1. K-State Home >
2. K-State Antivirus >
3. Trend Micro OfficeScan - Frequently asked questions

OfficeScan taskbar icons

What do the various OfficeScan icons in the taskbar mean?

Icon	Description	Real-time Scan Status	Manual/Scheduled Scan Status
	OfficeScan operating in connected mode.	Enabled	Enabled
	OfficeScan operating in connected mode but the pattern file is outdated.	Enabled	Enabled
	Scan Now, manual scan, or scheduled scan is running.	Enabled	Enabled
	OfficeScan operating in connected mode but the real-time scan feature has been disabled.	Disabled	Enabled
	OfficeScan operating in connected mode but the real-time scan feature has been disabled and the pattern file is outdated.	Disabled	Enabled
	OfficeScan operating in connected mode but the real-time scan service is not running.	Disabled	Disabled
	OfficeScan operating in connected mode but the real-time scan service is not running and the pattern file is outdated.	Disabled	Disabled
	OfficeScan operating in disconnected mode.	Enabled	Enabled
	OfficeScan operating in disconnected mode but the pattern file is outdated.	Enabled	Enabled
	Client operating in disconnected mode but the real-time scan feature has been disabled.	Disabled	Enabled
	OfficeScan operating in disconnected mode but the real-time scan feature has been disabled and the pattern file is outdated.	Disabled	Enabled
	OfficeScan operating in disconnected mode but the real-time scan service is not running.	Disabled	Disabled
	OfficeScan operating in disconnected mode but the real-time scan service is not running and the pattern file is outdated.	Disabled	Disabled
	OfficeScan operating in roaming mode.	Enabled	Enabled
	OfficeScan operating in roaming mode but the pattern file is outdated.	Enabled	Enabled
	OfficeScan operating in roaming mode but the real-time scan feature has been disabled.	Disabled	Enabled
	OfficeScan operating in roaming mode but the real-time scan feature has been disabled and the pattern file is outdated.	Disabled	Enabled
	OfficeScan operating in roaming mode but the real-time scan service is not running.	Disabled	Disabled
	OfficeScan operating in roaming mode but the real-time scan service is not running and the pattern file is outdated.	Disabled	Disabled

OfficeScan processes

What processes are associated with OfficeScan?
The table below describes the processes and services associated with OfficeScan 7.3:

Process/Service	Description
OfficeScanNT Listener	Service that communicates with the OfficeScan / OfficeScan server to retrieve updates, report status, etc.
OfficeScanNT	Service that enables the firewall features of OfficeScan program.

Scan exclusions

Should I set any exclusions for my scans?
Yes. Please see the Detailed Exclusion List (PDF) for specifics.

Installing and uninstalling OfficeScan

What do I do when I'm installing OfficeScan and I get this error: "C:\Windows\system32\AUTOEXEC.NT The system file is not suitable for running MS-DOS and Microsoft Windows applications"?
This may indicate a corrupt AUTOEXEC.NT file. You should do the following:

1. On your desktop, double-click My Computer.
2. Navigate to the C:\WINDOWS\Repair folder. If you have installed Windows in a location other than C:\WINDOWS, navigate there instead.
   
   Note: You may have to click Show the contents of this folder in Windows XP.
   
   
3. Right-click the AUTOEXEC.NT file and then click Copy.
4. Navigate to the C:\WINDOWS\System32 folder.
5. On the Edit menu, click Paste.
6. Click Yes if you are prompted to replace the existing file.

What do I do if the OfficeScan Setup Wizard runs but it never installs OfficeScan and fails to complete successfully?
This may indicate a corrupt AUTOEXEC.NT file. See the above FAQ to fix this problem.

Will OfficeScan interfere with Windows Defender, Ad Aware, or Spybot?
OfficeScan should not interfere with the Ad Aware or Spybot software packages. You can continue to use Ad Aware and Spybot as supplemental spyware protection if you wish; however, OfficeScan has spyware protection built into it as well. Windows Defender will prompt you to approve application changes during the installation of OfficeScan, but should also continue to function normally after OfficeScan is installed.

How do I uninstall the software from my PC?
Follow the instructions to uninstall K-State antivirus software. (To access that page, a K-State eID and password is required.)

Updating OfficeScan

How do I configure automatic scheduled updates?
Updates are automatically received once they are available at the server unless OfficeScan is behind a firewall that blocks incoming TCP port 8080.

