[0x7FFAD4C870E3] ANOMALY: use of REX.w is meaningless (default operand size is 64)
when calling pretty much any network related command in a cmd-shell. This is the case for both normal and elevated shells.
The symptom went away when disabling TrendMicro OfficeScan on my machine.
It probably came with the latest patch from TrendMicro to provide compatibility with Win10 anniversary edition:
Apart from that, there are no negative effects on my system so far.
if you disable
ReplyDelete"Enable program inspection to detect and block compromised executable files (Server platforms excluded"
it wil go away
How to disable this?
DeleteRelated, as a work-around you can stop the error from occurring on a specific command if you add it to the Exception List of Behaviour Monitoring (Settings > Protection > Behaviour Monitoring).
DeleteThe ANOMALY error was breaking one of my scripts that relied on Ping output, so I added PING.EXE to the Exception List, allowing my script to function correctly.
OfficeScan Web Console->Agents->Agent Management->Settings->Behavior Monitoring Settings, untick "Enable program inspection to detect and block compromised executable files (Server platforms excluded)"
DeleteThen Apply to All Agents. Enable it back once OfficeScan release new patch to fix this patch problem.
Contact Trend suport for latest hotfix 6178 it have resulved it on my system
ReplyDeleteI contacted their support and they promised to send the patch. - Thank you!
Delete