SharePoint issue with Trend Micro Antivirus after updating Trend Micro definition to pattern 12.941.00

After updating your Trend Micro definition to pattern 12.941.00 the following file in SharePoint will be quarantined because the antivirus Software incorrectly identifies that this files contains JS_NEMUCOD.SMAA15:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\template\layouts\1033\initstrings.js.
While rendering a SharePoint site or list you may receive a 304 or a server error in Application /
In ULS you will see a message similar to:
Cannot make a cache safe URL for "15/1033/initstrings.js", file not found. Please verify that the file exists under the layouts directory.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: Microsoft.SharePoint.SPException: Cannot make a cache safe URL for "15/1033/initstrings.js", file not found. Please verify that the file exists under the layouts directory.

Trend Micro has released a new pattern to correct this (pattern 943):  http://downloadcenter.trendmicro.com/index.php?clk=tab_pattern&clkval=35&regs=NABU&lang_loc=1
Customers should also ensure that they have the correct Antivirus Exclusions in place on their SharePoint servers as per https://support.microsoft.com/en-in/kb/952167. Depending on how the antivirus software is configured (quarantine or delete), it might also be required to replace the affected files if they were deleted.
In case that Trend Micro anti virus is used on client machines, the pattern on the client machines also has to be updated to ensure that the file is not quarantined when browing to a SharePoint site.
 
[Update December 7th, 2016] We have now an KB article for this issue as well: https://support.microsoft.com/en-us/kb/3211219

23 Comments


  1. Thanks Stefan!
    We have been fighting for an hour to find out the antivirus actually removed the initstrings.js file.
    Had to manually restore it from different environment.
    Your post should be a very good reminder what to check and how important is to set up antiVirus correctly.

    Reply

  2. Same for us. We had to restore the file from our daily server backups. This incident makes me to check our antivirus exclusions.

    Reply

  3. IMPORTANT – in case of deleted files. We had massive caching issues with the IIS.
    Only a deletion of all folders in: C:\inetpub\temp\IIS Temporary Compressed Files\ worked after we did an update of the AV-pattern.

    Reply

  4. Thanks a lot! You’ve made my day.

    Reply

  5. Thanks for putting this together Stefan!
    We had this issue too earlier today. Where some of the webparts were throwing below error message (in addition to what you already described).
    “ReferenceError: ‘Strings’ is undefinedTypeError: Unable to get property ‘RenderField’ of undefined or null referenceTypeError: Unable to get property ‘RenderField’ of undefined or null reference”

    Reply

    1. Hi
      I am also facing the similar issue can you please suggest on this.. or what action you have taken to overcome this error.

      Reply

      1. Hi Varun,
        ensure to install the latest Virus pattern from trend Micro and restore the deleted file.
        If it was quarantined just restore it from Trend Micro.
        If it was deleted you might have to restore it from your backup.
        Cheers,
        Stefan

        Reply

        1. Thanks stefan
          Just want to know why initstrings.js did not get deleted from app server, as we have trend micro in app server also.
          Have a good day,
          Varun

          Reply

          1. Maybe you had a correct exclusion list configured here?
            Or Trend Micro only deleted the file when it was read by SharePoint. The APP Server is not a WFE so users will not try to download it from this server.


  6. I was also totally surprised my SP stopped to work normally 🙁
    Thank you Stefan you are a god! 🙂

    Reply

  7. We experienced and fixed this one also yesterday. Glad to know the root cause is accountable.

    Reply

  8. Hi Stefan,
    Sites are working fine on the servers. But we still have a problem with the End Users. They still see the same error even if they clear the browser cache.
    I have already deleted folders from C:\inetpub\temp\IIS Temporary Compressed Files\ as mentioned by Andreas, however it didn’t help.
    The only option i found for them to fix it, is to go to IE, open the Developer Tool, click on Debugger, refresh the page. Then all starts to work normally. I have no idea what is the magic trick the IE Developer Debugger does…. Do You have any advice here?
    Regards

    Reply

  9. Hello Stefan!
    Many, many thanks!
    Situation exactly as written above. Me as a SP-user and not a SP-Administrator got an error message “ReferenceError: ‘Strings’ is undefined” (using IE11, Win7).
    1 download pattern 943 (link above)
    2 unzip icrc$oth
    3 copy file icrc$oth.945 into \TrendMicro\OfficeScan Client\
    4 done

    Reply

  10. Hi Stefan!
    As far as I can see the folder \15\template\layouts\ is not in the list of exclusions, is the recommendation changed from Microsoft to now also exclude the whole 15-folder?

    Reply

    1. Hi Marcus,
      the article recommends to exclude everything below this:
      Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions
      Cheers,
      Stefan

      Reply

  11. Thanks Stefan !
    Today your blog had saved our day.
    Just want to know why it did not deleted the file initstrings.js in app server, as we have trend micro in app server also.

    Reply

  12. I to was hit by false positive by Trend . I made mistake of shift delete ” C:\INETPUB\TEMP\IIS TEMPORARY COMPRESSED FILES\SHAREPOINT – 58000\$^_GZIP_C^\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB SERVER EXTENSIONS\15\TEMPLATE\LAYOUTS\1033\ ”
    Along with Trend deleting “C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\1033\ ”
    I do have a netback up I could restore from the file / folders from there. Any thoughts on best way to recover.

    Reply

  13. Stefan, thank you very much about this. For any Sharepoint admin out there, this is a confirmation of yet another super cool tool called ” ULS Viewer”. I have used this tool to detect what was going on first, after I have realized that that a particular file went missing from the server, my suspicion became a little clearer. In the process, I landed on this Stefan’s post, which confirmed my findings. Simply restored the file and voila. The farm is up and running again.

    Reply

  14. Thanks Stefan. We restored the file “initstrings.js” on the SharePoint 2013 environment but all the webparts are giving error- “ReferenceError: ‘Strings’ is undefinedTypeError: Unable to get property ‘RenderField’ of undefined or null referenceTypeError: Unable to get property ‘RenderField’ of undefined or null reference”.
    It is working on App Server but not on the WFEs. Could you please help?

    Reply

    1. Hi AB,
      ensure to clear all the caches (see other comments here). If you need further assistance please contact Microsoft Support.
      Cheers,
      Stefan

      Reply

    2. Hello,
      I had the same problem as you AB : I restored initstrings.js file from the C:\inetpub\temp\IIS Temporary Compressed Files\ but then I got many ““ReferenceError: ‘Strings’ is undefined” errors when trying to access libraries for example.
      In the same folder (C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\1033\), there is a file named “initstrings.debug.js”. Creating a copy of this fle and renaming it to “initstrings.js” seems to solve the problem.

      Reply

  15. Saved my day! Suddenly all sites returning blank page. Had to copy the file from other server and do an IISRESET to resolve the issue

    Reply

Leave a Reply to Marcus Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.