Terminology

Terminology

The following table provides the official terminology used throughout the OfficeScan documentation:

OfficeScan terminology

Terminology

Description

Client

The OfficeScan client program

Client computer or endpoint

The computer where the OfficeScan client is installed

Client user (or user)

The person managing the OfficeScan client on the client computer

Server

The OfficeScan server program

Server computer

The computer where the OfficeScan server is installed

Administrator (or OfficeScan administrator)

The person managing the OfficeScan server

Console

The user interface for configuring and managing OfficeScan server and client settings

The console for the OfficeScan server program is called "Web console", while the console for the client program is called "client console".

Security risk

The collective term for virus/malware, spyware/grayware, and Web threats

Product service

Includes Antivirus, Damage Cleanup Services, and Web Reputation and Anti-spyware—all of which are activated during OfficeScan server installation

OfficeScan service

Services hosted by Microsoft Management Console (MMC). For example, ofcservice.exe, the OfficeScan Master Service.

Program

Includes the OfficeScan client, Cisco Trust Agent, and Plug-in Manager

Components

Responsible for scanning, detecting, and taking actions against security risks

Client installation folder

The folder on the computer that contains the OfficeScan client files. If you accept the default settings during installation, you will find the installation folder at any of the following locations:

C:\Program Files\Trend Micro\OfficeScan Client

C:\Program Files (x86)\Trend Micro\OfficeScan Client

Server installation folder

The folder on the computer that contains the OfficeScan server files. If you accept the default settings during installation, you will find the installation folder at any of the following locations:

C:\Program Files\Trend Micro\OfficeScan

C:\Program Files (x86)\Trend Micro\OfficeScan

For example, if a particular file is found under \PCCSRV on the server installation folder, the full path to the file is:

C:\Program Files\Trend Micro\OfficeScan\PCCSRV\<file_name>.

Smart scan client

An OfficeScan client that has been configured to use smart scan

Conventional scan client

An OfficeScan client that has been configured to use conventional scan

Copyright © 1998-2010 Trend Micro Incorporated. All rights reserved.


Installation Requirements

The OfficeScan client can be installed on computers running the following platforms:

  • Windows XP/2003, 32-bit version

  • Windows XP/2003, 64-bit version

  • Windows Vista, 32-bit and 64-bit versions

  • Windows 2008, 32-bit version

  • Windows 2008 and Windows 2008 R2, 64-bit version

  • Windows 7, 32-bit version

  • Windows 7, 64-bit version

  • Windows Embedded POSReady 2009, 32-bit version

Windows XP/Server 2003, 32-bit version

Resource

Requirement

Operating system (Windows XP)

  • Windows XP Home with Service Pack 3

  • Windows XP Professional with Service Pack 3

  • Windows XP Professional for Embedded Systems

  • Windows XP Tablet PC Edition with Service Pack 3

  • OfficeScan supports client installation on guest Windows XP operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter™ 4

  • Citrix™ XenServer™ 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

  • OfficeScan automatically disables some features on server platforms. Refer to Post-installation Considerations for more information.

Operating system (Windows Server 2003)

  • Windows Server™ 2003 (Standard, Enterprise, Datacenter, and Web Editions) with Service Pack 2

  • Windows Server 2003 R2 (Standard, Enterprise, and Datacenter Editions) with Service Pack 2

  • Windows Storage Server 2003 (Basic, Standard, Enterprise, and Workgroup Editions) with Service Pack 2

  • Windows Storage Server 2003 R2 (Basic, Standard, Enterprise, and Workgroup Editions) with Service Pack 2

  • Microsoft Windows Compute Cluster Server 2003

  • OfficeScan supports client installation on guest Windows 2003 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter™ 4

  • Citrix™ XenServer™ 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

  • OfficeScan automatically disables some features on server platforms. Refer to Post-installation Considerations for more information.

Hardware

Processor

300MHz Intel Pentium or equivalent

AMD™64 processor architectures

RAM

256MB minimum, 512MB recommended

Available disk space

350MB minimum

Others

Monitor that supports 1024 x 768 resolution at 256 colors

Others

  • Microsoft Internet Explorer 6.0, 7.0, or 8.0 if performing Web setup

  • Disable Simple File Sharing on Windows XP computers so users can successfully install the OfficeScan client program (see the Windows documentation for instructions).

