keybase / keybase/keybase-issues

Trend Micro OfficeScan deletes Keybase Windows installer during installation

Open
#2,613 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I tried installing your software from https://prerelease.keybase.io/keybase_setup_386.exe, but unfortunately it did not succeed in installing the software.

Steps taken:

  1. Executing "keybase_setup_386.exe" with Administrator privilages
  2. Hitting the "Install" button in the Keybase Setup application
  3. Enter my Administrator privilages
  4. The Keybase Setup application gets terminated by Trend Micro OfficeScan 11.0.6054 SP1 due to the following reasons:

Information from Trend Micro OfficeScan

The following threats or security policy violations have been resolved:
Malicious Behavior Detections: OfficeScan detected a Behavior Monitoring policy violation and blocked the offending process(es).

  • Violation: Malware behavior blocking
  • Program: C:\Users\xxxx\Local\Temp{xxxxx}.cr\keybase_setup_386.exe
  • Event: Registry
  • Risk: High
  • Target: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce{25b8d256-dde7-4e38-bdde-07e0de8dd0f3}
  • Operation: Write
  • Action: Clean

Virus/Malware: OfficeScan has detected one or more virus/malware threats on your endpoint.

  • File Name: keybase_setup_386.exe
  • Threat: Multiple
  • Result: Deleted
  • Scan Type: DCS
  • Path: C:\Users\xxxx\Local\Temp{xxxxx}.cr\keybase_setup_386.exe

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by reproducing the installation of keybase_setup_386.exe with Trend Micro OfficeScan 11.0.6054 SP1, then trace the installer’s RunOnce registry operation and deletion event. Done means the Windows installer completes without OfficeScan deleting it.

Written by the indexing model from the issue text.

Assessment

Domain
desktop, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.