Cannot disable TrendMicro scan in 380.68_2

[gjf]

Hi All.

RT-AC68U with Merlin 380.68_2.
Every time I am trying to go to http://www.emui.com the router redirects to "Warning! The website contains malware. Visiting this site may harm your computer blahblahblah"
According to logo it is TrendMicro false.
I have only "Vulnerability Protection" enabled in AIProtection - Network Protection, so I switch it off. Anyway the situation does not change.

What is going on?

 

[AndreiV]

I have all the TM AI Protection modules running and see no issue visiting that site.

Make sure you have the latest signatures installed :: Version 1.184 Updated : 2017/09/30 02:00

then try rebooting the router, if you still have problems a clean install would be a good idea.

 

[gjf]

The question is not about running modules and updates.
The question is why modules are running when they are disabled?

 

[AndreiV]

If you did as suggested you would probably find the answer.

Like I said , I have all the Ai Protection settings enabled and do not have the problem , the site you complain about works fine here so it must have been a false positive that has been removed in a later signature update.

If I turn off Ai Protection it stops working.

You probably have a corrupted firmware , when did you last reboot or factory reset after a firmware upgrade?

 

[gjf]

Damn, you're right - reboot solved the problem.
But I still wonder why.
If modules are running free of settings - it is nonsense.
The same nonsense is requiring a reboot with every TrendMicro update.

P.S. Nope, this crap is still exists!
Try to browse the website - go to Themes etc. I have a warning again immediately when I try to go to sections.
After that I cannot open the webpage again. It looks like TrendMicro module was disabled right after reboot - but then it re-enables again. WTF?!

 

[elintseeker]

Are you sure it's the router and not your browser? On my end, same router and firmware version doesn't have any problems browsing the Huawei site.

 

[gjf]

Does it looks like the browser?
By the way - same for FF, IE, Edge...

 

[Jack Yaz]

Damn, you're right - reboot solved the problem.
But I still wonder why.
If modules are running free of settings - it is nonsense.
The same nonsense is requiring a reboot with every TrendMicro update.

P.S. Nope, this crap is still exists!
Try to browse the website - go to Themes etc. I have a warning again immediately when I try to go to sections.
After that I cannot open the webpage again. It looks like TrendMicro module was disabled right after reboot - but then it re-enables again. WTF?!

Did you do a factory reset as advised?

 

[gjf]

Uh. Just performed it. It took a long time to restore all settings from the scratch. Whatever - the situation remains the same.

 

[Jack Yaz]

Uh. Just performed it. It took a long time to restore all settings from the scratch. Whatever - the situation remains the same.

What signature is the TM engine using?

 

[gjf]

No idea because I never used it. How to find the signature version?

 

[Jack Yaz]

No idea because I never used it. How to find the signature version?

Administration -> Firmware Upgrade

 

[gjf]

1.150

 

[Jack Yaz]

1.150

Click to check for update, I believe there are later versions.

While this doesnt solve why TrendMicro runs irregardless, it may at least remove the false positive.

 

[gjf]

Already clicked it. "Signature is up to date".

 

[gjf]

380.68_4 partially fixed the issue - but not in full: the TrendMicro blocking appears not always, but from time to time with new firmware when browsing the above mentioned page.

 

[AndreiV]

Already clicked it. "Signature is up to date".

1.184 Updated : 2017/09/30 is the latest signature version.

 

[gjf]

As I said: I pushed "Check" button and no newer updates were found.

 

[AndreiV]

As I said: I pushed "Check" button and no newer updates were found.

and what is the date of the last signature update?

 

[gjf]

Once again: asking the questions please be noted I never used this feature and have no idea where to find details about it.
So: where could I find the date of signatures?