When upgrading Officescan clients from 10.5 to 10.6, some were successful while others failed. Users of machines with the failed upgrade reported that they are getting a Windows pop-up that states that the AntiVirus/Firewall has been turned off and that they need to enable the Officescan client. The Windows notification will appear every 2-4 minutes. They also reported that the Officescan clients are unloading then reloading on their own.
When you check the [drive]:\Program Files (x86)\Trend Micro\OfficeScan Client\Temp folder of the client that failed to upgrade, there were a lot of upgrade logs (upgrade_yyyymmddhhmmss.log) generated. It showed that there were multiple upgrade attempts but the version remains the same after each attempt, which explains the constant popup and unload-reload.
The upgrade process is running into a loop. Inspection of the registry of the affected clients show that they are using an Update Agent as source to get Program or hotfix upgrades. This source is represented by the string "RelayClientGetHotfixFrom"="http://ip-address-of-upgrade-source:port" in problem client's registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]
"RelayClientGetHotfixFrom"="http://ip-address-of-upgrade-source:port"
If this source is outdated, the upgrade process will not proceed because it will see that there is no new program version inside the source. Whenever the 10.6 Officescan server checks the version of these outdated clients, it will instruct them to perform an upgrade. Still, the upgrade process will again run into the outdated source. Thus, the upgrade loop.
To resolve the issue, you can perform any of the following:
- Make sure that all Update Agents are upgraded to the latest version (10.6).
- Temporarily configure Standard Update source (the OfficeScan server). This can be configured under Networked Computers > Update Source in the OfficeScan web console.
