Environment
- Cb Protection: All Versions
- Trend Micro cloud-based “Worry-Free Business Security Services” version 6.1.1280*
- Trend Micro "Office Scan" version 12.0.1556*
* The Trend Micro we know of where the issue started is on the above versions and newer
Symptoms
- Customers who have Cb Protection and certain versions of Trend Micro products may experience hangs on shutdown or reboot.
Cause
During an endpoint’s system shutdown, a Trend Micro kernel module acquires exclusive system lock (PushLock) that is synchronizing access to a process’ virtual memory and does not release it. This results in other processing in the kernel that requires the lock to pause until the lock is released. Multiple threads in the stack result in a Wait state including the Cb Protection driver when the system is attempting a shutdown. Because the lock is never released, the system cannot continue shutting down and hangs. We recommend replacing the files listed in the Resolution section below with the Trend Micro version prior to the ones exhibiting the behavior.
Resolution
Trend Micro issued the following Hotfix:
OfficeScan Server, Version: XG Service Pack 1
Build: 5122
Please contact Trend Micro to request the Hotfix.
Additional Notes
Details on Trend Micro versions
From the memory dump file, the following timestamp is seen for the version of TMEvtMgr and TMPrefilt drivers that are problematic and exhibiting this behavior:
0: kd> lmvm TmEvtMgr start end module name fffff801`05b20000 fffff801`05b38000 tmevtmgr (deferred) Image path: \SystemRoot\system32\DRIVERS\tmevtmgr.sys Image name: tmevtmgr.sys Timestamp: Tue Sep 26 05:55:10 2017 (59CA23FE) CheckSum: 000205FC ImageSize: 00018000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 0: kd> lmvm TmPreFlt start end module name fffff804`d81a0000 fffff804`d81b1000 TmPreFlt (deferred) Image path: \??\C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys Image name: TmPreFlt.sys Timestamp: Fri Oct 20 01:43:39 2017 (59E98D0B) CheckSum: 000191CC ImageSize: 00011000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 |