Vulnerability Scanner Online Help

OfficeScan Documentation Parent topic

Related information
  • OfficeScan Documentation
  • Audience
  • Document Conventions
  • Terminology
© 2017 Trend Micro Incorporated. All Rights Reserved.


Trend Micro homepage

OfficeScan Documentation Parent topic

OfficeScan documentation includes the following:

OfficeScan Documentation

Documentation
Description
Installation and Upgrade Guide
A PDF document that discusses requirements and procedures for installing the OfficeScan server, and upgrading the server and agents
Note
Note
The Installation and Upgrade Guide may not be available for minor release versions, service packs, or patches.
System Requirements
A PDF document that outlines the minimal and recommended system requirements for installing the OfficeScan server, and upgrading the server and agents
Administrator's Guide
A PDF document that discusses getting started information, OfficeScan agent installation procedures, and OfficeScan server and agent management
Help
HTML files compiled in WebHelp or CHM format that provide "how to's", usage advice, and field-specific information. The Help is accessible from the OfficeScan server and agent consoles, and from the OfficeScan Master Setup.
Readme file
Contains a list of known issues and basic installation steps. It may also contain late-breaking product information not found in the Help or printed documentation
Knowledge Base
An online database of problem-solving and troubleshooting information. It provides the latest information about known product issues. To access the Knowledge Base, go to the following website:
http://esupport.trendmicro.com
Download the latest version of the PDF documents and readme at:
http://docs.trendmicro.com/en-us/enterprise/officescan.aspx


Audience

Audience Parent topic

OfficeScan documentation is intended for the following users:
  • OfficeScan Administrators: Responsible for OfficeScan management, including the OfficeScan server and OfficeScan agent installation and management. These users are expected to have advanced networking and server management knowledge.
  • End users: Users who have the OfficeScan agent installed on their endpoints. The endpoint skill level of these individuals ranges from beginner to power user.


Document Conventions Parent topic

The documentation uses the following conventions.

Document Conventions

Convention
Description
UPPER CASE
Acronyms, abbreviations, and names of certain commands and keys on the keyboard
Bold
Menus and menu commands, command buttons, tabs, and options
Italics
References to other documents
Monospace
Sample command lines, program code, web URLs, file names, and program output
Navigation → Path
The navigation path to reach a particular screen
For example, File → Save means, click File and then click Save on the interface
Note
Note
Configuration notes
Tip
Tip
Recommendations or suggestions
Important
Important
Information regarding required or default configuration settings and product limitations
WARNING
WARNING
Critical actions and configuration options


Terminology Parent topic

The following table provides the official terminology used throughout the OfficeScan documentation:

OfficeScan Terminology

Terminology
Description
OfficeScan agent
The OfficeScan agent program
Agent endpoint
The endpoint where the OfficeScan agent is installed
Agent user (or user)
The person managing the OfficeScan agent on the agent endpoint
Server
The OfficeScan server program
Server computer
The endpoint where the OfficeScan server is installed
Administrator (or OfficeScan administrator)
The person managing the OfficeScan server
Console
The user interface for configuring and managing OfficeScan server and agent settings
The console for the OfficeScan server program is called "web console", while the console for the OfficeScan agent program is called "agent console".
Security risk
The collective term for virus/malware, spyware/grayware, and web threats
License service
Includes Antivirus, Damage Cleanup Services, and Web Reputation and Anti-spyware—all of which are activated during OfficeScan server installation
OfficeScan service
Services hosted through Microsoft Management Console (MMC). For example, ofcservice.exe, the OfficeScan Master Service.
Program
Includes the OfficeScan agent and Plug-in Manager
Components
Responsible for scanning, detecting, and taking actions against security risks
Agent installation folder
The folder on the endpoint that contains the OfficeScan agent files. If you accept the default settings during installation, you will find the installation folder at any of the following locations:
C:\Program Files\Trend Micro\OfficeScan Client
C:\Program Files (x86)\Trend Micro\OfficeScan Client
Server installation folder
The folder on the endpoint that contains the OfficeScan server files. If you accept the default settings during installation, you will find the installation folder at any of the following locations:
C:\Program Files\Trend Micro\OfficeScan
C:\Program Files (x86)\Trend Micro\OfficeScan
For example, if a particular file is found under \PCCSRV on the server installation folder, the full path to the file is:
C:\Program Files\Trend Micro\OfficeScan\PCCSRV\<file_name>.
Smart scan agent
Any OfficeScan agent that has been configured to use smart scan
Conventional scan agent
Any OfficeScan agent that has been configured to use conventional scan
Dual-stack
Entities that have both IPv4 and IPv6 addresses.
For example:
  • Endpoints with both IPv4 and IPv6 addresses
  • OfficeScan agents installed on dual-stack endpoints
  • Update Agents that distribute updates to agents
  • A dual-stack proxy server, such as DeleGate, can convert between IPv4 and IPv6 addresses
Pure IPv4
An entity that only has an IPv4 address
Pure IPv6
An entity that only has an IPv6 address
Plug-in solutions
Native OfficeScan features and plug-in programs delivered through Plug-in Manager


