Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Collecting logs for the User-Mode Hooking (UMH) module for a system crash issue

    • Updated:
    • 28 Dec 2016
    • Product/Version:
    • OfficeScan 11.0
    • Platform:
    • Windows 10
    • Windows 2008 32-Bit
    • Windows 2008 64-Bit
    • Windows 2012
    • Windows 7 32-Bit
    • Windows 7 64-Bit
    • Windows 8 32-Bit
    • Windows 8 64-Bit
    • Windows 8.1 32-Bit
    • Windows 8.1 64-Bit
Summary

This article introduces how to collect the UMH logs for a system crash issue caused by the UMH module.

UMH is an engine in OSCE that supports the enhanced ransomware solution. It is installed in the Common Client Solution Framework (CCSF) service as a module. It provides API events for other modules, such as Behavior Monitoring, Predictive Machine Learning, etc. Those modules will make decisions according to the provided API events from UMH.

Below is the installation path for UMH in OSCE:

<OfficeScan Agent Installation Path>\CCSF\MODULE\20019\

UMH has been involved since OfficeScan 11.0 Service Pack 1 Critical Patch 6054 (Ransomware CP) and OfficeScan XG.

Details
Public

To collect the UMH logs:

  1. Optional: For a Blue Screen of Death (BSoD) issue, you may need to log in using Safe Mode if the system BSoD happens before login.
    • If the user’s system is Windows 7 or an earlier version, use F8 in the system boot to enter System Safe Mode.
    • If the user’s system is Windows 8 or a later version, set the legacy boot mode before reproducing the BSoD.

    To log in using Safe Mode:

    1. Open a command line.
    2. Run the following prompt:

      bcdedit /set {default} bootmenupolicy legacy

      After the issue has been reproduced, roll back to standard boot mode.

    3. Run the following prompt:

      bcdedit /set {default} bootmenupolicy standard

  2. Enable kernel dump.

    Enable kernel dump

    Enable kernel dump

    For more information, refer to the following article: Enabling a Kernel-Mode Dump File.

  3. Set a restore point for %systemdrive% and impacted disk/partition.

    Set restore point

    Set restore point

    Set restore point

     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  4. Unload the OfficeScan agent, then update following registry keys to to reset UMH’s state before generating BSoD’s dump:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmumh
    • "BootStatus"=dword:ffffffff
  5. Reboot the computer to trigger the BSoD issue.
  6. Reboot the system again to get the dump file from %SystemRoot%\MEMORY.DMP. You may need to log in using Safe Mode.
  7. Get the UMH-related binary files:
    • <OSCE installation path>\CCSF\module\20019
    • %windir%\system32\tmumh
    • %windir%\syswow64\tmumh
    • %windir%\system32\drivers\tmumh.sys
  8. Get the UMH-related registry keys:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
    • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1115438
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.