Do either of the following:
On the OfficeScan server console
For "Scan End time" or to verify if the scheduled scan finished, you can export a log from the OfficeScan server console.
- Log in to the OfficeScan server console.
- In OfficeScan 10.6, go to Networked Computers > Client Management. In OfficeScan 11.0 and XG, go to Agents > Agent Management.
- Click on the Export button to save an Officescan_Client_Listing.csv file.
- Open the file and look for "Last Virus Scan (Scheduled)" and "Last Spyware Scan (Scheduled)" when the actual scanning is finished.
You can also access this same information if you click on the Status icon in the OfficeScan server console (under Networked Computers > Client Management page). If you are using OfficeScan 11.0, you can find this on the Agents > Agent Management page.
On the OfficeScan client/agent machine
Do the following:
- Open the Registry Editor.
Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
- Check the following registry keys to verify the scheduled scan configuration:
HKLM\Software\TrendMicro\PC-cillinNTcorp\CurrentVersion\PreScheduled Scan Configuration:
REG_DWORD: Enable
Possible Values: 1=Enable;0=DisableREG_DWORD: Frequency
Possible Values: 2=Weekly; 3=Daily
4=Hourly; 5=Execute once onlyREG_DWORD: Hour
Possible Values: 0~12REG_DWORD: DayOfWeek
Possible Values:
1=Mon; 2=Tues;
3=Wed ; 4=Thurs
5=Fri ; 6=Sat; 7=SunREG_DWORD: AmPm
Possible Values: 1=AM; 2=PMREG_DWORD: Minute
Possible Values: 0~59 - The following registry keys will show the scheduled time and the next scheduled scan time:
- HKLM\Software\TrendMicro\PC-cillinNTcorp\CurrentVersion\PreScheduled Scan Configuration\ScanStartTime
- HKLM\Software\TrendMicro\PC-cillinNTcorp\CurrentVersion\PreScheduled Scan Configuration\ScanStartTime\NextScanTime
- Close the Registry Editor.
- To investigate further on the scan start time and scan duration, enable and look for the following keyword strings in the ofcdebug.log file:
- For start time, look for this keyword:
[ntrtscan.exe]CreateThread (Schedule) OK
or
[ntrtscan.exe][tmntScheduleScan] TempPathName - For scan duration (in milliseconds), look for this keyword:
[ntrtscan.exe][Schedule] Total processing time:
- For start time, look for this keyword:
To enable debug mode, follow the steps in this KB article: Manually enabling debug mode on OfficeScan