The error appears on the agent machines when the main Apex One process ntrtscan.exe crashes.

This issue is related to the TmCCSF file being inconsistent with the current agent patch level. This can happen when the affected file was not properly upgraded during the agent patch installation pushed by the local server or update agent, due to a failed overwrite because the file may have been locked by some other processes.

Event Viewer Log

The System event viewer logs record the crash of ntrtscan.exe in relation to the issue at hand. Upon checking Services.msc, the ntrtscan is not running:

Log Name:      Application
Source:        Application Error
Event ID:      1000
Task Category: Application Crashing Events
Level:         Error
Keywords:      Classic
User:          N/A
Description:
Faulting application name: ntrtscan.exe, version: 14.0.0.2062, time stamp: 0x5e3934f0
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1770, time stamp: 0x59bf2ba6
Exception code: 0xe06d7363
Fault offset: 0x0000000000033c58
Faulting process id: 0x28a4
Faulting application start time: 0x01d5f2c7a9fc09e4
Faulting application path: C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Faulting package full name: 
Faulting package-relative application ID:

Upgrade Log

The upgrade log indicates that the the agent upgrade cannot modify the file, so it skips the said file and proceeds to the next:

[RenameFileForAccessViolation] ===> 
[RenameFileForAccessViolation] Check if 
        [C:\Program Files (x86)\Trend Micro\OfficeScan Client\CCSF\module\BES\TmBpIe64.dll] 
        is opening by other process.

[RenameLockPossibleFile] Create file handle 
        [C:\Program Files (x86)\Trend Micro\OfficeScan Client\CCSF\module\BES\TmBpIe64.dll] 
        with write success. Should not be the cause.

[RenameFileForAccessViolation] <=== 
[RenameFileForAccessViolation] ===> 
[RenameFileForAccessViolation] Check if 
        [C:\Program Files (x86)\Trend Micro\OfficeScan Client\CCSF\module\BES\IE32\TmBpIe32.dll] 
        is opening by other process.

[RenameLockPossibleFile] Create file handle 
        [C:\Program Files (x86)\Trend Micro\OfficeScan Client\CCSF\module\BES\IE32\TmBpIe32.dll] 
        with write success. Should not be the cause.

[RenameFileForAccessViolation] <=== 

To resolve the issue:

1. Verify if the Apex One Server is running the latest patches.

   You may check the latest patches available for the product in the Apex One Patch Download Center Portal.

2. Ensure that the agent's update privilege is set to "All Components".

   For more information, refer to this article.

3. Initiate the update from the agent side and confirm if the update is successful.
4. Verify if the following agent files have the same build as the ones on the server side:

   [C:\Program Files (x86)\Trend Micro\OfficeScan Client\CCSF\]libCCSF_ClientLibrary.dll 14.0.0.xxxx
   [C:\Program Files (x86)\Trend Micro\OfficeScan Client\] CCSF_X64.zip 14.0.0.xxxx

   • If the builds DO NOT match, it is possible to use Autopcc.exe on the agent side or reinstall the agent then verify if the issue persists.
   • If the builds DO match, collect CDT logs and contact Trend Micro Technical Support for further assistance.

• From the debug log, CCSF was not running due to a VC++ redistributable not being installed:

  [][Instreg.exe]CInstregApp::InstallCCSFService - Service name = TmCCSF, Disp = 
          Apex One Common Client Solution Framework, Path = 
          C:\Program Files\Trend Micro\OfficeScan Client\CCSF\TmCCSF.exe - 
          [d:\osce-common-main-int_1.0\src\client\instreg\instreg_instreg.cpp(890)]
  
  [][Instreg.exe]CInstregApp::InstallCCSFService - OpenSCManager fail, err = 1115 - 
          [d:\osce-common-main-int_1.0\src\client\instreg\instreg_instreg.cpp(896)]
  
