After installing or upgrading the OSCE 11.0 client on client machines, the real-time scan service fails to initialize.
Driver files such as tmxpflt.sys and tmfilter.sys are missing. The following errors are seen in the ofcdebug.log file:
2015 09/28 13:39:35 [11d0 : 1760] (00) (D) [-REAL-][ntrtscan.exe][OSCEIOT::InitializeDeviceAndScanEngineWithSpecificPatternEx][ReduceVSAPIcall] return:0 - [cnttmnts_IOT.cpp(682)] 2015 09/28 13:39:35 [11d0 : 1760] (00) (F) [-REAL-][ntrtscan.exe][CiCrcVirusScanType::InitializeVSAPIWithOtherPattern] - Failed to init VSAPI engine, code: 0x00000000 - [cnttmnts_iCrcVirusScanMode.cpp(676)] 2015 09/28 13:39:35 [11d0 : 1760] (00) (D) [-REAL-][ntrtscan.exe][ReportStatusToSCMgr] SetServiceStatus, ServiceProtection is On, dwCurrentState = 4 - [cnttmnts_Service.cpp(4511)] 2015 09/28 13:39:35 [11d0 : 1760] (00) (F) [-REAL-][ntrtscan.exe]**!** IOT_InitializeDeviceAndScanEngineEx Failed, Error = 0. - [(1)] 2015 09/28 13:39:35 [11d0 : 1760] (00) (F) [-REAL-][ntrtscan.exe]**!** IOT_InitializeDeviceAndScanEngineEx Failed, Unhandle Error = 0. - [(1)]
Pccntmon.exe also fails to check the digital signature of tmlisten.exe and ntrtscan.exe. The debug log shows the following errors:
2015 09/28 13:39:03 [15c4 : 049c] (00) (D) [-IPC-][pccntmon.exe]CPipeServer::Recv - The connected pipe client PID [4556] - [pipe_Server.cpp(363)] 2015 09/28 13:39:03 [15c4 : 049c] (00) (D) [-IPC-][pccntmon.exe][IO][ProcReceive] Total received data size [429] bytes - [OIPCObj.cpp(583)] 2015 09/28 13:39:03 [15c4 : 049c] (00) (D) [-IPC-][pccntmon.exe]COIPCObj::GetProcessDigitalSignatureType - Failed to open process [4556], Windows error code = 5 - [OIPCObj.cpp(2034)] 2015 09/28 13:39:03 [15c4 : 049c] (00) (D) [-IPC-][pccntmon.exe]COIPCObj::IsLegitimateCmd - IPC hash size [357] - [OIPCObj.cpp(2094)] 2015 09/28 13:39:03 [1338 : 0e48] (00) (D) [-IPC-][pccntmon.exe]COIPCObj::GetProcessDigitalSignatureType - Failed to open process [4556], Windows error code = 5 - [OIPCObj.cpp(2034)] 2015 09/28 13:39:03 [1338 : 0e48] (00) (D) [-IPC-][pccntmon.exe]COIPCObj::IsLegitimateCmd - IPC hash size [357] - [OIPCObj.cpp(2094)]
The real-time scan service does not run correctly because some of the drivers are missing during the installation or upgrade. This can be caused by digital signature checks failing during the install or upgrade process. This occurs even after a fresh install has been tried on the problematic machines.
Starting with OfficeScan (OSCE) 10.6 Service Pack (SP) 3, Trend Micro has used Comodo certificates for digital signature verification of client components during installations and updates. If the server is unable to verify the signatures of the files on the client machines, then installations, upgrades, and updates will fail.
Allow the OSCE server and client machines to download and update their digital certificates for the installation/upgrade to succeed. Refer to the Certificate-related issues after OfficeScan (OSCE) 10.6 Service Pack (SP) 3 KB article for more information.
If the issue still persists after performing the steps in the KB article above, contact Trend Micro Technical Support to request for assistance in debugging the product.