Windows XP/2003, 64-bit version

Resource

Requirement

Operating system

  • Windows XP Professional with Service Pack 2

  • Windows Server 2003 (Standard, Enterprise, Datacenter, and Web Editions) with Service Pack 2

  • Windows Server 2003 R2 (Standard, Enterprise, and Datacenter Editions) with Service Pack 2

  • Windows Storage Server 2003 (Basic, Standard, Enterprise, and Workgroup Editions) with Service Pack 2

  • Windows Storage Server 2003 R2 (Basic, Standard, Enterprise, and Workgroup Editions) with Service Pack 2

  • Microsoft Windows Compute Cluster Server 2003

  • OfficeScan supports client installation on guest Windows XP/2003 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

  • OfficeScan automatically disables some features on server platforms. Refer to Post-installation Considerations for more information.

Hardware

Processor

AMD64 and Intel 64 processor architectures

RAM

256MB minimum, 512MB recommended

Available disk space

350MB minimum

Others

Monitor that supports 1024 x 768 resolution at 256 colors

Others

  • Microsoft Internet Explorer 6.0, 7.0, or 8.0 if performing Web setup

  • Disable Simple File Sharing on Windows XP computers so users can successfully install the OfficeScan client program (see the Windows documentation for instructions).

Windows Vista, 32-bit and 64-bit versions

Resource

Requirement

Operating system

  • Windows Vista™ (Business, Enterprise, Ultimate, Home Premium, Home Basic) with Service Pack 1 or 2

  • Windows Vista Business/Ultimate for Embedded Systems

  • OfficeScan supports client installation on guest Windows Vista operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

Hardware

Processor

  • 1GHz Intel Pentium or equivalent

  • AMD64 and Intel 64 processor architectures

RAM

1GB minimum, 1.5GB recommended

Available disk space

350MB minimum

Others

Monitor that supports 1024 x 768 resolution at 256 colors

Others

Windows Internet Explorer 7.0 or 8.0 if performing Web setup

Windows Server 2008, 32-bit version

Resource

Requirement

Operating system

  • Windows Server 2008 (Standard, Enterprise, Datacenter and Web Editions) with Service Pack 1 or 2

  • Windows Storage Server 2008 (Basic Edition)

  • Microsoft Windows HPC Server 2008

  • OfficeScan supports client installation on guest Windows 2008 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

  • OfficeScan automatically disables some features on server platforms. Refer to Post-installation Considerations for more information.

Hardware

Processor

  • Minimum 1GHz Intel Pentium or equivalent, 2GHz recommended

  • AMD64 and Intel 64 processor architectures

RAM

512MB minimum, 2GB recommended

Available disk space

350MB minimum

Others

Monitor that supports 1024 x 768 resolution at 256 colors

Others

Windows Internet Explorer 7.0 or 8.0 if performing Web setup

Windows Server 2008 and Windows Server 2008 R2, 64-bit version

Resource

Requirement

Operating system

  • Windows Server 2008 (Standard, Enterprise, Datacenter and Web Editions) with Service Pack 1 or 2

  • Windows Server 2008 R2 (Standard, Enterprise, Datacenter, and Web Editions)

  • Windows Storage Server 2008 (Basic, Standard, Enterprise, and Workgroup Editions)

  • Windows Storage Server 2008 R2

  • Microsoft Windows HPC Server 2008

  • OfficeScan supports client installation on guest Windows 2008 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

  • OfficeScan automatically disables some features on server platforms. Refer to Post-installation Considerations for more information.

