Trusteer/Rapport Cerberus conflicted with Avast

Viruses and worms
1

Email to Abbey/Santander Bank

I am extremely concerned about your use of the Rapport security programme.
It conflicted with my Avast anti-virus and left me unprotected.
Apparently; via Google; this has been ongoing for at least two years.
I am; to put it mildly; disappointed that you suggest the installation of this programme.

My email to Trusteer
Rapport Cerberus Worm
My Avast anti-virus programme would not update.
Eventually I found dated; after my last automatic Avast update; in my ‘Restore’ a download from Rapport.
This is a security programme downloaded from my bank some months ago, with which I had not previously had any problem.
Deleting Rapport, I managed to get updates from Avast.
Avast informed me that I was still contaminated by the Rapport Cerberus Trojan Worm.
This apparently hides in all sorts of places and it is extremely difficult to get rid of, so the computer is now with a specialist to ensure complete removal of any contaminants.

I do not remember if I downloaded the Rapport update or whether it was automatic.
Further, there was a file (%1 %2) downloaded on the same date which I know nothing about.
Apparently in excess of 13 million people Worldwide use the Trusteer/Rapport Bank Security system.
Why are you not warning that downloads from ‘Rapport’ are not in fact communications from Rapport?
Edmund

From Trusteer
This issue is known to us, and we are working on solving it with the vendor.
Please note that it is a false alarm regarding a legitimate part of Rapport and there is nothing to be concerned about.
Some security products falsely recognize Rapport as malicious because they have not added it yet to their list of legitimate programs.
We also wish to reassure you that Rapport is a genuine security product, as long as it was downloaded directly from your bank’s website.

My reply
Might I suggest that you answer the question.
The subject is the Rapport Cerberus Worm and nothing to do with,
‘Some security products falsely recognize Rapport as malicious because they have not added it yet to their list of legitimate programs.’
Rapport stopped Avast downloading updates and prevented my computer from contacting Avast.

Trusteer replied
This issue is known to us, and we are working on solving it with the vendor.
Please note that it is a false alarm regarding a legitimate part of Rapport and there is nothing to be concerned about.
Some security products falsely recognize Rapport as malicious because they have not added it yet to their list of legitimate programs.
We also wish to reassure you that Rapport is a genuine security product, as long as it was downloaded directly from your bank’s website.
AND
As explained previously by my colleague, Rapport Cerberus is a legitimate file which is a part of Rapport, and is actually not a worm or any other sort of hazard. Avast falsely alert regarding this file as a virus. We have contacted Avast regarding this matter and they will white-list it on their databases.
In the meantime you can be rest assured that your computer is not under any risk.

My final comment
I shall never download anything from Trusteer again as you have failed to explain the reason why it conflicted; leaving me unprotected; with my anti-virus programme and Trusteer has cost me time; in excess of three days; money and worry.

2

I have never seen any other report on the forum of rapport stopping avast updating.

avast does alert to each new version of rapport cerberus on my xp machine (not on w7 64 bit). I believe this is the rootkit scan. The filepath looks fine though, and a right click scan says clean, so I choose ignore. VT says the file is clean too.

rapport also blocks the avast behaviour shield injection of dll’s into browsers to monitor them. If you report it to trusteer they will whitelist avast, but the next program update re-introduces the problem, so I’ve stopped bothering to report it.

3

We are now at the end of July 2011 and this issue with Avast and the Rapport programme has still not been solved. I get messages from Avast on a regular basis telling me that the RapportCerebus and whatever the following numbers are. At first this alarmed me and I did contact Avast about this, but now I just click onto “Ignore”. But, when is this issue going to be sorted between Avast and Trusteer??

4

It’s been going on for quite a while.

I fear that perhaps given the sneaky methods both programs are trying to use, regular new builds of both, and the use of heuristic detection, the answer may be never.