Vulnerability Scanner Usage

Vulnerability Scanner Usage Parent topic

Use Vulnerability Scanner to detect installed antivirus solutions, search for unprotected computers on the network, and install OfficeScan agents to computers.
Related information
  • Considerations When Using Vulnerability Scanner
  • Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner
  • Vulnerability Scan Methods
  • Vulnerability Scan Settings
  • Server Debug Logs Using LogServer.exe


Considerations When Using Vulnerability Scanner

Considerations When Using Vulnerability Scanner Parent topic

To help you decide whether to use Vulnerability Scanner, consider the following:
  • Network Administration
  • Network Topology and Architecture
  • Software/Hardware Specifications
  • Domain Structure
  • Network Traffic
  • Network Size


Network Administration Parent topic

Network Administration

Setup | Effectiveness of Vulnerability Scanner
Administration with strict security policy | Very effective. Vulnerability Scanner reports whether all computers have antivirus software installed.
Administrative responsibility distributed across different sites | Moderately effective
Centralized administration | Moderately effective
Outsource service | Moderately effective
Users administer their own computers | Not effective. Because Vulnerability Scanner scans the network for antivirus installations, it is not feasible to have users scan their own computers.


Network Topology and Architecture Parent topic

Network Topology and Architecture

Setup | Effectiveness of Vulnerability Scanner
Single location | Very effective. Vulnerability Scanner allows you to scan an entire IP segment and install the OfficeScan agent easily on the LAN.
Multiple locations with high speed connection | Moderately effective
Multiple locations with low speed connection | Not effective. You need to run Vulnerability Scanner on each location and OfficeScan agent installation must be directed to a local OfficeScan server.
Remote and isolated computers | Moderately effective


Software/Hardware Specifications Parent topic

Software/Hardware Specifications

Setup | Effectiveness of Vulnerability Scanner
Windows NT-based operating systems | Very effective. Vulnerability Scanner can easily install the OfficeScan agent remotely to computers running NT-based operating systems.
Mixed operating systems | Moderately effective. Vulnerability Scanner can only install to computers running Windows NT-based operating systems.
Desktop management software | Not effective. Vulnerability Scanner cannot be used with desktop management software. However, it can help track the progress of the OfficeScan agent installation.


Domain Structure Parent topic

Domain Structure

Setup | Effectiveness of Vulnerability Scanner
Microsoft Active Directory | Very effective. Specify the domain administrator account in Vulnerability Scanner to allow remote installation of the OfficeScan agent.
Workgroup | Not effective. Vulnerability Scanner may have difficulty installing to computers using different administrative accounts and passwords.
Novell™ Directory Service | Not effective. Vulnerability Scanner requires a Windows Domain account to install the OfficeScan agent.
Peer-to-peer | Not effective. Vulnerability Scanner may have difficulty installing to computers using different administrative accounts and passwords.


Network Traffic Parent topic

Network Traffic

Setup | Effectiveness of Vulnerability Scanner
LAN connection | Very effective
512 Kbps | Moderately effective
T1 connection and higher | Moderately effective
Dialup | Not effective. It will take a long time to finish installing the OfficeScan agent.


Network Size Parent topic

Network Size

Setup | Effectiveness of Vulnerability Scanner
Very large enterprise | Very effective. The bigger the network, the more Vulnerability Scanner is needed for checking OfficeScan agent installations.
Small and medium business | Moderately effective. For small networks, Vulnerability Scanner can be an option to install the OfficeScan agent. Other OfficeScan agent installation methods may prove much easier to implement.


Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner

Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner Parent topic

Vulnerability Scanner will not install the OfficeScan agent if:
  • The OfficeScan server or another security software is installed on the target host machine.
  • The remote endpoint runs Windows XP Home, Windows 7 Home Basic, Windows 7 Home Premium, Windows 8 (basic versions), Windows 8.1 (basic versions), or Windows 10 Home.
Before using Vulnerability Scanner to install the OfficeScan agent, perform the following steps:
  • For Windows 7 (Professional, Enterprise, Ultimate Edition), Windows 8 (Pro, Enterprise), Windows 8.1 (Pro, Enterprise), Windows 10 (Pro, Education, Enterprise), Windows Server 2012 (all editions), or Windows Server 2016 (all editions):
    1. Enable a built-in administrator account and set the password for the account.
    2. Click Start → Programs → Administrative Tools → Windows Firewall with Advanced Security.
    3. For Domain Profile, Private Profile, and Public Profile, set the firewall state to "Off".
    4. Open Microsoft Management Console (click Start > Run and type services.msc) and start the Remote Registry service. When installing the OfficeScan agent, use the built-in administrator account and password.
  • For Windows XP Professional (32-bit or 64-bit version):
    1. Open Windows Explorer and click Tools > Folder Options.
    2. Click the View tab and disable Use simple file sharing (Recommended).


Vulnerability Scan Methods Parent topic

Vulnerability scan checks the presence of security software on host machines and can install the OfficeScan agent to unprotected host machines.
There are several ways to run vulnerability scan.

Vulnerability Scan Methods

Method
Details
Manual vulnerability scan
Administrators can run vulnerability scans on demand.
DHCP scan
Administrators can run vulnerability scans on host machines requesting IP addresses from a DHCP server.
Vulnerability Scanner listens on port 67, which is the DHCP server’s listening port for DHCP requests. If it detects a DHCP request from a host machine, vulnerability scan runs on the machine.
Note
Note
Vulnerability Scanner is unable to detect DHCP requests if you launched it on Windows Server 2008, Windows 7, Windows 8, Windows 8.1, Windows 10, or Windows Server 2012.
Scheduled vulnerability scan
Vulnerability scans automatically run according to the schedule configured by administrators.
After Vulnerability Scanner runs, it displays the status of the OfficeScan agent on the target host machines. The status can be any of the following:
  • Normal: The OfficeScan agent is up and running and is working properly
  • Abnormal: The OfficeScan agent services are not running or the agent does not have real-time protection
  • Not installed: The TMListen service is missing or the OfficeScan agent has not been installed
  • Unreachable: Vulnerability Scanner was unable to establish connection with the host machine and determine the status of the OfficeScan agent
Related information
  • Running a Manual Vulnerability Scan
  • Running a DHCP Scan
  • Configuring a Scheduled Vulnerability Scan


Running a Manual Vulnerability Scan

Running a Manual Vulnerability Scan Parent topic

Procedure

  1. To run a vulnerability scan on the OfficeScan server computer, navigate to <Server installation folder>\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears. To run vulnerability scan on another endpoint running Windows Server 2003, Server 2008, 7, 8, 8.1, 10, or Server 2012/2016:
    1. On the OfficeScan server computer, go to <Server installation folder>\PCCSRV\Admin\Utility.
    2. Copy the TMVS folder to the other endpoint.
    3. On the other endpoint, open the TMVS folder and then double-click TMVS.exe.
      The Trend Micro Vulnerability Scanner console appears.
    Note
    Note
    You cannot launch the tool from Terminal Server.
  2. Go to the Manual Scan section.
  3. Type the IP address range of the endpoints you want to check.
    1. Type an IPv4 address range.
      Note
      Note
      Vulnerability Scanner can only query an IPv4 address range if it runs on a pure IPv4 or dual-stack host machine. Vulnerability Scanner only supports a class B IP address range, for example, 168.212.1.1 to 168.212.254.254.
    2. For an IPv6 address range, type the IPv6 prefix and length.
      Note
      Note
      Vulnerability Scanner can only query an IPv6 address range if it runs on a pure IPv6 or dual-stack host machine.
  4. Click Settings.
    The Settings screen appears.
  5. Configure the following settings:
    Option Description
    Ping settings
    Vulnerability Scan can "ping" the IP addresses specified in the previous step to check if they are currently in use. If a target host machine is using an IP address, Vulnerability Scanner can determine the host machine's operating system.
    For details, see Ping Settings.
    Method for retrieving computer descriptions
    For host machines that respond to the "ping" command, Vulnerability Scanner can retrieve additional information about the host machines.
    For details, see Method for Retrieving Endpoint Descriptions.
    Product query
    Vulnerability Scanner can check for the presence of security software on the target host machines.
    For details, see Product Query.
    OfficeScan server settings
    Configure these settings if you want Vulnerability Scanner to automatically install OfficeScan agent to unprotected host machines. These settings identify the parent server and the administrative credentials used by the OfficeScan agent to log on to the host machines.
    For details, see OfficeScan Server Settings.
    Note
    Note
    Certain conditions may prevent the installation of the OfficeScan agent to the target host machines.
    For details, see Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner.
    Notifications
    Vulnerability Scanner can send the vulnerability scan results to OfficeScan administrators. It can also display notifications on unprotected host machines.
    For details, see Notifications.
    Save results
    In addition to sending the vulnerability scan results to administrators, Vulnerability Scan can also save the results to a .csv file.
    For details, see Vulnerability Scan Results.
  6. Click OK.
  7. Click Start.
    The vulnerability scan results appear in the Results table under the Manual Scan tab.
    Note
    Note
    MAC address information does not display in the Results table if the endpoint runs Windows Server 2008 or Windows Server 2012.
  8. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.


Running a DHCP Scan

Running a DHCP Scan Parent topic

Procedure

  1. Configure DHCP settings in the TMVS.ini file found under the following folder: <Server installation folder>\PCCSRV\Admin\Utility\TMVS.