Hardware

Processor

  • Minimum 1.4GHz Intel Pentium or equivalent, 2GHz recommended

  • AMD64 and Intel 64 processor architectures

RAM

512MB minimum, 2GB recommended

Available disk space

350MB minimum

Others

Monitor that supports 1024 x 768 resolution at 256 colors

Others

If performing Web setup:

  • Windows Internet Explorer 7.0 or 8.0 for Windows Server 2008

  • Windows Internet Explorer 8.0 for Windows Server 2008 R2

Windows 7, 32-bit version

Resource

Requirement

Operating system

  • Windows 7 (Home Basic, Home Premium, Ultimate, Professional, Enterprise)

  • Windows 7 Professional/Ultimate for Embedded Systems

  • OfficeScan supports client installation on guest Windows 7 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

Hardware

Processor

  • Minimum 1GHz Intel Pentium or equivalent, 2GHz recommended

  • AMD64 and Intel 64 processor architectures

RAM

1GB minimum, 2GB recommended

Available disk space

350MB minimum

Others

Windows Internet Explorer 8.0 if performing Web setup

Windows 7, 64-bit version

Resource

Requirement

Operating system

  • Windows 7 (Home Basic, Home Premium, Ultimate, Professional, Enterprise)

  • Windows 7 Professional/Ultimate for Embedded Systems

  • OfficeScan supports client installation on guest Windows 7 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

Hardware

Processor

  • Minimum 2GHz Intel Pentium or equivalent

  • AMD64 and Intel 64 processor architectures

RAM

1.5GB minimum

Available disk space

350MB minimum

Others

Windows Internet Explorer 8.0 if performing Web setup

Windows Embedded POSReady 2009, 32-bit version

Resource

Requirement

Operating system

  • Windows Embedded POSReady 2009

  • OfficeScan supports client installation on guest Windows Embedded POSReady 2009 operating systems hosted on the following virtualization applications:

  • Microsoft Virtual Server 2005 R2 with Service Pack 1

  • VMware ESX/ESXi Server 4 (Server Edition)

  • VMware Server 2 (Server Edition)

  • VMware Workstation and Workstation ACE Edition 7.0

  • VMware vCenter 4

  • Citrix XenServer 5.5

  • Microsoft Windows Server 2008 64-bit Hyper-V

  • Microsoft Windows Server 2008 R2 64-bit Hyper-V

  • Microsoft Hyper-V Server 2008 R2 64-bit

Hardware

Processor

  • Minimum 300MHz Intel Pentium or equivalent

RAM

256MB minimum, 512MB recommended

Available disk space

350MB minimum

Others

Windows Internet Explorer 6.0, 7.0, or 8.0 if performing Web setup

Compatibility List

OfficeScan is compatible with the following third-party products:

  • Microsoft Office XP, 2003, 2007, and 2010

  • Microsoft SQL Server™ 2005 and 2008

  • Terminal Services on Windows 2003, 2003 R2, 2008, and 2008 R2

  • Windows Server 2003/2003 R2 Clusters

  • Windows Server 2008/2008 R2 Failover Clusters

  • VMware View™ 4

  • Citrix™ XenApp™ 4.5/5.0

  • Citrix XenDesktop™ 4

  • Outlook Mail Scan supports Microsoft Office Outlook™ 2002, 2003, 2007, and 2010

  • POP3 Mail Scan supports the following email programs:

  • Becky! Internet Mail 2.0

  • Eudora™ 6.2

  • Microsoft Outlook Express 6.0

  • Microsoft Office Outlook 2002, 2003, 2007, and 2010

  • Mozilla Thunderbird™ 1.5, 2.0

  • Windows Mail (for Windows Vista only)

  • Foxmail 5.0, 6.0


Using Vulnerability Scanner

Use Vulnerability Scanner to detect installed antivirus solutions, search for unprotected computers on the network, and install OfficeScan™ clients to computers. To determine if computers are protected, Vulnerability Scanner pings ports normally used by antivirus solutions.

Vulnerability Scanner Functions

Vulnerability Scanner performs the following functions:

  • Monitor the network for Dynamic Host Configuration Protocol (DHCP) requests so that when computers first log on to the network, Vulnerability Scanner can determine their status.

  • Ping computers on the network to check their status and retrieve their computer names, platform versions, and descriptions.

  • Determine the antivirus solutions installed on the network. Vulnerability scanner can detect Trend Micro™ products and third-party antivirus solutions (including Norton AntiVirus™ Corporate Edition and McAfee™ VirusScan™ ePolicy Orchestrator™).

  • Send scan results through email or export results to a comma-separated value (CSV) file.

