App Control: Agent Not Starting With Trend Micro 11/XG Installed

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Devices that have both Trend Micro XG or 11 installed and the App Control Agent are unable to start the App Control Agent Service
• App Control service does not start on a reboot
• Attempting to restart the service manually results in an immediate 1053: Service Timeout

Environment

• App Control Agent: All Supported Versions

Cause

• The cause of this is an injection of the Trend Micro DLLs into the Parity.exe process
• Trend Micro kernel filter load prior to the App Control agent, a load of the DLL is injected into the process
• This causes the Tamper Protection built into the filter driver to realize the process has been modified or changed and will stop the Parity.exe.

Resolution

1. Add the items from the following document to the normal Trend Exclusion list: Anti-Virus Exclusion
2. Navigate in Trend's console to Agents > Management
3. In the agent tree select Settings > Behavior Monitoring Settings.
4. Select the Exceptions tab and the items listed in the step 1

Additional Information

Trend Micro may have additional addons with their own exclusion lists that may need these exclusions added to