Virus Scan Engine in OfficeScan (OSCE) 10.6 cannot detect copied EICAR test files in Real-time Scan mode in some environments

Product / Version includes:

Last updated: 2021/08/28

Solution ID: KA-0004015

Category: Troubleshoot

Summary

You are copying an EICAR test sample to Windows 7 Service Pack 1 or Windows Server 2008 environment but the Virus Scan Engine cannot detect the sample in Real-time Scan mode. However, the Virus Scan Engine can still detect testing samples whenever someone tries to access or execute them.

The issue is due to a sharing violation. When the violation occured, the file was locked thus the Virus Scan Engine cannot break it nor wait for it to be unlocked. This also causes performance concerns.

The issue can be solved by modifying the following registry key value:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSApiNt\Parameters]UseRtLock=1 (REG_DWORD)

Change the key to the default value = 0.

Important:

Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
Once this registry key is enabled, it may increase the posibility of file corruption due to this force scan behavior. Use this registry key carefully and make sure you are advised by Trend Micro Technical Support.

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Virus Scan Engine in OfficeScan (OSCE) 10.6 cannot detect copied EICAR test files in Real-time Scan mode in some environments

Virus Scan Engine in OfficeScan (OSCE) 10.6 cannot detect copied EICAR test files in Real-time Scan mode in some environments

Product / Version includes:

Summary