  [][Instreg.exe]CInstregApp::InitInstance - Install VC++ redistributable and CCSF - 
          [d:\osce-common-main-int_1.0\src\client\instreg\instreg_instreg.cpp(791)]
  
  [][Instreg.exe]CInstregApp::DetectVcRedistributableEx - VC 2017 redistributable x86 detected result. 
          version=(14.13.26020) - [d:\osce-common-main-int_1.0\src\client\instreg\instreg_instreg.cpp(2283)]
  
  [][Instreg.exe]CInstregApp::DetectVcRedistributableEx - Need to install VC Redist check result = 0 - 
          [d:\osce-common-main-int_1.0\src\client\instreg\instreg_instreg.cpp(2296)]
  

• The debug log can also show the Microsoft Visual C++ 2017 x64 was detected, but is running an older version thus the setup was not able to continue:

  [Instreg.exe]CInstregApp::InstallCCSFService - Service name = TmCCSF, Disp = 
          Apex One Common Client Solution Framework, 
          Path = C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe - 
          [instreg_instreg.cpp(982)]
  
  [Instreg.exe]CInstregApp::InitInstance - CCSF service installation result = 
          [instreg_instreg.cpp(879)]
  
  [Instreg.exe]CInstregApp::InitInstance - Install VC++ redistributable and CCSF - 
          [instreg_instreg.cpp(882)]
  
  [Instreg.exe]CInstregApp::DetectVcRedistributableEx - VC 2017 redistributable x64 detected result. 
          version=(0.0.0) - [instreg_instreg.cpp(2338)]
  
  [Instreg.exe]CInstregApp::DetectVcRedistributableEx - Need to install VC Redist check result = 1 - 
          [instreg_instreg.cpp(2386)]
  
  [Instreg.exe]CInstregApp::InstallVcRedistributableEx - Remain installation performance key. - 
          [instreg_instreg.cpp(2583)]
  
  [Instreg.exe]CInstregApp::InstallVcRedistributableEx - VC++ redistributable: 
          "C:\Program Files (x86)\Trend Micro\Security Agent\vcredist_2017U3_x64.exe" /quiet /norestart - 
          [instreg_instreg.cpp(2598)]
  
  [Instreg.exe]LaunchProcessCmd - process exit code is 1603 - [instreg_instreg.cpp(2459)]
  
  [Instreg.exe]CInstregApp::InstallVcRedistributableEx - VC++ redistributable: 
          "C:\Program Files (x86)\Trend Micro\Security Agent\vcredist_2017U3_x86.exe" /quiet /norestart - 
          [instreg_instreg.cpp(2611)]
  
  [Instreg.exe]LaunchProcessCmd - process exit code is 1603 - [instreg_instreg.cpp(2459)]
  
  [Instreg.exe]CInstregApp::InitInstance - VC Runtime installation result = 1 - 
          [instreg_instreg.cpp(884)]
  
  

• From the application event logs, the Visual C++ application failed to install as a newer version is already installed:

  Application Event log:
  Windows Installer installed the product. Product Name: 
      Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.13.26020. 
      Product Version: 14.13.26020. 
      Product Language: 1033.Manufacturer: Microsoft Corporation. 
      Installation success or error status: 1603.
  
  Product: Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.13.26020 - 
      Installation failed.
  
  Product: Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.13.26020 - 
      A later version of Microsoft Visual C++ 2017 x64 Minimum Runtime - 
      14.13.26020 is already installed.
  

1. Check the following registry keys to determine which version is installed.
   • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\X64Version=
   • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\X86Version=
2. Install the Latest VC 14.27.29112 or higher fromMicrosoft Website:
   • Latest supported Visual C++ Redistributable downloads | Microsoft Docs
   • After installation, restart the agent machine and verify if the issue perists.
3. If the issue persists, kindly gather the set of logs below:
   • On the machine where the agent installation was recently attempted.  open Event Viewer and export and collect the Application and System logs
   • Export the OfcInstReg.log which can be found under the C:\Windows folder.