This article introduces how to collect the UMH logs for a system hang issue caused by the UMH module.
UMH is an engine in OSCE that supports the enhanced ransomware solution. It is installed in the Common Client Solution Framework (CCSF) service as a module. It provides API events for other modules, such as Behavior Monitoring, Predictive Machine Learning, etc. Those modules will make decisions according to the provided API events from UMH.
Below is the installation path for UMH in OSCE:
<OfficeScan Agent Installation Path>\CCSF\MODULE\20019\
UMH has been involved since OSCE 11.0 Service Pack 1 Critical Patch 6054 (Ransomware CP) and OSCE XG.
To collect the UMH logs:
- Enable the kernel dump.
For more information, refer to the following article: Enabling a Kernel-Mode Dump File.
- Set a restore point for %systemdrive% and impacted disk/partition.
- Set the following registry keys to Forcing a System Crash from the Keyboard:
- For PS/2 keyboards, enable the keyboard-initiated crash in the registry. In the registry keyHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters, create a value named CrashOnCtrlScroll, and set it equal to a REG_DWORD value of 0x01.
- For USB keyboards, enable the keyboard-initiated crash in the registry. In the registry keyHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters, create a value named CrashOnCtrlScroll, and set it equal to a REG_DWORD value of 0x01.
- Restart the system for the settings to take effect.
- After the system has restarted, the system hang problem should have been reproduced.
- After the problem reproduced, hold down the rightmost CTRL key then press the SCROLL LOCK key twice. A crash dump file is written at this point.
- Reboot the system again to get the dump file from %SystemRoot%\MEMORY.DMP.
- Get the UMH-related binary files:
- <OSCE installation path>\CCSF\module\20019
- %windir%\system32\tmumh
- %windir%\syswow64\tmumh
- %windir%\system32\drivers\tmumh.sys
- Get the UMH-related registry keys:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
