(imported topic written by YorkLy)
Hi All, I have a customer who has upgraded their TEM server from 7.2.5 to 8.1. All their workstations with CPM Client v1.6 have upgraded to v10.5. After awhile, customer has noticed that some of their Besclients reported CPM client current status in “Not running”. Further investigated and found out that all the subfolders and majority files are removed from this directory on the workstation.
C:\Program Files\Trend Micro\Core Protection Module
It left behind 5 DLL files and one exe files in that folder. But the CPM services are still remained in the Service panel.
The C:\Program Files\Trend Micro\OfficeScan Client folder and its files seem to be still there.
The application event viewer showed error about access to CpmConfig.ini file by Trend CPM application.
Looking at the C:\Windows\CPM*.log files and nothing indicated there was a uninstall task occurred which could delete those files.
This happens to a few of the workstations with this problem and it can’t explain who or what would have deleted those files.
Has anyone seens this problem and how could be the problem?
See the screen attachment.
How do I trace back what has happened to the CPM Client?
Is there a log somewhere for BesClient or Windows to trace who has deleted those files?
York