This article introduces how to collect the UMH service and driver logs if required.
UMH is an engine in OSCE that supports the enhanced ransomware solution. It is installed in the Common Client Solution Framework (CCSF) service as a module. It provides API events for other modules, such as Behavior Monitoring, Predictive Machine Learning, etc. Those modules will make decisions according to the provided API events from UMH.
Below is the installation path for UMH in OSCE:
<OfficeScan Agent Installation Path>\CCSF\MODULE\20019\
UMH has been involved since OfficeScan 11.0 Service Pack 1 Critical Patch 6054 (Ransomware CP) and OfficeScan XG.
To collect the logs:
- Copy\PCCSRV\Private\LogServer\ofcdebugEx.ini from the OSCE server to C:\ in the OSCE agent.
- Rename ofcdebugEx.ini to ofcdebug.ini.
- Unload the OSCE agent.
- Open a command line. Run as administrator.
- Run the following prompt: net stop tmumh (Stop UMH driver).
- Download DebugView from the following link: DebugView v4.81.
- Open Dbgview.exe (Run as administrator), and check Capture Win32, Capture Global Win32, Caputer Kernel, Enable Verbose Kernel Output, Pass-Through, and Capture Events from the Caputer dropdown list.
- Reload the OfficeScan Agent, and make sure that the tmccsf.exe, tmbmsrv.exe, ntrtscan.exe and tmlisten.exe processes are running. Also make sure that tmumh is running (sc query tmumh).
- Reproduce the problem.
- Collect the following logs:
- Driver log from Dbgview.exe
- Get the following UMH-related binary files:
- Get the following UMH-related registry keys:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows