IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

App Control: Agent Not Starting With Trend Micro 11/XG Installed

App Control: Agent Not Starting With Trend Micro 11/XG Installed

Environment

  • App Control Agent: All Supported Versions

Symptoms

  • Devices that have both Trend Micro XG or 11 installed and the App Control Agent are unable to start the App Control Agent Service
  • App Control service does not start on a reboot
  • Attempting to restart the service manually results in an immediate 1053: Service Timeout

Cause

  • The cause of this is an injection of the Trend Micro DLLs into the Parity.exe process
  • Trend Micro kernel filter load prior to the App Control agent, a load of the DLL is injected into the process
  • This causes the Tamper Protection built into the filter driver to realize the process has been modified or changed and will stop the Parity.exe.

Resolution

  1. Add the items from the following document to the normal Trend Exclusion list: Anti-Virus Exclusion
  2. Navigate in Trend's console to Agents > Management
  3. In the agent tree select Settings > Behavior Monitoring Settings.
  4. Select the Exceptions tab and the items listed in the step 1

Additional Notes

Trend Micro may have additional addons with their own exclusion lists that may need these exclusions added to

Related Content


Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎12-10-2020
Views:
415
Contributors