To collect the logs:

1. On the Apex One client:
   1. Copy the ofcdebug.ini of the \Program Files (x86)\Trend Micro\Security Agent\Temp\LogServer\ folder (excluding the Log folder) to the root of C:.
   2. Edit the ofcdebug.ini file now located in the root of C::
      1. Change DebugLog=.\Log\ofcdebug.log to "DebugLog=.\ofcdebug.log".
      2. Change debugLevel_new=E to "debugLevel_new=D".
      3. Change ForceStopOtherLogserver=0 to "ForceStopOtherLogserver=1".

         If larger logs are desired, you can edit the debugSplitSize line. Default is 10 MB before splitting and zipping the old file.

         By default DebugMaxSplit=100, this limits the total number of split logs to 100 files.

      4. Save the file.
2. Unload the agent.
3. Open a command line. Run as administrator.
4. Run the following prompt: net stop tmumh (Stop UMH driver).
5. Download DebugView from the following link: DebugView v4.81.
6. Open Dbgview.exe (Run as administrator), and check Capture Win32, Capture Global Win32, Caputer Kernel, Enable Verbose Kernel Output, Pass-Through, and Capture Events from the Caputer dropdown list.

   

7. Reload the agent, and make sure that the tmccsf.exe, tmbmsrv.exe, ntrtscan.exe and tmlisten.exe processes are running. Also make sure that tmumh is running (sc query tmumh).
8. Reproduce the problem.
9. Collect the following logs:
   • C:\CCSF_DebugLog.log
   • C:\osceDB.log
   • Driver log from Dbgview.exe

   

10. Get the following UMH-related binary files:
    • \CCSF\module\20019
    • %windir%\system32\tmumh
    • %windir%\syswow64\tmumh
    • %windir%\system32\drivers\tmumh.sys
11. Get the following UMH-related registry keys:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
    • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows