To track the files currently being scanned:

1. Create a batch file and name it "ReadReg_LastFile.bat”

2. Paste the following contents into the batch file:

   @echo off
   > "%Temp%.\sleep.vbs" ECHO WScript.Sleep 3 * 1000
   REM // Read Registry Information #1
   set TESTA1=HKLM\SOFTWARE\Wow6432Node\TrendMicro\Pc-cillinNTCorp\CurrentVersion\Misc.
   set TESTA2=LastScannedFileName
   call :reg_read "%TESTA1%" "%TESTA2%" || (echo ERROR: no value found for LastScannedFileName & exit /b 1)
   REM // Writes Registry Information to File
   echo.%RETURN%|findstr "sleep.vbs output_file.txt" >nul 2>&1
   if not errorlevel 1 (
      REM Supressing, this script is used for this bat file
   ) else (
      echo Log: LastScannedFileName=%RETURN%
      echo %RETURN% >> C:\output_file.txt
   )
   CSCRIPT //NoLogo "%Temp%.\sleep.vbs"
   %~dp0\ReadReg_LastFile.bat
   exit /b 0
   :reg_read <key> <value>
   setlocal
   set key=%~1
   set value=%~2
   REM // make one call to reg to make sure the KEY/VALUE exists before reading it
   reg query "%key%" /v "%value%" 1>nul 2>&1 || (exit /b 1)
   for /f "tokens=2,*" %%a in ('reg query "%key%" /v "%value%" ^| findstr /c:"%value%"') do (
   set data=%%b
   )
   REM if {%data%}=={} (endlocal & exit /b 1)
   endlocal & set RETURN=%data%
   exit /b 0

3. Open a Command Prompt with administrator privilege, and navigate to the directory where the batch file was created.
4. Type “ReadReg_LastFile.bat” and press ENTER.
5. Monitor the command window to see what files are currently being scanned.

You will be able to find which certain files or folders can be excluded in OfficeScan/Apex One. This information will also let you confirm their behavior.

To identify the last file scanned by the agent:

1. Right-click Apex One system tray icon > Open Apex One Real-Time Monitor