Anti-Virus scanners and Dameware software

10/9/2018 10:32 AM

1/17/2025 10:43 PM

Some anti-virus scanners report that one or more of the many remote administration tools are infected with a "remote admin" virus. None of the Dameware software products contain viruses, but because remote administration tools have been used by viruses, occasionally they trigger virus notifications.

Dameware files such as DWRCS.EXE, DWRCST.EXE, and DameWare.LogAdjuster.exe are known to trigger AV alert and must be excluded from the customer's AV deployment to avoid getting flagged and inconvenienced.

Dameware Remote Support & Mini Remote Control

File signature not verified

The Dameware files that are most commonly flagged incorrectly are the Mini Remote Control (MRC) Client Agent Service (DWRCS.EXE) as well as the associated System Tray icon (DWRCST.EXE).

• A valid set of credentials (UserID & Password) with local Administrator rights on the remote machine is necessary.
• "File & Printer Sharing" must be enabled on the remote machine.
• The Admin$ share must be available on the remote machine.
•  All the necessary File & Printer Sharing ports (UDP 137, UDP 138, TCP 139, & TCP 445) must be open on all routers/firewalls between the local and remote machines.
• These same ports must also be open on any firewall software on the remote machine (i.e. Windows Firewall, ZoneAlarm, Black Ice, etc.).

the DameWare Development installation folder to the System32 folder on the remote machine. 
**For 64-bit Operating Systems, copy all these files to the SYSWOW64 folder instead of System32:

• DWRCS.EXE
• DWRCS.INI
• DWRCK.DLL
• DWRCSET.DLL
• DWRCST.EXE
• DWRCSh32.DLX  (v6.7 and higher)
• DWRCSh64.DLX  (v6.7 and higher, only for 64-bit Operating Systems)
• DWRCShell.DLX (v6.6 and below)
• DWRCShell64.DLX (all versions between 5.1.1.8 and 6.6.x, and only required for 64-bit Operating Systems)