[CaseDiagnosticTool]
DLL_ExInterface=1
SelfVersion=1


[Common]
ProductName=Trend Micro OfficeScan Agent
MaxVersion=12.00
MinVersion=11.95
ProductVersion=$(32:HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\ProgramVer)
EngineVersion=$(32:HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\EngineZipVer)
InstallDateTime=$(32:HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\InstDate) $(32:HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\InstTime)
Is64bitApp=1
EnableFirewallDriverLog=0

[Category1]
ProblemType=Basic Information
Events=1,19

[Category2]
ProblemType=Installation/Uninstallation Issue
Events=4,17

[Category3]
ProblemType=Connectivity Issue
Events=12,24

[Category4]
ProblemType=Scan Related Issue
Events=2,15

[Category5]
ProblemType=Behavior Monitor Issue
Events=14

[Category6]
ProblemType=Enterprise Firewall Issue
Events=6

[Category7]
ProblemType=Update/Deployment Issue
Events=4,5

[Category8]
ProblemType=Web Reputation Issue
Events=13,22

[Category9]
ProblemType=Crash/BSoD
Events=3

[Category10]
ProblemType=Compatibility
Events=16

[Category11]
ProblemType=Outbreak Prevention
Events=7

[Category12]
ProblemType=POP3 Scan Related
Events=8,13

[Category13]
ProblemType=Tools
Events=9,10,11

[Category14]
ProblemType=Data Loss Prevention <font color=ff0000>(Warning! Logs collected may contain sensitive data.)</font>
Events=18

[Category15]
ProblemType=C&C Callback Information
Events=22

[Category16]
ProblemType=Sample Submission
Events=23

[Event1]
EventName=Collect OfficeScan Agent basic debug information
EventFile=$(DebugLog1);$(Log1);$(Log37);$(Log46);$(Log53);$(Log70);$(Log74);$(Log81);$(Log21);$(Log91);$(Log94);$(Log98);$(Log105);$(Log106);$(Log107);$(Log108);$(Log109);$(Log110);$(Log111)
RegKey=HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\;HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\;HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AEGIS\;HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC\;HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Osprey\;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL;$(SecureProtocol_Reg1);$(SecureProtocol_Reg2);$(SecureProtocol_Reg3);$(SecureProtocol_Reg4)
ModuleName=OSCEclient

[Event2]
EventName=Problems with Real-time/Manual/Scheduled scanning (e.g. program unresponsive during scanning, unable to detect virus, performance issues, etc.)
EventFile=$(DebugLog2);$(Log30);$(Log31);$(Log80)
ModuleName=TmFilter
RegKey=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmcomm;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmactmon;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmevtmgr;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TmPreFilter;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TmFilter

[Event3]
EventName=Problems with General Protection Failure
EventFile=$(Log2);$(Log3);$(Log5);$(Log6)
ModuleName=OSCEclient

[Event4]
EventName=Problems with hotfix update
EventFile=$(Log21);$(Log99);$(Log71)

[Event5]
EventName=ActiveUpdate - pattern, engine, and program update failure
EventFile=$(Log7)
ModuleName=AU

[Event6]
EventName=Collect firewall policy
EventFile=$(Log22);$(Log26);$(Log27);$(Log29);$(Log32);$(Log33);$(Log34);$(Log39);$(Log40);$(Log41);$(Log42);$(Log43);$(Log44);$(PFW_DUMP)
ModuleName=PFW;AEGIS

[Event7]
EventName=Problems with outbreak prevention policy
EventFile=$(Log10);$(Log11);$(Log12)
ModuleName=OSCEclient

[Event8]
EventName=Problems with POP3 mail scan
EventFile=$(Log13);$(Log14);$(Log15);$(Log28)
ModuleName=WRS

[Event9]
EventName=Problems with Microsoft Outlook mail scan
EventFile=$(Log16);$(Log17);$(Log18)

[Event10]
EventName=Problems with wireless protection
EventFile=$(DebugLog3);$(Log19)
ModuleName=WPM

[Event11]
EventName=Collect SecuRemote debug information
EventFile=$(Log20)

[Event12]
EventName=Communication problems
EventFile=$(Log23)

[Event13]
EventName=Problems with Web Reputation
EventFile=$(Log24);$(Log25);$(Log28);$(Log50);$(Log51);$(Log52);$(Log72);$(Log64);$(Log65);$(Log66);$(Log74);$(Log75);$(Log76);$(Log79);$(Log87);$(Log98)
ModuleName=WRS
RegKey=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TmLwf;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmWfp

[Event14]
EventName=Collect AEGIS debug information
EventFile=$(Log33);$(Log34);$(Log45);$(Log78);$(Log82);$(Log83);$(Log74);$(Log84);$(Log85);$(Log86);$(Log87);$(Log90);$(Log98);$(Log103);$(Log104)
ModuleName=AEGIS
RegKey=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmcomm;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmactmon;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmevtmgr;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmumh

[Event15]
EventName=Problems with Smart Scan agent
EventFile=$(Log35);$(Log36);$(Log38);$(Log47);$(Log48);$(Log77);$(Log92);$(Log93)
ModuleName=FRS

[Event16]
EventName=Compatibility
EventFile=$(DebugLog1);$(DebugLog2)
Module=TmFilter;OSCEclient

[Event17]
EventName=MSI/EXE installation
EventFile=$(Log1);$(Log37);$(Log100);$(Log101);$(Log102)

[Event18]
EventName=Problems with Data Loss Prevention
EventFile=$(Log49);$(Log54);$(Log55);$(Log56);$(Log57);$(Log58);$(Log59);$(Log60);$(Log61);$(Log62);$(Log71)
ModuleName=DLP

[Event19]
EventName=Collect system services and drivers information
RegKey=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\

[Event20]
EventName=Collect debug logs by Toolbox
EventFile=$(DebugLog1);$(Log1);$(Log2);$(Log5);$(Log6);$(Log7);$(Log10);$(Log11);$(Log12);$(Log16);$(Log17);$(Log18);$(Log21);$(Log23);$(Log24);$(Log30);$(Log31);$(Log32);$(Log33);$(Log34);$(Log35);$(Log37);$(Log38);$(Log39);$(Log42);$(Log43);$(Log44);$(Log45);$(Log46);$(Log47);$(Log48);$(Log50);$(Log51);$(Log52);$(Log64);$(Log65);$(Log66);$(Log67);$(Log68);$(Log69);$(Log70);$(Log71)
ModuleName=OSCEclient
RestartService=0

[Event21]
EventName=Collect debug logs by Toolbox
EventFile=$(DebugLog1);$(Log1);$(Log2);$(Log5);$(Log6);$(Log7);$(Log10);$(Log11);$(Log12);$(Log16);$(Log17);$(Log18);$(Log21);$(Log23);$(Log24);$(Log30);$(Log31);$(Log32);$(Log33);$(Log34);$(Log35);$(Log37);$(Log38);$(Log39);$(Log42);$(Log43);$(Log44);$(Log45);$(Log46);$(Log47);$(Log48);$(Log50);$(Log51);$(Log52);$(Log64);$(Log65);$(Log66);$(Log67);$(Log68);$(Log69);$(Log70);$(Log71)
ModuleName=OSCEclient
RestartService=0

[Event22]
EventName=C&C Callback Logs
EventFile=$(Log73);$(Log72);$(Log63);$(Log95);$(Log96);$(Log97)
ModuleName=CCCA

[Event23]
EventName=Sample Submission Logs
EventFile=$(Log88);$(Log89)
ModuleName=AEGIS

[Event24]
EventName=HTTP Logs
EventFile=$(Log79);$(Log94)

[Variables]
HomeDir=$(32:HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Application Path)
RegRootKey=HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro

HomedirReg1=$(HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Wireless Protection Manager\ApplicationPath\SetupLog)
HomedirReg2=$(HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Wireless Protection Manager\ApplicationPath\AppLog)
HomeDirReg3=$(HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\SecuRemote\5.0\PRODDIR)
PluginDir=$(HomeDir)..\BM;C:\Windows\System32\drivers;C:\Windows\SysWOW64\drivers;C:\Windows\Sysnative\dgagent;C:\Windows\System32\tmumh;C:\Windows\SysWOW64\tmumh

DrWtsn32Path=$(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson\LogFilePath)
MemoryDump=$(HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\DumpFile)
UserDump=$(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson\CrashDumpFile)

DebugLog1=$(OSCE_DEBUG_LOG).*
DebugLog2=$(WinDir)\Tmfilter.log
DebugLog3=$(HomeDirReg2)

UMHDllsList=UMHDllLists.log

;Please do not modify OSCE_DEBUG_LOG and PFW_DUMP, it is used by DLL extension interface
OSCE_DEBUG_LOG=$(systemdrive)\OfcDebug.log
;PFW_DUMP=Pre-defined in the DLL implementation, it is $(WinDir)\pfw_dump.txt

