I've run across a situation where a customer is reporting odd behavior from his system.  The software running on his system uses the GetVolumeInformation in kernel32 to document the machine's current hard drive serial number.  Sometimes it gets the serial number and other times it doesn't.  The user can literally run the app and not get the number, exit, then run the app and get the number.  Odd, just odd.  I've run through the P/Invoke declaration and it seems right.  I'm wondering if Trend Micro is interfering but am having a hard time understanding if it is, how.  Can Trend Micro interfer with kernel32 API calls?