ServerProtect For Storage

Running ServerProtect and Microsoft Defender on the same machine may lead to the following:         • Virus detection failure        • Application lockup        • Machine performance issueYou may refer to this documentation for updated Microsoft Window's Compatibility to 3rd party Antivirus. Recommended settings are indicated as well.Should there be compatibility issues with Microsoft Defender and ServerProtect, Trend Micro recommends deactivating Microsoft Defender to lessen resource consumption for your endpoints. This also ensures that ServerProtect's security features work in optimal condition by eliminating potential conflicts with Microsoft Defender

After upgrading Virus Scan Engine to 12.200.1020, the Normal Server may restart every time a scheduled deployment or manual deployment tries to deploy Virus Scan Engine.

The NetApp Filer reports that scan requests are lost, even though they are scanned by the VirusScan Enterprise for Storage module and timeout settings are properly configured on both the filer and scanner server. This occurs only with very large files (multiple gigabytes).Example: nasbpvsc02@nasbpf02p:vscan.server.completionRequestLost:warning]: CIFS: Vscan server 172.22.66.150 completed a scan request for ONTAP_ADMIN$\vol\FSVOL023\dacipost\BUZON GENERAL\PENDIENTES SIN GESTIONAR 20150325.zip but the original request was not found. Depending on the case, the filer's VSCAN abort_timeout value is either met or exceeded and you see the following error message on the filer: "vscan.server.requestTimeout:error : CIFS: Virus scan request to xxx for file xxx timed out. Vscan abort_timeout setting exceeded. Filer will retry this request on other vscan servers, if possible." The scanner server completes the scan request some time later, after which you see the following error in the filer's messages/syslog file: "vscan.server.completionRequestLost:warning : CIFS: Vscan server xxx completed a scan request for xxx but the original request was not found."

This article lists all of the products integrated in Apex Central.

After deploying Virus Scan Engine 22.610 or later, a scan result shows the following:Real-time scan found virus "" in "?:".Action result: Clean failedServerProtect is unable to recognize the new scan report type after deploying Virus Scan Engine 22.610 or later. It will treat the scan report as Boot virus report that will cause this issue because different scan report type has different scan report content or offset.

There has been a report that there was no virus detection log on the ServerProtect Management Console when performing the EICAR test. This is done by placing the EICAR file on the local server or in the NAS folder where SPFS with CAVA mode was configured as the antivirus software. In the mean time, there may be alerts about the infected EICAR file.This issue may happen when the Microsoft Defender Antivirus Service (msmpeng.exe) or other 3rd party anti-virus program such as CrowdStrike is running on the SPFS server or on the server from where the EICAR test folder is accessed. Microsoft Defender or other 3rd-party antivirus program may take action on the EICAR file before SPFS can hook or take action on this file.

When integrated with Dell ONEFS 9.x storage in Common AntiVirus Agent (CAVA) mode, you may receive false positive infection notification from the Dell ONEFS storage. Consider the following scenarios:Scenario 1: Temporary files like .tmp, .laccdb.Scenario 2: Editing and saving office file directly from storage

This article will discuss the resolution for the following issues:The User Name in Storage Scan Result tab would always be 0.0.0.0, while it should be the Internet Protocol (IP) address of the user who caused a virus-infection on the Storage server. The user who caused a virus-infection cannot see the warning message box when “Notify a device client upon infection” is enabled.

Your Normal Servers become offline after applying ServerProtect for Storage 6.0 Patch 1 and the Normal Server service “spntsvc” fails to start with a 14001 error code.cmd view:service.msc view:A 14001 error log and a SideBySide configuration error log should exist in the Windows Event log as shown below: This issue also appears on ServerProtect for Windows 5.80 after applying Patch 5 (or higher). The following solution will also be applicable. 

In the ServerProtect NS debog log, the following errors may be encountered:"Error 5(ERROR_ACCESS_DENIED)""1722(RPC_S_SERVER_UNAVAILABLE)" The ServerProtect Information Server (IS) may be able to download the pattern file but the Windows NS does not receive the update.