To clean malware remnants and/or restore system policies, please follow the steps below.
To restore system policies and clean the registry remnants left by malware when the files have already been cleaned up by a scan (i.e. real-time or manual scan):
- Go to the folder where the TSC.EXE file is located.
The default locations are:
- OfficeScan: C:\Program Files\Trend Micro\OfficeScan Client
- WFBS/Client Server Security Agent: C:\Program Files\Trend Micro\Client Server Security Agent
- SPNT: C:\Program Files\Trend\Sprotect
- Create the DEADLINKS.INI file if it does not exist yet.
- Add the “[MAL_FILE]” entry on the first line.
- Add the following on the next line:
DEADLINKSFILE=<malware full path and filename>
For example:
DEADLINKSFILE=C:\test\bad.exe
- Save and close the file.
- Run TSC.EXE.
- Restart the system for the policies to take effect.
If the files and registry remnants of the malware have already been cleaned up, but certain functionalities still do not work on the machine (i.e. Task Manager), then please do the following:
- Go to the folder when the TSC.EXE file is located.
The default locations are:
- OfficeScan: C:\Program Files\Trend Micro\OfficeScan Client
- WFBS/Client Server Security Agent: C:\Program Files\Trend Micro\Client Server Security Agent
- SPNT: C:\Program Files\Trend\Sprotect
- Create the DEADLINKS.INI file if it does not exist yet.
- Add the “[MAL_FILE]” entry on the first line.
- Add the “DEADLINKSFILE=” parameter on the next line.
- Save and close the file.
- Run TSC.EXE.
- Restart the system for the policies to take effect.