Windows – OfficeScan RealTime Scan randomly stops

anti-viruswindows

I'm having an issue with a couple of computers where the RealTime scan for trendMicro 8 just stops with no user intervention. It is random, they might not see it for days then it will just turn off. In the logs I'm seeing the services are sent a stop command, sometimes from the user, other times with one of the administrator accounts. There is two services, Listener and the RealTime Scan, both are sent a stop, not a crash but the Listener is started right up by the SYSTEM after shutting down. They are not dependent on each other, RealTime Scan has no dependancies, Listener depends on Network Connections and WMI. I'm not seeing anything particularly unusual here either in the logs or the running processes.

Sequence:

Stop is sent to Listener Service, 
Stop is sent to RealTime Scan Service, 
Start command sent by SYSTEM to Listener Service.

This all happens within 2-3 minutes of windows starting.
All computers are running Windows XP Service Pack 3.
Both services are set to start Automatically and they log no other issues.

Event Type: Information
Event Source:   Service Control Manager
Event Category: None
Event ID:   7035
Date:       10/13/2009
Time:       7:41:14 AM
User:       DOMAIN\administrator (Sometimes this is the users name)
Computer:   RNDCOMPNAMEHERE
Description:
The OfficeScanNT RealTime Scan service was successfully sent a stop control.

I'm at a bit of loss as to what else to look at or where to look for further clues as to the source. Searching online nets a bit fat 0 results for this particular problem.

Best Answer

Okay, after finally getting a hold of a trendMicro rep it would appear this is actually an application bug and not a network or configuration issue. Our network vendor who is supposed to be responsible for these systems has not updated or let us know about a service pack for TrendMicro 8. Pushing the issue through with my organizations VP and hopefully this should now be a solved problem once that is in place.

Related Solutions

Windows – Useful Command-line Commands on Windows

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

Screenshot of running getmac from a Windows commandline window.

windows – Granting Service Permissions to Users on Non-Domain Servers

There doesn't appear to be a GUI-based way of doing this unless you're joined to a domain - at least not one I could find anywhere - so I did a bit more digging and I've found an answer that works for our situation.

I didn't understand what the string representation meant in the knowledge base article, but doing a bit of digging led me to discover that it's SDDL syntax. Further digging led me to this article by Alun Jones which explains how to get the security descriptor for a service and what each bit means. MS KB914392 has more details.

To append to the service's existing security descriptor, use sc sdshow "Service Name" to get the existing descriptor. If this is a plain old .NET Windows Service - as is the case with ours - the security descriptor should look something like this:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOC
RRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA
;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

We needed to grant permissions RP (to start the service), WP (to stop the service), DT (to pause/continue the service) and LO (to query the service's current status). This could be done by adding our service account to the Power Users group, but I only want to grant individual access to the account under which the maintenance service runs.

Using runas to open a command prompt under the service account, I ran whoami /all which gave me the SID of the service account, and then constructed the additional SDDL below:

(A;;RPWPDTLO;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx)

This then gets added to the D: section of the SDDL string above:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOC
RRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;RPWP
DTLO;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx)S:(AU;FA;CCDCLCSWRPWPDTLOC
RSDRCWDWO;;;WD)

This is then applied to the service using the sc sdset command (before the S: text):

sc sdset "Service Name" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;
CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU
)(A;;RPWPDTLO;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx)S:(AU;FA;CCDCLCSW
RPWPDTLOCRSDRCWDWO;;;WD)

If all goes according to plan, the service can then be started, stopped, paused and have it's status queried by the user defined by the SID above.

Best Answer

Related Solutions

Windows – Useful Command-line Commands on Windows

windows – Granting Service Permissions to Users on Non-Domain Servers

Related Topic