Considerations When Using Vulnerability Scanner

To help you decide whether to use Vulnerability Scanner, consider the following:

Network Administration

Network administration

Setup | Effectiveness of Vulnerability Scanner
Administration with strict security policy | Very effective. Vulnerability Scanner reports whether or not all computers have antivirus software installed.
Administrative responsibility distributed across different sites | Moderately effective
Centralized administration | Moderately effective
Outsource service | Moderately effective
Users administer their own computers | Not effective. Because Vulnerability Scanner scans the network for antivirus installation, it is not feasible to have users scan their own computers.

Network Topology and Architecture

Network topology and architecture

Setup | Effectiveness of Vulnerability Scanner
Single location | Very effective. Vulnerability Scanner allows you to scan an entire IP segment and install OfficeScan client easily on the LAN.
Multiple locations with high speed connection | Moderately effective
Multiple locations with low speed connection | Not effective. You need to run Vulnerability Scanner on each location and OfficeScan client installation must be directed to a local OfficeScan server.
Remote and isolated computers | Not effective. Vulnerability Scanner cannot scan computers not connected to the network.

Software/Hardware Specifications

Software/Hardware specifications

Setup | Effectiveness of Vulnerability Scanner
Windows NT-based operating systems | Very effective. Vulnerability Scanner can easily install the OfficeScan client remotely to computers running NT-based operating systems.
Mixed operating systems | Moderately effective. Vulnerability Scanner can only install to computers running Windows NT-based operating systems.
Desktop management software | Not effective. Vulnerability Scanner cannot be used with desktop management software. However, it can help track the progress of OfficeScan client installation.

Domain Structure

Domain structure

Setup | Effectiveness of Vulnerability Scanner
Microsoft Active Directory | Very effective. Specify the domain administrator account in Vulnerability Scanner to allow remote installation of the OfficeScan client.
Workgroup | Not effective. Vulnerability Scanner may have difficulty installing to computers using different administrative accounts and passwords.
Novell™ Directory Service | Not effective. Vulnerability Scanner requires a Windows Domain account to install the OfficeScan client.
Peer-to-peer | Not effective. Vulnerability Scanner may have difficulty installing to computers using different administrative accounts and passwords.

Network Traffic

Network traffic

Setup | Effectiveness of Vulnerability Scanner
LAN connection | Very effective
512 Kbps | Moderately effective
T1 connection and higher | Moderately effective
Dialup | Not effective. It will take a long time to finish installing the OfficeScan client.

Network Size

Network size

Setup | Effectiveness of Vulnerability Scanner
Very large enterprise | Very effective. The bigger the network, the more Vulnerability Scanner is needed for checking OfficeScan client installations.
Small and medium business | Moderately effective. For small networks, Vulnerability Scanner can be an option to install the OfficeScan client. Other client installation methods may prove much easier to implement.

User Tasks

Perform the following tasks from Vulnerability Scanner:

  • Installing the OfficeScan Client

  • Managing General Settings

  • Running Vulnerability Scan

  • Creating a Scheduled Task

  • Configuring Other Vulnerability Scanner Settings

Launching Vulnerability Scanner on Another Computer

You can launch Vulnerability Scanner on a computer other than the OfficeScan server computer. Ensure that the other computer runs Windows XP, 2003, 2008, Vista, and 7. You cannot launch the tool from Terminal Server.

To launch Vulnerability Scanner on another computer: >>>

  1. Connect to the OfficeScan server computer.

  2. Copy the TMVS folder in < Server installation folder>\PCCSRV\Admin\Utility to the other computer.

  3. After copying the TMVS folder, double-click TMVS.exe.


Installing the OfficeScan Client

Vulnerability Scanner can install the OfficeScan client to remote computers. However, Vulnerability Scanner will not install the client if:

  • The remote computer already has the OfficeScan server or other antivirus products installed.

  • The remote computer runs Windows XP Home, Windows Vista Home Basic, Windows Vista Home Premium, Windows 7 Starter, Windows 7 Home Basic, and Windows 7 Home Premium.

To install OfficeScan client with Vulnerability Scanner: >>>

  1. Perform the following steps:

    2. For Windows Vista Business, Enterprise, or Ultimate Edition, Windows 7 Professional, Enterprise, or Ultimate:

    1. Enable a built-in administrator account and set the password for the account.

    2. Click Start > Programs > Administrative Tools > Windows Firewall with Advanced Security.

    3. For Domain Profile, Private Profile, and Public Profile, set the firewall state to "Off".

    4. Open Microsoft Management Console (click Start > Run and type services.msc) and start the Remote Registry service. When installing the OfficeScan client, use the built-in administrator account and password.

