Real-time scanning occurs whenever a file is saved to a SharePoint server (check-in) or retrieved from the SharePoint server (check-out). Manual scanning scans the SharePoint content database and occurs immediately after you manually choose Scan Now. Scheduled scans perform the same function as manual scans, but occur according to the schedule you set. The duration of the scan depends on the number of files and your hardware resources.
To optimize the performance of your SharePoint environment, Trend Micro recommends that you NOT perform a manual or scheduled scan during peak usage periods.
When real-time scan is enabled and scan documents on download and scan documents on upload are also enabled on the SharePoint Anti-Virus options, then, PortalProtect will scan the files while uploading, but will not scan the files while downloading. Since these files have already been scanned, PortalProtect will not scan them again during download. This is due to limitations of Microsoft SharePoint.
PortalProtect secures your SharePoint environment by performing scans on all content that is either uploaded or downloaded. You can configure PortalProtect to run scans on-demand (manual scanning), according to a schedule (scheduled scanning), or in an ongoing and persistent manner (real-time scanning). Additionally, you configure scans using the Security Risk Scan screen, accessible from the sidebar, or from the Manual Scan and Scheduled Scan screens.
Real-time Scanning protects your SharePoint environment in an ongoing manner. When you enable real-time scan, it continually runs in the background. You can configure only one real-time scan at a time.
Trend Micro recommends that you always keep real-time scan enabled. However, if you must disable the real-time scan functionality, be sure to run regular manual scans.