Scan one or more endpoints for file-based threats such as viruses, spyware, and grayware.

This task is supported by the following services:
  • Trend Micro Apex One as a Service
  • Standard Endpoint Protection
When searching for suspicious files on endpoints, you may trigger a one-time malware scan for a single endpoint using the context menu in Workbench or for up to 200 endpoints using the Response drop-down menu in Endpoint Inventory.
  • Agents on target endpoints must be connected and upgraded to the latest version.
  • If the agent on a target endpoint is disconnected, the task is queued until the agent reconnects. Queued tasks time out after 24 hours.
  • Depending on number of files, size of files, and storage device speed on target endpoints, the task may take several hours to complete.


  1. After identifying endpoints to scan, access the context or response menu and click Scan for Malware.
    The Scan for Malware Task screen appears.
  2. Confirm the targets of the response.
  3. (Optional) Specify a Description for the response or event.
  4. Click Create.
    Trend Vision One creates the task and displays the current task status in Response Management.
  5. Monitor the task status.
    1. Open Response Management.
    2. (Optional) Locate the task using the Search field or by selecting Scan for Malware from the Action drop-down menu.
    3. View the task status.
      • In progress (in-progress.jpg): Trend Vision One sent the command and is waiting for a response.
      • Successful (successful.jpg): The command was successfully executed.
      • Partially successful (partially-successful.jpg): One or more commands was unsuccessful.
      • Manually terminated (rejected.jpg): The command was manually terminated in Response Management.
      • Queued (queued.jpg): The managing server queued the command because the agent was offline.
      • Unsuccessful (error.jpg): An error or time-out occurred when attempting to send the command to the managing server, the agent is offline for more than 24 hours, or the command execution timed out.
        If the task status is Queued (queued.jpg) or Unsuccessful (error.jpg), you can click the Resend command (resendcommand.jpg) icon to immediately send the exact same command to the managing server.
    You may view the task progress or results by clicking on the corresponding task ID in Response Management. To terminate the task, click the options (options-icon.jpg) icon and select Terminate task.