    DHCP Settings in the TMVS.ini File

    Setting
    Description
    DhcpThreadNum=x
    Specify the thread number for DHCP mode. The minimum is 3, the maximum is 100. The default value is 8.
    DhcpDelayScan=x
    This is the delay time in seconds before checking the requesting endpoint for installed antivirus software.
    The minimum is 0 (do not wait) and the maximum is 600. The default value is 30.
    LogReport=x
    0 disables logging, 1 enables logging.
    Vulnerability Scanner sends the results of the scan to the OfficeScan server. Logs display in the System Event Logs screen on the web console.
    OsceServer=x
    This is the OfficeScan server's IP address or DNS name.
    OsceServerPort=x
    This is the web server port on the OfficeScan server.
  2. To run a vulnerability scan on the OfficeScan server computer, navigate to <Server installation folder>\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears. To run vulnerability scan on another endpoint running Windows Server 2003, Server 2008, 7, 8, 8.1, 10, or Server 2012/2016:
    1. On the OfficeScan server computer, go to <Server installation folder>\PCCSRV\Admin\Utility.
    2. Copy the TMVS folder to the other endpoint.
    3. On the other endpoint, open the TMVS folder and then double-click TMVS.exe.
      The Trend Micro Vulnerability Scanner console appears.
    Note
    Note
    You cannot launch the tool from Terminal Server.
  3. Under the Manual Scan section, click Settings.
    The Settings screen appears.
  4. Configure the following settings:
    Option Description
    Product query
    Vulnerability Scanner can check for the presence of security software on the target host machines.
    For details, see Product Query.
    OfficeScan server settings
    Configure these settings if you want Vulnerability Scanner to automatically install OfficeScan agent to unprotected host machines. These settings identify the parent server and the administrative credentials used by the OfficeScan agent to log on to the host machines.
    For details, see OfficeScan Server Settings.
    Note
    Note
    Certain conditions may prevent the installation of the OfficeScan agent to the target host machines.
    For details, see Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner.
    Notifications
    Vulnerability Scanner can send the vulnerability scan results to OfficeScan administrators. It can also display notifications on unprotected host machines.
    For details, see Notifications.
    Save results
    In addition to sending the vulnerability scan results to administrators, Vulnerability Scan can also save the results to a .csv file.
    For details, see Vulnerability Scan Results.
  5. Click OK.
  6. In the Results table, click the DHCP Scan tab.
    Note
    Note
    The DHCP Scan tab is not available on computers running Windows Server 2008, Windows 7, Windows 8, Windows 8.1, Windows 10, and Windows Server 2012.
  7. Click Start.
    Vulnerability Scanner begins listening for DHCP requests and performing vulnerability checks on computers as they log on to the network.
  8. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.


Configuring a Scheduled Vulnerability Scan

Configuring a Scheduled Vulnerability Scan Parent topic

Procedure

  1. To run a vulnerability scan on the OfficeScan server computer, navigate to <Server installation folder>\PCCSRV\Admin\Utility\TMVS and double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears. To run vulnerability scan on another endpoint running Windows Server 2003, Server 2008, 7, 8, 8.1, 10, or Server 2012/2016:
    1. On the OfficeScan server computer, go to <Server installation folder>\PCCSRV\Admin\Utility.
    2. Copy the TMVS folder to the other endpoint.
    3. On the other endpoint, open the TMVS folder and then double-click TMVS.exe.
      The Trend Micro Vulnerability Scanner console appears.
    Note
    Note
    You cannot launch the tool from Terminal Server.
  2. Go to the Scheduled Scan section.
  3. Click Add/Edit.
    The Scheduled Scan screen appears.
  4. Type a name for the scheduled vulnerability scan.
  5. Type the IP address range of the endpoints you want to check.
    1. Type an IPv4 address range.
      Note
      Note
      Vulnerability Scanner can only query an IPv4 address range if it runs on a pure IPv4 or dual-stack host machine. Vulnerability Scanner only supports a class B IP address range, for example, 168.212.1.1 to 168.212.254.254.
    2. For an IPv6 address range, type the IPv6 prefix and length.
      Note
      Note
      Vulnerability Scanner can only query an IPv6 address range if it runs on a pure IPv6 or dual-stack host machine.
  6. Specify the start time for the Schedule using the 24-hour clock format and then select how often the scan will run. Choose from daily, weekly, or monthly.
  7. Select which set of vulnerability scan settings to use.
    1. Select Use current settings if you have configured and want to use manual vulnerability scan settings.
      For details about manual vulnerability scan settings, see Running a Manual Vulnerability Scan.
    2. If you did not specify manual vulnerability scan settings or if you want to use another set of settings, select Modify settings and then click Settings.
      The Settings screen appears.
    3. Configure the following settings:
      Ping settings
      Vulnerability Scan can "ping" the IP addresses specified in the previous step to check if they are currently in use. If a target host machine is using an IP address, Vulnerability Scanner can determine the host machine's operating system.
      For details, see Ping Settings.
      Method for retrieving computer descriptions
      For host machines that respond to the "ping" command, Vulnerability Scanner can retrieve additional information about the host machines.
      For details, see Method for Retrieving Endpoint Descriptions.
      Product query
      Vulnerability Scanner can check for the presence of security software on the target host machines.
      For details, see Product Query.
      OfficeScan server settings
      Configure these settings if you want Vulnerability Scanner to automatically install OfficeScan agent to unprotected host machines. These settings identify the parent server and the administrative credentials used by the OfficeScan agent to log on to the host machines.
      For details, see OfficeScan Server Settings.
      Note
      Note
      Certain conditions may prevent the installation of the OfficeScan agent to the target host machines.
      For details, see Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner.
      Notifications
      Vulnerability Scanner can send the vulnerability scan results to OfficeScan administrators. It can also display notifications on unprotected host machines.
      For details, see Notifications.
      Save results
      In addition to sending the vulnerability scan results to administrators, Vulnerability Scan can also save the results to a .csv file.
      For details, see Vulnerability Scan Results.
  8. Click OK.
    The Scheduled Scan screen closes. The scheduled vulnerability scan you created appears under the Scheduled Scan section. If you enabled notifications, Vulnerability Scanner sends you the scheduled vulnerability scan results.
  9. To execute the scheduled vulnerability scan immediately, click Run Now.
    The vulnerability scan results appear in the Results table under the Scheduled Scan tab.
    Note
    Note
    MAC address information does not display in the Results table if the endpoint runs Windows Server 2008 or Windows Server 2012.
  10. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.


