Views:

To clean malware remnants and/or restore system policies, please follow the steps below.

 
If the DEADLINKS.INI file already exists, and the malware full path and filename is already in the DEADLINKS.INI file, you can restart the machine to clean out any remnants or restore policies.

To restore system policies and clean the registry remnants left by malware when the files have already been cleaned up by a scan (i.e. real-time or manual scan):

  1. Go to the folder where the TSC.EXE file is located.

    The default locations are:

    1. OfficeScan: C:\Program Files\Trend Micro\OfficeScan Client
    2. WFBS/Client Server Security Agent: C:\Program Files\Trend Micro\Client Server Security Agent
    3. SPNT: C:\Program Files\Trend\Sprotect
  2. Create the DEADLINKS.INI file if it does not exist yet.
  3. Add the “[MAL_FILE]” entry on the first line.
  4. Add the following on the next line:

    DEADLINKSFILE=<malware full path and filename>

    For example:

    DEADLINKSFILE=C:\test\bad.exe

  5. Save and close the file.
  6. Run TSC.EXE.
  7. Restart the system for the policies to take effect.

If the files and registry remnants of the malware have already been cleaned up, but certain functionalities still do not work on the machine (i.e. Task Manager), then please do the following:

  1. Go to the folder when the TSC.EXE file is located.

    The default locations are:

    1. OfficeScan: C:\Program Files\Trend Micro\OfficeScan Client
    2. WFBS/Client Server Security Agent: C:\Program Files\Trend Micro\Client Server Security Agent
    3. SPNT: C:\Program Files\Trend\Sprotect
  2. Create the DEADLINKS.INI file if it does not exist yet.
  3. Add the “[MAL_FILE]” entry on the first line.
  4. Add the “DEADLINKSFILE=” parameter on the next line.
  5. Save and close the file.
  6. Run TSC.EXE.
  7. Restart the system for the policies to take effect.