    For Windows XP Professional (32-bit or 64-bit version):

    1. Open Windows Explorer and click Tools > Folder Options.

    2. Click the View tab and disable Use simple file sharing (Recommended).

  2. Navigate to the TMVS folder and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears.

    • On the OfficeScan server computer, the TMVS folder is located in < Server installation folder>\PCCSRV\Admin\Utility. If you copied the TMVS folder to another computer, navigate to the TMVS folder on that computer.

  3. Click Settings.

  4. Under OfficeScan server settings, type the OfficeScan server name and port number.

  5. Select Auto-Install OfficeScan client on unprotected computers.

  6. Click OK to begin checking the computers on the network and begin OfficeScan client installation.

See also:

  • Installation Requirements

  • Installation Methods


Managing General Settings

To configure and manage the following Vulnerability Scanner settings, navigate to < Server installation folder >\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe:

Product Query

Select the products to check on the network. To prevent false alarms, select all check boxes. Click Settings next to the product name to verify the port number that Vulnerability Scanner will check.

Manually configure the port settings for each product (except ServerProtect™ for Windows and Linux™ and McAfee™ VirusScan™ ePolicy Orchestrator™).

How Vulnerability Scanner checks security products:

Security products checked by Vulnerability Scanner

Product

Description

OfficeScan client

Vulnerability Scanner uses the OfficeScan client port to check if OfficeScan client is installed. It also checks if the TmListen.exe process is running. It retrieves the port number automatically if executed from its default location

If you launched TMVS on computer other than the OfficeScan server, check and then use the other computer's communication port.

Trend Micro Internet Security™ (PC-cillin)

Vulnerability Scanner uses port 40116 to check if Trend Micro Internet Security is installed.

ServerProtect for Windows

Vulnerability Scanner uses RPC endpoint to check if SPNTSVC.exe is running. It returns information including operating system, and Virus Scan Engine, Virus Pattern and product versions. Vulnerability Scanner cannot detect the ServerProtect Information Server or the ServerProtect Management Console.

ServerProtect for Linux

If the target computer does not run Windows, Vulnerability Scanner checks if it has ServerProtect for Linux installed by trying to connect to port 14942.

ScanMail™ for Microsoft Exchange™

Vulnerability Scanner loads the Web page http://ipaddress:port/scanmail.html to check for ScanMail installation. By default, ScanMail uses port 16372. If ScanMail uses a different port number, specify the port number. Otherwise, Vulnerability Scanner cannot detect ScanMail for Exchange.

InterScan™ family

Vulnerability Scanner loads each Web page for different products to check for product installation.

  • InterScan Messaging Security Suite 5.x: http://localhost:port/eManager/cgi-bin/eManager.htm

  • InterScan eManager 3.x: http://localhost:port/eManager/cgi-bin/eManager.htm

  • InterScan VirusWall™ 3.x: http://localhost:port/InterScan/cgi-bin/interscan.dll

PortalProtect™

Vulnerability Scanner loads the Web page http://localhost:port/PortalProtect/index.html to check for product installation.

Norton Antivirus™ Corporate Edition

Vulnerability Scanner sends a special token to UDP port 2967, the default port of Norton Antivirus Corporate Edition RTVScan. The computer with this antivirus product replies using a special token type. Since Norton Antivirus Corporate Edition communicates by UDP, the accuracy rate is not guaranteed. Furthermore, network traffic may influence UDP waiting time.

McAfee VirusScan ePolicy Orchestrator

Vulnerability Scanner sends a special token to TCP port 8081, the default port of ePolicy Orchestrator for providing connection between the server and client. The computer with this antivirus product replies using a special token type. Vulnerability Scanner cannot detect the standalone McAfee VirusScan.

Protocols

Vulnerability Scanner detects products and computers using the following protocols:

  • RPC: Detects ServerProtect for NT

  • UDP: Detects Norton AntiVirus Corporate Edition clients

  • TCP: Detects McAfee VirusScan ePolicy Orchestrator

  • ICMP: Detects computers by sending ICMP packets

  • HTTP: Detects OfficeScan clients

  • DHCP: If it detects a DHCP request, Vulnerability Scanner checks if antivirus software has already been installed on the requesting computer.