Vulnerability Scan Settings

Vulnerability Scan Settings Parent topic

Vulnerability scan settings are configured from Trend Micro Vulnerability Scanner (TMVS.exe) or from the TMVS.ini file.
Note
Note
See Server Debug Logs Using LogServer.exe for information on how to collect debug logs for Vulnerability Scanner.
Related information
  • Product Query
  • Method for Retrieving Endpoint Descriptions
  • Notifications
  • Vulnerability Scan Results
  • Ping Settings
  • OfficeScan Server Settings


Product Query

Product Query Parent topic

Vulnerability Scanner can check for the presence of security software on agents. The following table discusses how Vulnerability Scanner checks security products:

Security Products Checked by Vulnerability Scanner

Product
Description
ServerProtect for Windows
Vulnerability Scanner uses RPC endpoint to check if SPNTSVC.exe is running. It returns information including operating system, and Virus Scan Engine, Virus Pattern and product versions. Vulnerability Scanner cannot detect the ServerProtect Information Server or the ServerProtect Management Console.
ServerProtect for Linux
If the target endpoint does not run Windows, Vulnerability Scanner checks if it has ServerProtect for Linux installed by trying to connect to port 14942.
OfficeScan agent
Vulnerability Scanner uses the OfficeScan agent port to check if the OfficeScan agent is installed. It also checks if the TmListen.exe process is running. It retrieves the port number automatically if executed from its default location.
If you launched Vulnerability Scanner on any endpoint other than the OfficeScan server, check and then use the other endpoint's communication port.
PortalProtect™
Vulnerability Scanner loads the web page http://localhost:port/PortalProtect/index.html to check for product installation.
ScanMail™ for Microsoft Exchange™
Vulnerability Scanner loads the web page http://ipaddress:port/scanmail.html to check for ScanMail installation. By default, ScanMail uses port 16372. If ScanMail uses a different port number, specify the port number. Otherwise, Vulnerability Scanner cannot detect ScanMail.
InterScan™ family
Vulnerability Scanner loads each web page for different products to check for product installation.
  • InterScan Messaging Security Suite 5.x: http://localhost:port/eManager/cgi-bin/eManager.htm
  • InterScan eManager 3.x: http://localhost:port/eManager/cgi-bin/eManager.htm
  • InterScan VirusWall™ 3.x: http://localhost:port/InterScan/cgi-bin/interscan.dll
Trend Micro Internet Security™ (PC-cillin)
Vulnerability Scanner uses port 40116 to check if Trend Micro Internet Security is installed.
McAfee VirusScan ePolicy Orchestrator
Vulnerability Scanner sends a special token to TCP port 8081, the default port of ePolicy Orchestrator for providing connection between the server and agent. The endpoint with this antivirus product replies using a special token type. Vulnerability Scanner cannot detect the standalone McAfee VirusScan.
Norton Antivirus™ Corporate Edition
Vulnerability Scanner sends a special token to UDP port 2967, the default port of Norton Antivirus Corporate Edition RTVScan. The endpoint with this antivirus product replies using a special token type. Since Norton Antivirus Corporate Edition communicates by UDP, the accuracy rate is not guaranteed. Furthermore, network traffic may influence UDP waiting time.
Vulnerability Scanner detects products and computers using the following protocols:
  • RPC: Detects ServerProtect for NT
  • UDP: Detects Norton AntiVirus Corporate Edition clients
  • TCP: Detects McAfee VirusScan ePolicy Orchestrator
  • ICMP: Detects computers by sending ICMP packets
  • HTTP: Detects OfficeScan agents
  • DHCP: If it detects a DHCP request, Vulnerability Scanner checks if antivirus software has already been installed on the requesting endpoint.
Related information
  • Configuring Product Query Settings


Configuring Product Query Settings

Configuring Product Query Settings Parent topic

Product query settings are a subset of vulnerability scan settings. For details about vulnerability scan settings, see Vulnerability Scan Methods.

