keybase / keybase/keybase-issues
Trend Micro OfficeScan deletes Keybase Windows installer during installation
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
I tried installing your software from https://prerelease.keybase.io/keybase_setup_386.exe, but unfortunately it did not succeed in installing the software.
Steps taken:
- Executing "keybase_setup_386.exe" with Administrator privilages
- Hitting the "Install" button in the Keybase Setup application
- Enter my Administrator privilages
- The Keybase Setup application gets terminated by Trend Micro OfficeScan 11.0.6054 SP1 due to the following reasons:
Information from Trend Micro OfficeScan
The following threats or security policy violations have been resolved:
Malicious Behavior Detections: OfficeScan detected a Behavior Monitoring policy violation and blocked the offending process(es).
- Violation: Malware behavior blocking
- Program: C:\Users\xxxx\Local\Temp{xxxxx}.cr\keybase_setup_386.exe
- Event: Registry
- Risk: High
- Target: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce{25b8d256-dde7-4e38-bdde-07e0de8dd0f3}
- Operation: Write
- Action: Clean
Virus/Malware: OfficeScan has detected one or more virus/malware threats on your endpoint.
- File Name: keybase_setup_386.exe
- Threat: Multiple
- Result: Deleted
- Scan Type: DCS
- Path: C:\Users\xxxx\Local\Temp{xxxxx}.cr\keybase_setup_386.exe
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Start by reproducing the installation of keybase_setup_386.exe with Trend Micro OfficeScan 11.0.6054 SP1, then trace the installer’s RunOnce registry operation and deletion event. Done means the Windows installer completes without OfficeScan deleting it.
Written by the indexing model from the issue text.
Assessment
- Domain
- desktop, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100