MSE Anti-Virus False Positive

Starting Thursday Sept 3rd, Microsoft Security Essentials (MSE) started reporting a false positive on one of the Atrex DLL files for Atrex 13, 14, and 15.  The file being incorrectly reported as being a trojan virus is ExtModule.dll.   
 
As part of the detection, MSE is placing this file into quarantine which in turn causes a variety of errors in Atrex including ElevateDB error 202, 401, and 601. 
 
To restore proper Atrex operation and prevent the dlls from being removed again, you will need to follow the instructions below on EVERY workstation that has MSE and/or Atrex installed:
 
  1. Close Atrex if it is open.
  2. Open your Microsoft Security Essentials.
  3. Click on the Settings tab. 
  4. Click on the "Excluded files and locations" entry in the left hand window.
  5. Browse and add the following locations:
    a) The folder in which Atrex is installed.
    b) If you are using a direct connection to the data, you will need to add the central location folder if it is on a different computer.
  6. Click the Save Changes button.
  7. Click on the History tab.
  8. In the Detected Item area, look for any entry that says "Trojan:Win32/Dorv.B!rfn".  For each entry that you see that matches this description, look at the detected item detail information and make sure that the file is ExtModule.exe.  If it is for ExtModule.exe, click the restore button.
  9. Restart Atrex.
If you are unable to restore the files from the MSE quarantine, you will need to reinstall Atrex to replace the deleted files.   If you are a registered user of Atrex 15, you can download Atrex 15 directly from the downloads page of our web site.   If you are a registered user of Atrex 13 or 14, you MUST download Atrex from the Millennium Software client center to ensure that you install the version of Atrex that you are licensed for.
 

If you are using a client/server configuration, you will also need do the following on the server computer:
 
  1. Open your Microsoft Security Essentials.
  2. Click on the Settings tab. 
  3. Click on the "Excluded files and locations" entry in the left hand window.
  4. Browse and add the folder in which the Atrex Database Server is installed.
  5. Click the Save Changes button.
  6. Click on the History tab.
  7. In the Detected Item area, look for any entry that says "Trojan:Win32/Dorv.B!rfn".  For each entry that you see that matches this description, look at the detected item detail information and make sure that the file is ExtModule.exe.  If it is for ExtModule.exe, click the restore button.
If you are unable to restore the files from the MSE quarantine, you will need to reinstall the Atrex Database Server to replace the deleted files.   If you are a registered user of Atrex 15, you can download the Atrex Database Server directly from the downloads page of our web site.   If you are a registered user of Atrex 13 or 14, you MUST download the Atrex Database Server from the Millennium Software client center to ensure that you install the version of the server that is appropriate for the version of Atrex that you are running.
 
 
Please contact our support department if you need assistance.  Please note that standard support charges may apply if you are outside of the support included with your Atrex purchase.
Published: 9/3/2015 at 6:00 PM

Share this article