I'm having an issue with a couple of computers where the RealTime scan for trendMicro 8 just stops with no user intervention. It is random, they might not see it for days then it will just turn off. In the logs I'm seeing the services are sent a stop command, sometimes from the user, other times with one of the administrator accounts. There is two services, Listener and the RealTime Scan, both are sent a stop, not a crash but the Listener is started right up by the SYSTEM after shutting down. They are not dependent on each other, RealTime Scan has no dependancies, Listener depends on Network Connections and WMI. I'm not seeing anything particularly unusual here either in the logs or the running processes.
Stop is sent to Listener Service, Stop is sent to RealTime Scan Service, Start command sent by SYSTEM to Listener Service.
This all happens within 2-3 minutes of windows starting. All computers are running Windows XP Service Pack 3. Both services are set to start Automatically and they log no other issues.
Event Type: Information Event Source: Service Control Manager Event Category: None Event ID: 7035 Date: 10/13/2009 Time: 7:41:14 AM User: DOMAIN\administrator (Sometimes this is the users name) Computer: RNDCOMPNAMEHERE Description: The OfficeScanNT RealTime Scan service was successfully sent a stop control.
I'm at a bit of loss as to what else to look at or where to look for further clues as to the source. Searching online nets a bit fat 0 results for this particular problem.