Microsoft Surface Pro (2017) BSOD PDC_WATCHDOG_TIMEOUT pdc.sys with Trend Micro Anti Virus

Anonymous

Hi,

I've been getting bluescreens for a few days now after a while of doing nothing.

The tablet is currently unused next to me but is on and the display is off, eventually comes just the said BSOD and the part restarts.

Have current Surace Pack on Win10 and current updates.

What could be the PDC_WATCHDOG_TIMEOUT?

The triggering file is pdc.sys.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

My Company is experiencing the exact same issue with our Surface Pro Fleet of Devices (1796 & 1807); Trend has been fairly helpful but still yet to confirm a proper fix & it's currently not on the Developers Radar for future fixes.. The "workarounds" suggested & that I've deployed to a few Surfaces are proving successful.

Trend Micro's Response:

As per checking deeper on the DMP files that was collected, as per our Developers; the issue is because Behaviour Monitoring is unable to handle events from sleep mode. So indirectly, it leads to PDC.sys, or DAM.sys to BSOD.

--CUT--

PROCESS ffffbe830f8e8640 SessionId: 0 Cid: 196c Peb: d48258b000 ParentCid: 0368 DeepFreeze DirBase: 126388000 ObjectTable: ffffce8bc4bc6480 HandleCount: 2212. Image: TMBMSRV.exe

--CUT--

Suggested Action Plan to apply for testing, provided by Trend Micro:

Rename AEGIS drivers and create a folder with same name

c:\windows\system32\drivers\tmcomm.sys

c:\windows\system32\drivers\tmactmon.sys

c:\windows\system32\drivers\tmevtmgr.sys

(ps: Take tmcomm.sys for example, rename it as tmcomm.sys.bak, then create a folder named tmcomm.sys)

Create the following registry key entry:

[HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\aegis]

PowerMonitorTime=dword:0x10

Still awaiting for further development & feedback from Trend but have yet to experience a BSOD with the above mentioned Action steps followed.

Note our case is still opened with Trend Micro, I'll post updates as they occur.

0 comments

Answer accepted by question author

Anonymous

I uninstalled Trend Micro Anti Virus and the problem went away. We are now using Symantec Antivirus.

0 comments

Answer accepted by question author

Anonymous

I can confirm applying just the registry key from the above posts fixes the BSOD/Crash on the 3 Surface books I have updated to 1709 with the latest driver pack 18_015_00 16299 (64 bit) .

Create the following registry key entry:

[HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\aegis]

PowerMonitorTime=dword:0x10

I have logged the call with Trend to find out what exactly the key does before I roll it out and if there is a fix/patch due to be released.

0 comments

52 additional answers

Anonymous

2018-02-23T21:35:43+00:00
Small update from Trend After Some Escalation.

Script is no longer required & is recommended to remove the folders that were preventing the creation of the .sys files as indicated below:

rmdir C:\windows\system32\drivers\tmcomm.sys

rmdir C:\windows\system32\drivers\tmactmon.sys

rmdir C:\windows\system32\drivers\tmevtmgr.sys

For Mass deployment fix from the Trend OfficeScan XG [This will deploy the Registry settings like the script moving forward to all Trend OfficeScan Agents]

On Trend OfficeScan Server:

Backup the OfcScan.ini located in C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV

Turn off the OfficeScan Master Service

Edit the Ofcscan.ini and amend the parameter below or add if it is not indicated.

[Global Setting]

PowerMonitorTime = 16

Save the edited Ofcscan.ini

Turn on the OfficeScan Master Service

Login to OfficeScan Server Console

Go to Agents > Global Settings > Click SAVE
Thanks Slap Dash!

I will give that a try in our office and see how it goes.

Switching from TrencMicro isn't really an option for us right now (I really don't want to put Surface on a different AV than the rest of our laptops and desktops).

Prior to reading this latest reply about amending Ofcscan.ini, I did create a script to automate the first solution, which I have included below in case it is helpful to anyone else (you will just need to update your unload password where I entered "UNLOAD_PASSWORD")

<snip>

@echo off

CLS

ECHO.

::::::::::::::::::::::::::::

::START

::::::::::::::::::::::::::::

REM Unload TrendMicro OfficeScan from CLI

echo ++++++++++++++++++++++++++++++++++++++++++++

echo ++ Unloading Trend Micro OfficeScan Agent ++

echo ++++++++++++++++++++++++++++++++++++++++++++

cd "C:\Program Files (x86)\Trend Micro\OfficeScan Client"

PccNTMon.exe -n UNLOAD_PASSWORD

if ERRORLEVEL 1 goto error1

REM Rename the Trend Micro AEGIS Driver .sys files by adding .bak to their extension

echo ++++++++++++++++++++++++++++++++++++++++++++++++++

echo ++ Renaming TrendMicro OfficeScan AEGIS Drivers ++

echo ++++++++++++++++++++++++++++++++++++++++++++++++++

REN c:\windows\system32\drivers\tmcomm.sys *.bak

REN c:\windows\system32\drivers\tmactmon.sys *.bak

REN c:\windows\system32\drivers\tmevtmgr.sys *.bak

if ERRORLEVEL 1 goto error2

REM Load PowerMonitorTime Registry Workaround

echo ++++++++++++++++++++++++++++++++++++++++++++++++++++

echo ++ Adding PowerMonitorTime Workaround to Registry ++

echo ++++++++++++++++++++++++++++++++++++++++++++++++++++

regedit.exe /s \Path-To\PowerMonitorTime\Workaround.reg

if ERRORLEVEL 1 goto error3

echo ++++++++++++++++++++++++++++

echo ++ PLEASE REBOOT MANUALLY ++

echo ++++++++++++++++++++++++++++

pause

exit

:error1

echo There was a problem unloading TrendMicro OfficeScan Agent

pause

:error2

echo There was a problem renaming TrendMicro OfficeScan AEGIS Driver Files

pause

:error3

echo There was a problem loading the Registry workaround into Windows

pause

</snip>
Was this answer helpful?

0 comments No comments
Anonymous

2018-02-21T17:54:02+00:00

Thank you for this fix, it worked great on our systems. Hopefully Trend Micro comes up with a hotfix soon
Was this answer helpful?

0 comments No comments