Procedure

  1. To specify product query settings from Vulnerability Scanner (TMVS.exe):
    1. Launch TMVS.exe.
    2. Click Settings.
      The Settings screen appears.
    3. Go to the Product query section.
    4. Select the products to check.
    5. Click Settings next to a product name and then specify the port number that Vulnerability Scanner will check.
    6. Click OK.
      The Settings screen closes.
  2. To set the number of computers that Vulnerability Scanner simultaneously checks for security software:
    1. Go to <Server installation folder>\PCCSRV\Admin\Utility\TMVS and open TMVS.ini using a text editor such as Notepad.
    2. To set the number of computers checked during manual vulnerability scans, change the value for ThreadNumManual. Specify a value between 8 and 64.
      For example, type ThreadNumManual=60 if you want Vulnerability Scanner to check 60 computers at the same time.
    3. To set the number of computers checked during scheduled vulnerability scans, change the value for ThreadNumSchedule. Specify a value between 8 and 64.
      For example, type ThreadNumSchedule=50 if you want Vulnerability Scanner to check 50 computers at the same time.
    4. Save TMVS.ini.


Method for Retrieving Endpoint Descriptions

Method for Retrieving Endpoint Descriptions Parent topic

When Vulnerability Scanner is able to "ping" host machines, it can retrieve additional information about the host machines. There are two methods for retrieving information:
  • Quick retrieval: Retrieves only the endpoint name
  • Normal retrieval: Retrieves both domain and endpoint information
Related information
  • Configuring Retrieval Settings


Configuring Retrieval Settings

Configuring Retrieval Settings Parent topic

Retrieval settings are a subset of vulnerability scan settings. For details about vulnerability scan settings, see Vulnerability Scan Methods.

Procedure

  1. Launch TMVS.exe.
  2. Click Settings.
    The Settings screen appears.
  3. Go to the Method for retrieving computer descriptions section.
  4. Select Normal or Quick.
  5. If you selected Normal, select Retrieve computer descriptions when available.
  6. Click OK.
    The Settings screen closes.


Notifications

Notifications Parent topic

Vulnerability Scanner can send the vulnerability scan results to OfficeScan administrators. It can also display notifications on unprotected host machines.
Related information
  • Configuring Notification Settings


Configuring Notification Settings

Configuring Notification Settings Parent topic

Notification settings are a subset of vulnerability scan settings. For details about vulnerability scan settings, see Vulnerability Scan Methods.

Procedure

  1. Launch TMVS.exe.
  2. Click Settings.
    The Settings screen appears.
  3. Go to the Notifications section.
  4. To automatically send the Vulnerability Scan results to yourself or to other administrators in your organization:
    1. Select Email results to the system administrator.
    2. Click Configure to specify email settings.
    3. In To, type the email address of the recipient.
    4. In From, type the email address of the sender.
    5. In SMTP server, type the SMTP server address.
      For example, type smtp.company.com. The SMTP server information is required.
    6. In Subject, type a new subject for the message or accept the default subject.
    7. Click OK.
  5. To inform users that their computers do not have security software installed:
    1. Select Display a notification on unprotected computers.
    2. Click Customize to configure the notification message.
    3. In the Notification Message screen, type a new message or accept the default message.
    4. Click OK.
  6. Click OK.
    The Settings screen closes.


Vulnerability Scan Results

Vulnerability Scan Results Parent topic

You can configure Vulnerability Scanner to save the vulnerability scan results to a comma-separated value (CSV) file.
Related information
  • Configuring Scan Results


Configuring Scan Results

Configuring Scan Results Parent topic

Vulnerability scan results settings are a subset of vulnerability scan settings. For details about vulnerability scan settings, see Vulnerability Scan Methods.

Procedure

  1. Launch TMVS.exe.
  2. Click Settings.
    The Settings screen appears.
  3. Go to the Save results section.
  4. Select Automatically save the results to a CSV file.
  5. To change the default folder for saving the CSV file:
    1. Click Browse.
    2. Select a target folder on the endpoint or on the network.
    3. Click OK.
  6. Click OK.
    The Settings screen closes.


