To collect the logs:
- On the Apex One client:
- Copy the ofcdebug.ini of the \Program Files (x86)\Trend Micro\Security Agent\Temp\LogServer\ folder (excluding the Log folder) to the root of C:.
- Edit the ofcdebug.ini file now located in the root of C::
- Change DebugLog=.\Log\ofcdebug.log to "DebugLog=.\ofcdebug.log".
- Change debugLevel_new=E to "debugLevel_new=D".
- Change ForceStopOtherLogserver=0 to "ForceStopOtherLogserver=1".
If larger logs are desired, you can edit the debugSplitSize line. Default is 10 MB before splitting and zipping the old file.
By default DebugMaxSplit=100, this limits the total number of split logs to 100 files.
- Save the file.
- Unload the agent.
- Open a command line. Run as administrator.
- Run the following prompt: net stop tmumh (Stop UMH driver).
- Download DebugView from the following link: DebugView v4.81.
- Open Dbgview.exe (Run as administrator), and check Capture Win32, Capture Global Win32, Caputer Kernel, Enable Verbose Kernel Output, Pass-Through, and Capture Events from the Caputer dropdown list.
- Reload the agent, and make sure that the tmccsf.exe, tmbmsrv.exe, ntrtscan.exe and tmlisten.exe processes are running. Also make sure that tmumh is running (sc query tmumh).
- Reproduce the problem.
- Collect the following logs:
- C:\CCSF_DebugLog.log
- C:\osceDB.log
- Driver log from Dbgview.exe
- Get the following UMH-related binary files:
- \CCSF\module\20019
- %windir%\system32\tmumh
- %windir%\syswow64\tmumh
- %windir%\system32\drivers\tmumh.sys
- Get the following UMH-related registry keys:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows