We help IT Professionals succeed at work.

Newly Encountered Program Detection

Ryan Chong
Ryan Chong asked
on
My IT team installed the Trend Micro antivirus software couple of months ago. Since then, our in-house built .NET program that deployed via ClickOnce technology got this message prompting out every time we launch the program.

Untitled.jpg
We know that this is relating to Trend Micro's feature of Newly Encountered Program Detection

Understanding Behavior Monitoring detections in OfficeScan
https://success.trendmicro.com/solution/1121152-behavior-monitoring-detections-officescan#collapse4

But how can we bypass this configuration so that the prompt of Newly Encountered Program Detection can be disabled for our in-house built .NET program?

We tried to include the installation path of .NET program (such as C:\Users\xxxxxx\AppData\Local\Apps\2.0) into the Trend Micro's Exclude List in local machine, but it doesn't help and the message is still keep prompting.

Any help is greatly appreciated, thanks.
Comment
Watch Question

View Solution Only

Ryan ChongSoftware Team Lead

Author

Commented:
Hi,

How to login or access to OfficeScan management console ? Is it a web-based URL or a program? I did a search on my local laptop but didn't find any related program.
Zaheer IqbalTechnical Assurance & Implementation

Commented:

Do you have a server team that look after your antivirus application back-end server ?

I guess you have logged an incident in your in house IT Team.

Ryan ChongSoftware Team Lead

Author

Commented:
Thanks for your inputs

I will verify with my infra team colleagues soon and get back to you.
Software Team Lead
Commented:
We got reply from Trend Micro support after investigating our case.

And here's the reply from them:

Apologies for the delay as we tried to replicate the issue in our lab and I also consulted with our modules' development team for this case. Based on our investigation, the exception/trusted program list did not work to exclude this application because the module that is blocking it is the Meerkat module.

After further discussion with our Meerkat modules team, the only way we can exclude the application from being blocked is for you to send us a copy of the application so we can add this in our Global List.
Upload link : https://box-us.trendmicro-cloud.com/SFDCSignOut/UploadPage.aspx?sha_unique=E93F432B-7267-4B49-A0DF-4C62541D595B

If you cannot provide us a copy of the application, the only way is to disable the Meerkat (Newly Encountered Programs) Feature:
 -> From the policy deployment page, disable the 'Newly Encountered Programs' under the Behavior Monitoring Settings.