Ping Settings

Ping Settings Parent topic

Use "ping" settings to validate the existence of a target machine and determine its operating system. If these settings are disabled, Vulnerability Scanner scans all the IP addresses in the specified IP address range – even those that are not used on any host machine – thereby making the scanning attempt longer than it should be.
Related information
  • Configuring Ping Settings


Configuring Ping Settings

Configuring Ping Settings Parent topic

Ping settings are a subset of vulnerability scan settings. For details about vulnerability scan settings, see Vulnerability Scan Methods.

Procedure

  1. To specify ping settings from Vulnerability Scanner (TMVS.exe):
    1. Launch TMVS.exe.
    2. Click Settings.
      The Settings screen appears.
    3. Go to the Ping settings section.
    4. Select Allow Vulnerability Scanner to ping computers on your network to check their status.
    5. In the Packet size and Timeout fields, accept or modify the default values.
    6. Select Detect the type of operating system using ICMP OS fingerprinting.
      If you select this option, Vulnerability Scanner determines if a host machine runs Windows or another operating system. For host machines running Windows, Vulnerability Scanner can identify the version of Windows.
    7. Click OK.
      The Settings screen closes.
  2. To set the number of computers that Vulnerability Scanner simultaneously pings:
    1. Go to <Server installation folder>\PCCSRV\Admin\Utility\TMVS and open TMVS.ini using a text editor such as Notepad.
    2. Change the value for EchoNum. Specify a value between 1 and 64.
      For example, type EchoNum=60 if you want Vulnerability Scanner to ping 60 computers at the same time.
    3. Save TMVS.ini.


OfficeScan Server Settings

OfficeScan Server Settings Parent topic

OfficeScan server settings are used when:
  • Vulnerability Scanner installs the OfficeScan agent to unprotected target machines. Server settings allow Vulnerability Scanner to identify the OfficeScan agent’s parent server and the administrative credentials to use when logging on to the target machines.
    Note
    Note
    Certain conditions may prevent the installation of the OfficeScan agent to the target host machines.
    For details, see Guidelines When Installing the OfficeScan Agent Using Vulnerability Scanner.
  • Vulnerability Scanner sends agent installation logs to the OfficeScan server.
Related information
  • Configuring OfficeScan Server Settings


Configuring OfficeScan Server Settings

Configuring OfficeScan Server Settings Parent topic

OfficeScan server settings are a subset of vulnerability scan settings. For details about vulnerability scan settings, see Vulnerability Scan Methods.

Procedure

  1. Launch TMVS.exe.
  2. Click Settings.
    The Settings screen appears.
  3. Go to the OfficeScan server settings section.
  4. Type the OfficeScan server name and port number.
  5. Select Auto-install OfficeScan agent on unprotected computers.
  6. To configure the administrative credentials:
    1. Click Install to Account.
    2. In the Account Information screen, type a user name and password.
    3. Click OK.
  7. Select Send logs to the OfficeScan server.
  8. Click OK.
    The Settings screen closes.


Server Debug Logs Using LogServer.exe

Server Debug Logs Using LogServer.exe Parent topic

Use LogServer.exe to collect debug logs for the following:
  • OfficeScan server basic logs
  • Trend Micro Vulnerability Scanner
  • Active Directory integration logs
  • Agent grouping logs
  • Security compliance logs
  • Role-based administration
  • Smart scan
Related information
  • Enabling Debug Logging
  • Disabling Debug Logging
  • Enabling Debug Logging for Server Installation and Upgrade


Enabling Debug Logging

Enabling Debug Logging Parent topic

Procedure

  1. Log on to the web console.
  2. On the banner of the web console, click the first "O" in "OfficeScan".
  3. Select Enable debug log.
  4. Specify debug log settings.
  5. Click Save.
  6. Check the log file (ofcdebug.log) in the default location: <Server installation folder>\PCCSRV\Log.


Disabling Debug Logging

Disabling Debug Logging Parent topic

Procedure

  1. Log on to the web console.
  2. On the banner of the web console, click the first "O" in "OfficeScan".
  3. Clear Enable debug log.
  4. Click Save.


Enabling Debug Logging for Server Installation and Upgrade

Enabling Debug Logging for Server Installation and Upgrade Parent topic

Enable debug logging before performing the following tasks:
  • Uninstall and then install the server again.
  • Upgrade OfficeScan to a new version.
  • Perform remote installation/upgrade (Debug logging is enabled on the endpoint where you launched Setup and not on the remote endpoint.)

Procedure

  1. Copy the LogServer folder located in <Server installation folder>\PCCSRV\Private to C:\.
  2. Create a file named ofcdebug.ini with the following content:
    [debug]
    debuglevel=9
    debuglog=c:\LogServer\ofcdebug.log
    debugLevel_new=D
    debugSplitSize=10485760
    debugSplitPeriod=12
    debugRemoveAfterSplit=1
  3. Save ofcdebug.ini to C:\LogServer.
  4. Perform the appropriate task (that is, uninstall/reinstall the server, upgrade to a new server version, or perform remote installation/upgrade).
  5. Check ofcdebug.log in C:\LogServer.