CCSF_FILTER_MODULE=LOG_INFO_TYPE_ENGINE_TMSA:wrs;LOG_INFO_TYPE_ENGINE_BP_ADAPTER:wrs;

;Please do not modify DLP_DEBUG_LOG_PREFIX, it is used by DLL extension interface
;Note DLP_DEBUG_LOG_PREFIX cannot conatin space in it
DLP_DEBUG_LOG_PREFIX=$(systemdrive)\cdt_OfcDlp

SecureProtocol_Reg1=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
SecureProtocol_Reg2=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
SecureProtocol_Reg3=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
SecureProtocol_Reg4=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Log1=$(WinDir)\OfcNT.log
Log2=$(DrWtsn32Path)\DrWtsn32.log
Log3=$(UserDump)
Log4=$(MemoryDump)
Log5=$(systemdrive)\Documents and Settings\All Users\Documents\DrWatson\DrWtsn32.log
Log6=$(systemdrive)\Documents and Settings\All Users\Documents\DrWatson\user.dmp
Log7=$(HomeDir)\AU_Data\AU_Log\tmudump.txt
Log8=$(HomeDir)\Aubin\patchdmp.txt
Log9=$(WinDir)\Tmfilter.log
Log10=$(HomeDir)\_Tmopp.ini
Log11=$(HomeDir)\TmOppRestore.ini
Log12=$(HomeDir)\OppLog\Opplogs.log
Log13=$(HomeDir)\Pc-cillin.ini
Log14=$(systemdrive)\Pcc9.log  
Log15=$(HomeDir)\Pcc.log
Log16=$(HomeDir)\Update.ini
Log17=$(HomeDir)\SMOL.ini
Log18=$(HomeDir)\smoldbg.txt
Log19=$(HomeDirReg1)
Log20=$(HomeDirReg3)\policy\*.scv
Log21=$(HomeDir)\temp\*.log
Log22=$(systemdrive)\cfw_log.txt
Log23=$(HomeDir)\ConnLog\*.log
Log24=$(HomeDir)\misc\ofcurlf.log
Log25=$(systemdrive)\tmproxy.log
Log26=$(systemdrive)\tmpfw.log
Log27=$(winDir)\setupapi.log
Log28=$(systemdrive)\temp\*_NSC_TmProxy.log
Log29=$(systemdrive)\temp\*_NSC_TmPfw*.log
Log30=$(systemdrive)\SSAPI.log
Log31=$(HomeDir)\SSAPI.log
Log32=$(HomeDir)\temp\*.zip
Log33=$(HomeDir)\Log\TMBMCli*.log
Log34=$(HomeDir)\..\BM\Log\*.*
Log35=$(HomeDir)\ssNotify.ini
Log36=$(HomeDir)\BF.ptn
Log37=$(Systemdrive)\ClnPack.log
Log38=$(HomeDir)\icrc.dat
Log39=$(HomeDir)\PFW\*.dat
Log40=$(Systemdrive)\lwf_log.txt 
Log41=$(Systemdrive)\wfp_log.txt
Log42=$(WinDir)\inf\setupapi.app.log
Log43=$(WinDir)\inf\setupapi.dev.log
Log44=$(WinDir)\system32\tminstall.log
Log45=$(HomeDir)\DAC_ELIST
Log46=$(HomeDir)\ofcscan.ini
Log47=$(HomeDir)\SmartScanClientQueries.csv
Log48=$(HomeDir)\SmartScanClientScanningCounters.csv
Log49=$(DLP_DEBUG_LOG_PREFIX)*.log
Log50=$(userprofile)\Local Settings\Temporary Internet Files\*_TmPlugIn.log
Log51=$(userprofile)\AppData\Local\Microsoft\Windows\Temporary Internet Files\*_TmPlugIn.log
Log52=$(userprofile)\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\*_TmPlugIn.log
Log53=$(HomeDir)\*.dmp
Log54=$(HomeDir)\dlplite\*.*
Log55=$(HomeDir)\dlp*.*
Log56=$(WinDir)\System32\dgagent\*.pol
Log57=$(WinDir)\System32\dgagent\dsaverreg.dll
Log58=$(WinDir)\System32\dgagent\dsa.pro
