SharePoint issue with Trend Micro Antivirus after updating Trend Micro definition to pattern 12.941.00


After updating your Trend Micro definition to pattern 12.941.00 the following file in SharePoint will be quarantined because the antivirus Software incorrectly identifies that this files contains JS_NEMUCOD.SMAA15:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\template\layouts\1033\initstrings.js.

While rendering a SharePoint site or list you may receive a 304 or a server error in Application /

In ULS you will see a message similar to:

Cannot make a cache safe URL for "15/1033/initstrings.js", file not found. Please verify that the file exists under the layouts directory.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: Microsoft.SharePoint.SPException: Cannot make a cache safe URL for "15/1033/initstrings.js", file not found. Please verify that the file exists under the layouts directory.

Trend Micro has released a new pattern to correct this (pattern 943):  http://downloadcenter.trendmicro.com/index.php?clk=tab_pattern&clkval=35&regs=NABU&lang_loc=1

Customers should also ensure that they have the correct Antivirus Exclusions in place on their SharePoint servers as per https://support.microsoft.com/en-in/kb/952167. Depending on how the antivirus software is configured (quarantine or delete), it might also be required to replace the affected files if they were deleted.

In case that Trend Micro anti virus is used on client machines, the pattern on the client machines also has to be updated to ensure that the file is not quarantined when browing to a SharePoint site.

 

[Update December 7th, 2016] We have now an KB article for this issue as well: https://support.microsoft.com/en-us/kb/3211219

Comments (23)

  1. Kamil says:

    Thanks Stefan!

    We have been fighting for an hour to find out the antivirus actually removed the initstrings.js file.

    Had to manually restore it from different environment.

    Your post should be a very good reminder what to check and how important is to set up antiVirus correctly.

  2. Sven says:

    Same for us. We had to restore the file from our daily server backups. This incident makes me to check our antivirus exclusions.

  3. IMPORTANT – in case of deleted files. We had massive caching issues with the IIS.
    Only a deletion of all folders in: C:\inetpub\temp\IIS Temporary Compressed Files\ worked after we did an update of the AV-pattern.

  4. Thanks a lot! You’ve made my day.

  5. BlueSky2010 says:

    Thanks for putting this together Stefan!
    We had this issue too earlier today. Where some of the webparts were throwing below error message (in addition to what you already described).
    “ReferenceError: ‘Strings’ is undefinedTypeError: Unable to get property ‘RenderField’ of undefined or null referenceTypeError: Unable to get property ‘RenderField’ of undefined or null reference”

    1. varun jain says:

      Hi
      I am also facing the similar issue can you please suggest on this.. or what action you have taken to overcome this error.

      1. Hi Varun,
        ensure to install the latest Virus pattern from trend Micro and restore the deleted file.
        If it was quarantined just restore it from Trend Micro.
        If it was deleted you might have to restore it from your backup.
        Cheers,
        Stefan

        1. varun jain says:

          Thanks stefan
          Just want to know why initstrings.js did not get deleted from app server, as we have trend micro in app server also.

          Have a good day,
          Varun

          1. Maybe you had a correct exclusion list configured here?
            Or Trend Micro only deleted the file when it was read by SharePoint. The APP Server is not a WFE so users will not try to download it from this server.

  6. I was also totally surprised my SP stopped to work normally 🙁
    Thank you Stefan you are a god! 🙂

  7. michael.olb says:

    We experienced and fixed this one also yesterday. Glad to know the root cause is accountable.

  8. Kamil says:

    Hi Stefan,

    Sites are working fine on the servers. But we still have a problem with the End Users. They still see the same error even if they clear the browser cache.
    I have already deleted folders from C:\inetpub\temp\IIS Temporary Compressed Files\ as mentioned by Andreas, however it didn’t help.
    The only option i found for them to fix it, is to go to IE, open the Developer Tool, click on Debugger, refresh the page. Then all starts to work normally. I have no idea what is the magic trick the IE Developer Debugger does…. Do You have any advice here?

    Regards

  9. Oliver says:

    Hello Stefan!
    Many, many thanks!
    Situation exactly as written above. Me as a SP-user and not a SP-Administrator got an error message “ReferenceError: ‘Strings’ is undefined” (using IE11, Win7).
    1 download pattern 943 (link above)
    2 unzip icrc$oth
    3 copy file icrc$oth.945 into \TrendMicro\OfficeScan Client\
    4 done

  10. Marcus says:

    Hi Stefan!
    As far as I can see the folder \15\template\layouts\ is not in the list of exclusions, is the recommendation changed from Microsoft to now also exclude the whole 15-folder?

    1. Hi Marcus,
      the article recommends to exclude everything below this:
      Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions
      Cheers,
      Stefan

  11. varun jain says:

    Thanks Stefan !
    Today your blog had saved our day.
    Just want to know why it did not deleted the file initstrings.js in app server, as we have trend micro in app server also.

  12. cc says:

    I to was hit by false positive by Trend . I made mistake of shift delete ” C:\INETPUB\TEMP\IIS TEMPORARY COMPRESSED FILES\SHAREPOINT – 58000\$^_GZIP_C^\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB SERVER EXTENSIONS\15\TEMPLATE\LAYOUTS\1033\ ”
    Along with Trend deleting “C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\1033\ ”
    I do have a netback up I could restore from the file / folders from there. Any thoughts on best way to recover.

  13. a_rut says:

    Stefan, thank you very much about this. For any Sharepoint admin out there, this is a confirmation of yet another super cool tool called ” ULS Viewer”. I have used this tool to detect what was going on first, after I have realized that that a particular file went missing from the server, my suspicion became a little clearer. In the process, I landed on this Stefan’s post, which confirmed my findings. Simply restored the file and voila. The farm is up and running again.

  14. AB says:

    Thanks Stefan. We restored the file “initstrings.js” on the SharePoint 2013 environment but all the webparts are giving error- “ReferenceError: ‘Strings’ is undefinedTypeError: Unable to get property ‘RenderField’ of undefined or null referenceTypeError: Unable to get property ‘RenderField’ of undefined or null reference”.

    It is working on App Server but not on the WFEs. Could you please help?

    1. Hi AB,
      ensure to clear all the caches (see other comments here). If you need further assistance please contact Microsoft Support.
      Cheers,
      Stefan

    2. Seb_Lz says:

      Hello,
      I had the same problem as you AB : I restored initstrings.js file from the C:\inetpub\temp\IIS Temporary Compressed Files\ but then I got many ““ReferenceError: ‘Strings’ is undefined” errors when trying to access libraries for example.
      In the same folder (C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\1033\), there is a file named “initstrings.debug.js”. Creating a copy of this fle and renaming it to “initstrings.js” seems to solve the problem.

  15. CY says:

    Saved my day! Suddenly all sites returning blank page. Had to copy the file from other server and do an IISRESET to resolve the issue

Skip to main content