When you experience issues with the WFBS Security Agent, try unloading first the Agent:
- Right-click the Trend Micro system-tray icon on the taskbar.
- Exit Worry-Free Business Security.
If the issue persists, uninstall the Agent and reboot the computer. If you still experience the issue after removing the Agent and rebooting your machine, then the Security Agent is not the cause of the issue.
If unloading the Agent does not resolve the issue, but uninstalling it does, send a report to Trend Micro Technical Support.
In cases where the issue was gone after unloading the Agent, perform the tests outlined below to isolate the module that is causing the issue:
Add a different group that will be used for the feature isolation.
- On the Management Console, go to the Devices tab.
- On the left pane, click on Add Group.
- Specify the following:
- Group Type: Select the type of group either desktops or servers
- Name: Specify a name for the test group
- Settings: Import settings from the group that was affected by the issue
- click Save.
- On the right pane, select machine/s that can be used for isolation. Then drag them over to the new group.
Click the image to enlarge.
Once isolation has been done on the single endpoint, you can double-check by expanding the change to other affected machines.
You will need to turn each service off one by one until the issue is gone. Note the setting and then turn the suspicious service back on and continue to turn the other services off to see if the issue persists to confirm. As components can interact with each other, it is possible that disabling different services could potentially resolve the issue. If any other service also corrects the issue, please note those as well.
After changing each service from the web console, do a manual update on client. Test if the issue persists. It can take up to 10 minutes for the agent to receive the updated policy.
Test Group > Configure Policy > Antivirus/Anti-spyware > toggle off Enable real-time Antivirus/Anti-spyware > click Save
Click the image to enlarge.
To verify if the Real-Time Scan is disabled, hover your mouse on the small green icon of the agent console:
Click the image to enlarge.
If this action solves the issue, please enable this setting and do actions 2, 3, 8, 10 to confirm the problematic feature further.
Test Group > Configure Policy > Behavior Monitoring > toggle off "Enable Behavior Monitoring"> click Save.
Click the image to enlarge.
To verify if the Behavior Monitoring is disabled, hover your mouse on the small green icon of the agent console:
Click the image to enlarge.
If this action solves the issue, please enable this setting and do actions 2, 7, 8, 9 to confirm the problematic feature further.
Test Group > Configure Policy > Web Reputation > toggle off Enable Web Reputation > click Save.
Click the image to enlarge.
To verify if the Web Reputation is disabled, hover your mouse on the small green icon of the agent console:
Click the image to enlarge.
If this action solves the issue, please enable this setting and do actions 5, 11 to confirm the problematic feature further.
Test Group > Configure Policy > Firewall > toggle off Enable Firewall > click Save.
Click the image to enlarge.
When Advanced mode is enabled, you may try to lower the security level first or disable "Enable Intrusion Detection System" to further isolate the cause of the issue.
Click the image to enlarge.
To verify if the Firewall is disabled, hover your mouse on the small green icon of the agent console:
Click the image to enlarge.
- Access Document Control (ADC)
Test Group > Configure Policy > Behavior Monitoring > Untick "Enable document protection against unauthorized encryption or modification"> click Save - Damage Recover Engine (DRE)
Test Group > Configure Policy > Behavior Monitoring > Untick "Auto backup files changed by suspicious programs"> click Save - Software Restricted Policy (SRP)
Test Group > Configure Policy > Behavior Monitoring > Untick "Enable blocking of processes commonly associated with ransomware"> click Save
Click the image to enlarge.
To verify if the sub-modules are disabled, you may go to the following registry hive:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\AEGIS] EnableAdc=0 EnableDre=0 EnableSRP=0
Test Group > Configure Policy > Behavior Monitoring > Untick Enable program inspection to detect and block compromised executable files > click Save.
Click the image to enlarge.
Verify if the TMUMH service has stopped by running the command "sc query tmuh" from an admin command line. If the service is still running, stop the service by running "sc stop tmumh". If the process is actively hooked, this may fail and a system restart will be required.
Test Group > Configure Policy > Behavior Monitoring > untick Prompt users before executing newly encountered programs downloaded through HTTP or email applications > click Save.
Click the image to enlarge.
To verify if the Meerkat is disabled, you may go to the following registry hive:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\AEGIS] EnableMeerkatDetection=0
Test Group > Configure Policy > Antivirus/Anti-spyware > Advanced Settings > untick Quarantine malware variants detected in memory > click Save.
Click the image to enlarge.
To verify if the Ravage Scan is disabled, you may go to the following registry hive:
[HKEY_LOCAL_MACHINE\Software\Wow6432node\Trend Micro\PC-cillinNTCorp\CurrentVersion\RealTimeScan Configuration] RavageScanMemory=0
Test Group > Configure Policy > Web Reputation > Browser Exploit Prevention > untick Block pages containing malicious script > click Save.
Click the image to enlarge.
To verify if the BEP is disabled, you may go to the following registry hive:
[HKEY_LOCAL_MACHINE\Software\WOW6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\URL Filtering] EnableBES=0