Summary
The Tmumh.sys under C:\Windows\System32\drivers on the OSCE client is not updated. If you uninstall/reinstall the OSCE client, then it gets the correct Tmumh.sys file version.
This issue may be caused by outdated packages CCSF_WIN32 and CCSF_X64 on the OSCE server. The packages are located under the following paths inside the archive \CCSF\module\20019\UMH\Helper:
- PCCSRV\Pccnt\Common\CCSF_WIN32.zip
- PCCSRV\Pccnt\Win64\X64\CCSF_X64.zip
The version can be checked in the properties after extraction.
Details
To resolve the issue:
- Take a snapshot first or back up the important files of your OSCE server.
For more information, refer to the following KB article: Files to back up before upgrading, migrating, or uninstalling the OfficeScan (OSCE) server.
- Copy CCSF_WIN32.zip and CCSF_X64.zip from the paths above to \Trend Micro\OfficeScan\PCCSRV\Admin\Utility\Touch.
If you noticed that the packages on the OSCE server include an old Tmumh.sys version, please contact Trend Micro Technical Support.
- Open a command prompt and type TmTouch.exe CCSF_WIN32.zip. It will change the timestamp of the package. It is possible that the timestamp cannot be modified if the command is run from a folder in Program Files. If that is the case, copy the TmTouch from Admin\Utility\Touch and the two packages from C:\Temp and run the same commands.
- Type TmTouch.exe CCSF_X64.zip.
- Copy both files to their original directory:
- PCCSRV\Pccnt\Common\CCSF_WIN32.zip
- PCCSRV\Pccnt\Win64\X64\CCSF_X64.zip
- Wait until the hot fix has been packed.
- Perform Update Now on the agent.
- Verify that the agent will update the tmumh.sys to the right version under C:\Windows\System32\drivers.
