with some pretty funky bugs. This has to be one of the better ones to have slipped by the "quality control" people over at Trend.
For us, this situation, the lack of support, and the fact that one of our clients who was virus free until we installed Trend A/V on their systems pretty much puts the final nail in the coffin.
We will go back to Symantec for the time period between now and when our clients have SBS 2008 installed. From there we will run with ForeFront and Live OneCare on SBS 2008.Security 537 2/10/2008 4:44 AM 16,044 *And, something that came to us via one person who contacted us as a result of the first post on this issue that causes us to pause:Logon Failure: Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Èù
Authentication Package: NTLM
Workstation Name:
Status code: 0x80090308
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Dear XXXXXX,
This is an update.
According to RD, the event ID 537 is caused by TMUFE, which is our Web Reputation service engine.
The behaviour of TMUFE will be as follows:So it is normal for the security warning to show up on event logs of the SBS server.
- Connect to Proxy Server without authentication.
- Proxy server return access denied (Event ID 537) and request authentication.
- Connect to Proxy Server with configured user name/password.
Thank you and have a great day!
Best regards,
Txxxx Cxxxx
Systems Engineer
Australia Technical Support Center
TrendLabs HQ, Trend Micro Incorporated
And, just tonight as this post was being written, the following showed up in our Experts-Exchange Inbox: SBS performance report displays thousands of event id 537 errors. Apparently the above note was sent to the person posing the question who has 5 SBS servers showing the problem.
The above mentioned services were indeed a part of our troubleshooting with B. Especially when it came to having ISA on the box. But, if there were authentication issues, updates too should fail which they were not.
Notice that there are a lot of them.Security Event ID 537: An error occurred during logon.