Method for Retrieving Computer Descriptions

Quick retrieval retrieves only the computer name. Normal retrieval takes longer to complete since it retrieves both domain and computer information. If you select Normal retrieval, set Vulnerability Scanner to try to retrieve computer descriptions, if available.

Notifications

To automatically send the results to yourself or to other administrators in your organization, select Email results to the system administrator, and then click Configure to specify email settings.

  1. In To, type the email address of the recipient.

  2. In From, type an email address to let the recipient know who sent the message.

  3. In SMTP server, type the SMTP server address. For example, type smtp.company.com. The SMTP server information is required.

  4. In Subject, type a new subject for the message or accept the default subject.

  5. Click OK.

  6. Choose to display a notification on unprotected computers. Click Customize to configure the notification message. In the Notification Message screen, type a new message or accept the default message. Click OK.

Vulnerability Scan Results

Save the scan results to a comma-separated value (CSV) file. To change the default folder for saving the CSV file, click Browse, select a target folder on the computer or on the network, and then click OK.

Ping Settings

Enable Vulnerability Scanner to ping computers on the network to get their status. To specify how Vulnerability Scanner will send packets to the computers and wait for replies, select Allow Vulnerability Scanner to ping computers on your network to check their status, and then accept the default settings or type new values in the Packet size and Timeout text boxes.

Vulnerability Scanner can also detect the type of operating system using ICMP OS fingerprinting.

OfficeScan Server Settings

Type the OfficeScan server name and port number. Vulnerability Scanner can auto-install the OfficeScan client on unprotected computers.

Click Install to Account to configure the account. In the Account Information screen, type a user name and password that permits installation. Click OK.

Vulnerability Scanner can also send logs to the OfficeScan server.


Running Vulnerability Scan

Run Vulnerability Scan on multiple computers by specifying a range of IP addresses.

Vulnerability Scan can also run on computers requesting IP addresses from a DHCP server. Vulnerability Scanner listens on port 67 (DHCP Server listening port for DHCP requests). If it detects a DHCP request, Vulnerability Scanner can check for the presence of antivirus software on the requesting computer.

To run a manual vulnerability scan on a range of IP addresses: >>>

  1. Navigate to < Server installation folder>\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears.

  2. Under Manual Scan, type the IP address range of the computers you want to check.

    • Vulnerability Scanner only supports a class B IP address range, for example, 168.212.1.1 to 168.212.254.254.

  3. Click Start. The vulnerability scan results appear in the Results table under the Manual Scan tab.

    • MAC address information does not display in the Results table if the computer runs Windows 2008.

  4. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.

To run a vulnerability scan on computers requesting IP addresses from a DHCP server: >>>

  1. Configure DHCP settings in the TMVS.ini file found under the following folder: < Server installation folder>\PCCSRV\Admin\Utility\TMVS.

    DHCP settings in the TMVS.ini file

    Setting

    Description

    DhcpThreadNum=x

    Specify the thread number for DHCP mode. The minimum is 3, maximum is 100. The default value is 3.

    DhcpDelayScan=x

    This is the delay time in seconds before checking the requesting computer for installed antivirus software.

    The minimum is 0 (do not wait), maximum is 600. The default value is 60.

    LogReport=x

    0 disables logging, 1 enables logging.

    Vulnerability Scanner sends the results of the scan to the OfficeScan server and the logs display in the System Event Logs screen of the Web console.

    OsceServer=x

    This is the OfficeScan server's IP address or DNS name.

    OsceServerPort=x

    This is the Web server port on the OfficeScan server.

  2. Navigate to < Server installation folder>\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears.

  3. In the Results table, click the DHCP Scan tab.

    • The DHCP Scan tab is not available on computers running Windows 2008 and 7.

  4. Click Start. Vulnerability Scanner begins listening for DHCP requests and performing vulnerability checks on computers as they log on to the network. When it detects an unprotected computer and verifies that the computer's IP address belongs to the defined IP address range, Vulnerability Scanner runs remote installation to install the OfficeScan client.

  5. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.


