At the heart of all Trend Micro products lies a proprietary scan engine, know as VSAPI, that is capable of detecting all virus known to be �in the wild�, or actively circulating. The 32-bit, ICSA-certified, multi-threaded engine checks files in real-time using a process called pattern matching. VSAPI also employs a number of heuristic scanning technologies that even allow it to detect new viruses not yet recognized by security experts. In addition to viruses, the engine protects against mass mailing worms such as Nimda and CodeRed, macro and polymorphic viruses, Trojans, and Distributed Denial of Service (DDoS) attacks.

The scan engine includes an automatic clean-up routine for old virus pattern files (to help manage disk space), as well as incremental pattern updates (to help manage bandwidth).