Log59=$(WinDir)\System32\dgagent\dsa.sta
Log60=$(WinDir)\System32\dgagent\dsa.ctl
Log61=$(WinDir)\System32\dgagent\dsa.cfg
Log62=$(WinDir)\System32\dgagent\GHttpPtn.xml
Log63=$(systemdrive)\temp\*_tmncie*.*
Log64=$(HomeDir)\misc\OfcUrlCategory.log
Log65=$(HomeDir)\ofcAWSL*.dat
Log66=$(HomeDir)\ofcBWSL*.dat
Log67=$(HomeDir)\misc\pccnt35.log
Log68=$(HomeDir)\report\YYYYMMDD.log
Log69=$(HomeDir)\Debug\TSCDebug.log
Log70=$(HomeDir)\ous.ini
Log71=$(systemdrive)\SDK_INSTALL.log.*.log
Log72=$(systemdrive)\*_EE_*.*
Log73=$(systemdrive)\tmnciesc_log.txt
Log74=$(HomeDir)\CCSF\*.log
Log75=$(HomeDir)\CCSF\debug\10011\*.*
Log76=$(HomeDir)\CCSF\debug\20002\*.*
Log77=$(HomeDir)\crcz.ptn
Log78=$(WinDir)\tmcomm.log
Log79=$(WinDir)\System32\LogFiles\HTTPERR\httperr*.log
Log80=$(HomeDir)\Misc\scan_operation.csv
Log81=$(HomeDir)\tmopp.ini
Log82=$(HomeDir)\..\BM\Patterns\*.*
Log83=$(HomeDir)\..\BM\Profiles\*.*
Log84=$(HomeDir)\..\BM\log\*.*
Log85=$(HomeDir)\..\BM\Eyes\log\*.*
Log86=$(HomeDir)\CCSF\debug\10012\*.*
Log87=$(HomeDir)\CCSF\debug\20019\*.*
Log88=$(HomeDir)\misc\SampleSubCln_*.txt
Log89=$(HomeDir)\dbdda\*.db
Log90=$(UMHDllsList)
Log91=$(HomeDir)\hotfix_history.ini
Log92=$(HomeDir)\cache.dat
Log93=$(HomeDir)\Log\icrc_diagnostic.log
Log94=$(HomeDir)\apricot.log
Log95=$(HomeDir)\Ncie*.ini
Log96=$(HomeDir)\OfcCCCAUpdate.ini
Log97=$(HomeDir)\bl.ini
Log98=$(HomeDir)\CCSF\*.cfg
Log99=$(HomeDir)\HotFix.dat
Log100=$(userprofile)\AppData\Local\Trend Micro\OfficeScan Client\*.LOG
Log101=$(userprofile)\AppData\Local\Trend Micro\Security Agent\*.LOG
Log102=$(WinDir)\OfcInstReg.log
Log103=$(HomeDir)\Misc\AEGIS.log
Log104=$(HomeDir)\Misc\AEGIS_BM.log
Log105=$(HomeDir)\DllBackup
Log106=$(HomeDir)\..\Endpoint Basecamp\log\*.log
Log107=$(HomeDir)\..\Endpoint Basecamp\log\*.zip
Log108=$(systemdrive)\Program Files\Trend Micro\Cloud Endpoint\VOneEndpoint.cfg
Log109=$(systemdrive)\Program Files\Trend Micro\Cloud Endpoint\modules\LweBridgeModule\LWE\*.cfg
Log110=$(WinDir)\Temp\Cloud Endpoint\*.log
Log111=$(systemdrive)\Program Files\Trend Micro\Cloud Endpoint\modules\LweBridgeModule\LWE\filelist

[CleanAfterCDTExec]
MaxCountNumber=14
Clean1=$(systemdrive)\OfcDebug.log
Clean2=$(systemdrive)\cdt_OfcDlp.*.log
Clean3=$(systemdrive)\Pcc9.log  
Clean4=$(systemdrive)\cfw_log.txt
Clean5=$(systemdrive)\tmproxy.log
Clean6=$(systemdrive)\tmpfw.log
Clean7=$(systemdrive)\SSAPI.log
Clean8=$(Systemdrive)\lwf_log.txt 
Clean9=$(Systemdrive)\wfp_log.txt
Clean10=$(systemdrive)\SDK_INSTALL.log.*.log
Clean11=$(systemdrive)\*_EE_*.*
Clean12=$(systemdrive)\tmnciesc_log.txt
Clean13=$(systemdrive)\Windows\tmfilter.log
Clean14=$(systemdrive)\OfcDebug.log.*.7z