Creating a Scheduled Task

Scheduling tasks in Vulnerability Scanner allows you to periodically check the network for installed antivirus solutions. This is a convenient way of running tasks automatically, without having to configure Vulnerability Scanner every time.

To create a scheduled task: >>>

  1. Navigate to < Server installation folder>\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears.

  2. In the Results table, click the DHCP Scan tab.

    • The DHCP Scan tab is not available on computers running Windows 2008 and 7.

  3. Under Scheduled Scan, click Add/Edit. The Scheduled Scan screen appears. Configure the following:

    • Name: Type a name for the scheduled scan.

    • IP address range: Type the IP address range of the computers you want to check.

    • Start time: Type or select the time when the scan will run. Use the 24-hour clock format.

    • Frequency: Select how often the scan will run. Choose from daily, weekly, or monthly.

    • Settings: Click Use current settings to use existing settings, or click Modify settings. If you click Modify settings, click Settings to change the configuration.

  4. Click OK. The scheduled scan you created appears under Scheduled Scan.

  5. To execute the scheduled scan immediately, click Run Now.


Configuring Other Vulnerability Scanner Settings

Some Vulnerability Scanner settings can be configured only from the TMVS.ini file.

To modify settings on the TMVS.ini file: >>>

  1. Navigate to < Server installation folder>\PCCSRV\Admin\Utility\TMVS and open TMVS.ini. using a text editor such as Notepad.

  2. To set the number of computers that Vulnerability Scanner simultaneously pings, change the value for EchoNum. Specify a value between 1 and 64.

    3. For example, type EchoNum=60 if you want Vulnerability Scanner to ping 60 computers at the same time.

  3. To set the number of computers that Vulnerability Scanner simultaneously checks for antivirus software, change the value for ThreadNumManual. Specify a value between 8 and 64.

    4. For example, type ThreadNumManual=60 if you want Vulnerability Scanner to check 60 computers for antivirus software at the same time.

  4. To set the number of computers that Vulnerability Scanner simultaneously checks for antivirus software when running scheduled tasks, change the value for ThreadNumSchedule. Specify a value between 8 and 64.

    5. For example, type ThreadNumSchedule=60 if you want Vulnerability Scanner to check 60 computers for antivirus software at the same time whenever it runs a scheduled task.

  5. Save TMVS.ini.

  • See Server Debug Logs Using LogServer.exe for information on how to collect debug logs for Vulnerability Scanner.


Server Debug Logs Using LogServer.exe

Use LogServer.exe to collect debug logs for the following:

  • OfficeScan server basic logs

  • Trend Micro Vulnerability Scanner

  • Active Directory integration logs

  • Client grouping logs

  • Security compliance logs

  • Role-based administration

  • Smart scan

  • Policy Server

To enable debug logging: >>>

  1. Log on to the Web console.

  2. On the banner of the Web console, click the first "c" in "OfficeScan".

  3. Specify debug log settings.

  4. Click Save.

  5. Check the log file (ofcdebug.log) in the default location: < Server installation folder>\PCCSRV\Log.

To disable debug logging: >>>

  1. Log on to the Web console.

  2. On the banner of the Web console, click the first "c" in "OfficeScan".

  3. Clear Enable debug log.

  4. Click Save.

To enable debug logging for server installation and upgrade: >>>

Enable debug logging before performing the following tasks:

  • Uninstall and then install the server again.

  • Upgrade OfficeScan to a new version.

  • Perform remote installation/upgrade (Debug logging is enabled on the computer where you launched Setup and not on the remote computer.)

Perform the following steps:

  1. Copy the LogServer folder located in < Server installation folder>\PCCSRV\Private to C:\.

  2. Create a file named ofcdebug.ini with the following content:

    3. [debug]

    debuglevel=9

    debuglog=c:\LogServer\ofcdebug.log

    debugLevel_new=D

    debugSplitSize=10485760

    debugSplitPeriod=12

    debugRemoveAfterSplit=1

  3. Save ofcdebug.ini to C:\LogServer.

  4. Perform the appropriate task (that is, uninstall/reinstall the server, upgrade to a new server version, or perform remote installation/upgrade).

  5. Check ofcdebug.log in C:\LogServer.

See also:

  • OfficeScan Server Logs