How do I know if my pattern files are up to date?
If your pattern files are more than a week old, the OfficeScan system tray icon will change to include an exclamation point in it. You can find out the date of your pattern files by doing the following:

1. Right-click the OfficeScan icon in the system tray and then choose OfficeScan Main.
2. On the Help menu, click About.
   
   The Component information section contains the date the pattern files were last updated. This should typically be within the last 1 to 3 days.

How do I force an update?
If you want to force OfficeScan to check for updates, do the following:

• Right-click the OfficeScan icon in the system tray and then choose Update Now.
  
  Note: If your system requires a proxy to access the Internet, enter the appropriate information and then click Update Now to perform the update.

What do I do when I'm attempting a manual update and receive this error: "Unable to connect to the server. There may be a problem with the server or network, or the proxy information is incorrect."?
This error can occur for several reasons:

• Your computer does not have internet connectivity.
  Check to make sure your internet connection is working properly.
• Your computer has been turned off for an extended period of time and was removed from the management server due to inactivity.
  If your computer does not report back to the management server for a period of 30 or more days, it is assumed that the computer is no longer active, and its entry will be removed from the server. To fix the problem, do the following:
  1. Click Start and then click Control Panel (you may have to point to Settings before clicking Control Panel).
  2. Double-click Administrative Tools.
  3. Double-click Services.
  4. Click OfficeScan Listener service.
  5. Click Restart the service link and then wait 15 minutes. Your computer should be re-added to the management server and updates should begin working again.
• You have a firewall turned on that does not allow outgoing access to the management server.
  If you have firewall software such as AOL firewall or Zone Alarm installed on your computer, or if you have enabled the OfficeScan firewall feature in High security mode, you should make sure that outgoing TCP connections on ports 80 and 443 are allowed to the OfficeScan server you are connecting to.
• The OfficeScan server to which your copy of OfficeScan reports is down.
  Periodically, an OfficeScan server may go offline if it needs to be rebooted for updates or maintenance. If the server appears to be down for more than 30 minutes, you should contact your system administrator or the IT Help Desk for additional help.

How do I manually update my pattern files?
If your computer does not have internet connectivity, or if you wish to manually update the pattern files for OfficeScan from a CD or other media, follow these steps:

1. Download the latest virus pattern files and spyware pattern files from the Trend Micro website.
   
   Note: Be sure to download the Official Pattern Release files only.
   
   
2. Copy the files to the appropriate media or computer.
3. Click Start and then click Control Panel (you may have to point to Settings before clicking Control Panel).
4. Double-click Administrative Tools.
5. Double-click Services.
6. Click OfficeScan Listener service.
7. Click the Stop the service link.
8. Click OfficeScanNT RealTime Scan.
9. Click the Stop the service link.
10. Unzip the files to the installation folder of the OfficeScan software, typically C:\Program Files\Trend Micro\OfficeScan Client.
    
    Note: The files should be named something similar to TMAPTN.??? and LPT$VPN.???, where the question marks represent the pattern versions.
    
    
11. Repeat steps 3-8 above except instead of clicking the Stop the services link, click Restart the service link to start the OfficeScan services back up.

Configuring OfficeScan

How do the POP3 and Outlook mail scanning features work?
When you download e-mail from your server using POP3, typically messages are written into a single database mailbox file or a file for each mail folder. Mail messages themselves are not written to individual files. The POP3 scanning feature of the OfficeScan client allows you to scan the actual text content of your POP3 messages as they are read and/or retrieved from the server. The POP3 mail scanning feature is currently only compatible with Outlook Express and Eudora and will not work with SSL-enabled POP connections, APOP connections, or Secure Password Authentication (SPA) in Outlook Express.

The Outlook mail scan feature simply scans the mail messages in your Personal Folders, which either reside locally on your computer or on your Exchange server. Outlook mail scanning does not occur in real-time meaning that you must perform a manual scan on the messages. Your mail server should be protected by antivirus software already, so the Outlook scanning simply provides a secondary layer of protection. Any attachments or files that are written locally to disk will be scanned by the OfficeScan real-time scanning engine.