Technical Support

Technical Support Parent topic

Learn about the following topics:
  • Troubleshooting Resources
  • Contacting Trend Micro
  • Sending Suspicious Content to Trend Micro
  • Other Resources


Troubleshooting Resources

Troubleshooting Resources Parent topic

Before contacting technical support, consider visiting the following Trend Micro online resources.
Related information
  • Using the Support Portal
  • Threat Encyclopedia


Using the Support Portal

Using the Support Portal Parent topic

The Trend Micro Support Portal is a 24x7 online resource that contains the most up-to-date information about both common and unusual problems.

Procedure

  1. Go to http://esupport.trendmicro.com.
  2. Select from the available products or click the appropriate button to search for solutions.
  3. Use the Search Support box to search for available solutions.
  4. If no solution is found, click Contact Support and select the type of support needed.
    Tip
    Tip
    To submit a support case online, visit the following URL:
    http://esupport.trendmicro.com/srf/SRFMain.aspx
    A Trend Micro support engineer investigates the case and responds in 24 hours or less.


Threat Encyclopedia

Threat Encyclopedia Parent topic

Most malware today consists of blended threats, which combine two or more technologies, to bypass computer security protocols. Trend Micro combats this complex malware with products that create a custom defense strategy. The Threat Encyclopedia provides a comprehensive list of names and symptoms for various blended threats, including known malware, spam, malicious URLs, and known vulnerabilities.
Go to http://about-threats.trendmicro.com/us/threatencyclopedia#malware to learn more about:
  • Malware and malicious mobile code currently active or "in the wild"
  • Correlated threat information pages to form a complete web attack story
  • Internet threat advisories about targeted attacks and security threats
  • Web attack and online trend information
  • Weekly malware reports


Contacting Trend Micro

Contacting Trend Micro Parent topic

In the United States, Trend Micro representatives are available by phone or email:
Address | Trend Micro, Incorporated 225 E. John Carpenter Freeway, Suite 1500 Irving, Texas 75062 U.S.A.
Phone | Phone: +1 (817) 569-8900 Toll-free: (888) 762-8736
Website | http://www.trendmicro.com
Email address | support@trendmicro.com
  • Worldwide support offices:
    http://www.trendmicro.com/us/about-us/contact/index.html
  • Trend Micro product documentation:
    http://docs.trendmicro.com
Related information
  • Speeding Up the Support Call


Speeding Up the Support Call

Speeding Up the Support Call Parent topic

To improve problem resolution, have the following information available:
  • Steps to reproduce the problem
  • Appliance or network information
  • Computer brand, model, and any additional connected hardware or devices
  • Amount of memory and free hard disk space
  • Operating system and service pack version
  • Version of the installed agent
  • Serial number or Activation Code
  • Detailed description of install environment
  • Exact text of any error message received


Sending Suspicious Content to Trend Micro

Sending Suspicious Content to Trend Micro Parent topic

Several options are available for sending suspicious content to Trend Micro for further analysis.
Related information
  • Email Reputation Services
  • File Reputation Services
  • Web Reputation Services


Email Reputation Services

Email Reputation Services Parent topic

Query the reputation of a specific IP address and nominate a message transfer agent for inclusion in the global approved list:
https://ers.trendmicro.com/
Refer to the following Knowledge Base entry to send message samples to Trend Micro:
http://esupport.trendmicro.com/solution/en-US/1112106.aspx


File Reputation Services

File Reputation Services Parent topic

Gather system information and submit suspicious file content to Trend Micro:
http://esupport.trendmicro.com/solution/en-us/1059565.aspx
Record the case number for tracking purposes.


Web Reputation Services

Web Reputation Services Parent topic

Query the safety rating and content type of a URL suspected of being a phishing site, or other so-called "disease vector" (the intentional source of Internet threats such as spyware and malware):
http://global.sitesafety.trendmicro.com/
If the assigned rating is incorrect, send a re-classification request to Trend Micro.


Other Resources

Other Resources Parent topic

In addition to solutions and support, there are many other helpful resources available online to stay up to date, learn about innovations, and be aware of the latest security trends.
Related information
  • Download Center
  • Documentation Feedback


Download Center

Download Center Parent topic

From time to time, Trend Micro may release a patch for a reported known issue or an upgrade that applies to a specific product or service. To find out whether any patches are available, go to:
http://www.trendmicro.com/download/
If a patch has not been applied (patches are dated), open the Readme file to determine whether it is relevant to your environment. The Readme file also contains installation instructions.


Documentation Feedback

Documentation Feedback Parent topic

Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please go to the following site:
http://www.trendmicro.com/download/documentation/rating.asp


Index

© 2017 Trend Micro Incorporated. All Rights Reserved.