The POP3 scanning feature is not available for my mail program. Am I still protected from viruses?
Yes. The vast majority of viruses that spread via e-mail come either as an attachment or attempt to obtain information by redirecting a user to a website to enter personal information, a process known as phishing. Although the actual text content of your messages may not be getting scanned, any attachment or file that is downloaded to your local disk will be scanned by the OfficeScan real-time scanning engine. This protects your system from attack. The POP3 scanning feature just gives you an additional layer of security and provides somewhat of a "double" check for viruses.

Is mail scanning available for IMAP connections?
Real-time mail scanning is only available for POP3 connections. If you are using Outlook, you can use the Outlook scanning feature to manually scan any of your Personal Folders, regardless of whether or not you use POP3, IMAP, or Exchange.

Although no additional scanning is available for other IMAP programs, any attachments from e-mail messages that are written locally to disk will be scanned by the real-time scanning engine. This allows your computer to remain protected even though the actual text content of your messages is not being scanned by OfficeScan.

How do I find out what server my computer is reporting to?
To determine the server your computer is reporting to, perform the following steps:

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. On the Help menu, click About.
   
   The Communication information section contains the Server name/port that your computer reports to.

What is roaming mode and how do I enable or disable it?
Roaming mode computers will only get pattern updates from the server when the updates are manually deployed by an administrator or when a normally scheduled update occurs. They do not receive any other notifications from the server. This mode is typically used for laptop users on low bandwidth, dial-in, or wireless connections who only wish to receive the absolute minimum communication from the server.

To enable or disable roaming mode:

1. Right-click the OfficeScan Client icon in the system tray and then click OfficeScan Main.
2. Click Enable Roaming Mode.
   
   To switch back to normal mode, choose Disable Roaming Mode.

How do I know if my Real-Time Scan Monitor is running?
The scan monitor is running if the OfficeScan icon in the System Tray has a blue background, with a yellow line through it. If no icon is displayed, or your icon has a solid red background, Real-Time protection is not running. Contact your IT personnel.

Running Scans

How do I start a manual scan?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. Select the drive you want to scan.
3. Click the Scan button.

How do I view my scan results after a manual scan?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. Click the Scan Results tab.

How do I change Real-Time scan settings?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. On the Options menu, click Real-Time Scan.

How do I change the Scheduled Scan settings?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. On the Options menu, click Scheduled Scan.

How do I change Manual Scan settings?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. On the Options menu, click Manual Scan.

What is Damage Cleanup Services and how do I use it?
Damage Cleanup Services (DCS) removes spyware, worms, virus remnants, Trojans, and memory registries on computers and servers that typical antivirus scan engines do not detect. In addition to clean up, it repairs computer registries and memory to decrease the administrative labor, recovery time, and costs of outbreaks. To use DCS, do the following:

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. Click the Clean button.

Intrusion detection and firewall

What does the IDS feature of OfficeScan do?
The IDS feature of OfficeScan protects your system against the following intrusions:

• Too Big Fragment
• Ping of Death
• Fragmented IGMP
• Tiny Fragment
• Overlapping Fragment
• Tear Drop
• Conflicted Arp
• Syn flood
• Land Attack

When the OfficeScan Enterprise Client Firewall detects these attacks, it will simply drop the packets and log the appropriate information to the firewall log. Normal traffic will continue to flow.

How do I view/change my firewall settings?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. Click the Enterprise Client Firewall tab.
   
   Note: Currently the campus antivirus does not allow for client changes to the firewall settings.

OfficeScan mail scan

Note: Mail scan is only available for Outlook.

How do I install mail scan?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. Click the Mail Scan tab.
3. Click the Install/Upgrade Outlook Mail Scan button.
4. Click Yes when ask to download the module.

How do I perform a mail scan?

1. Right-click the OfficeScan icon in the system tray and then click OfficeScan Main.
2. Click the Mail Scan tab.
3. Click the Scan my Outlook folders button.
   
   Note: If the Scan my Outlook folders button is grayed out, see How do I install mail scan? above.
   
   
4. Select the mail folder(s) you want to scan.
5. Click the Scan Now button.
   
   Note: Outlook Mail Scan is not a real-time scan. It is an on-demand scan intended as extra protection.

Managed K-State OfficeScan servers

What are the K-State managed OfficeScan servers?
The table below shows the list of our servers and their current status:

Server Name	Server Port	Status
Kswatos1.ads.ksu.edu	80	Online-UCL/IC and Staff
Kswatos2.ads.ksu.edu	80	Online- General Campus
Kswatos3.ads.ksu.edu	80	Online –Residence Halls