Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Performing a manual update or rollback of the scan engine in OfficeScan (OSCE)

    • Updated:
    • 17 Oct 2016
    • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • Platform:
    • Windows 10 32-bit
    • Windows 10 64-bit
    • Windows 2003 Datacenter 64-bit
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Server R2
    • Windows 2003 Standard
    • Windows 2003 Standard 64-bit
    • Windows 2008 Datacenter
    • Windows 2008 Datacenter 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server Core
    • Windows 2008 Server R2 Enterprise
    • Windows 2008 Standard
    • Windows 2008 Standard 64-bit
    • Windows 2008 Web Server Edition
    • Windows 2008 Web Server Edition 64-bit
    • Windows 2012 Datacenter R2
    • Windows 2012 Enterprise
    • Windows 2012 Enterprise R2
    • Windows 2012 Server Essential R2
    • Windows 2012 Server Essentials
    • Windows 2012 Standard
    • Windows 2012 Standard R2
    • Windows 2012 Web Server Edition
    • Windows 7 32-Bit
    • Windows 7 64-Bit
    • Windows 8 32-Bit
    • Windows 8 64-Bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Home
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

If you are having problems with the current OfficeScan Scan Engine (such as the Trend Micro VSAPI NT service failing to start), you can perform a manual update or rollback for both the OfficeScan server and client.

This solution is also applicable to OfficeScan environments which have outdated Scan Engines and are having difficulty in updating them via the OfficeScan management console.

Details
Public

Both 32-bit and 64-bit scan engines should be updated at the same time.

Scan engine download

Click image to enlarge

1. Preparation for 32-bit Engine Upgrade.

  1. Go to the Trend Micro Scan Engine Updates page and download the latest Scan Engine for Windows 32-bit.
  2. Rename the ZIP file to "tmengNT32.zip".
  3. Extract the contents of the tmengNT32.zip file to the ..\PCCSRV\pccnt\Drv folder.
  4. Copy the tmengNT32.zip file to the ..\PCCSRV\Download and ..\PCCSRV\Download\engine folders.
  5. Check the properties of the tmengNT32.zip file then note its file size in bytes.

2. Preparation for 64-bit Engine Upgrade.

  1. Go to the Trend Micro Scan Engine Updates page and download the latest Scan Engine for Windows 64-bit
  2. Rename the ZIP file to "tmengNT64.zip".
  3. Extract the contents of the tmengNT64.zip file to the ..\PCCSRV\pccnt\drv\X64 folder.
  4. Copy the tmengNT64.zip file to the ..\PCCSRV\Download and ..\PCCSRV\Download\engine folders.
  5. Check the properties of the tmengNT64.zip file then note its file size in bytes.

3. Modify server.ini in the ‘download’ directory.

 
Make a backup of server.ini before making changes.

The PCCSRV\download\server.ini file with the relevant lines (other lines are snipped for clarity).

Each engine type has a ‘Tag’ line and a ‘Path’ line (4 lines in total to me modified 2x x86, 2x x64)

  • Tag E.10 for 32-bit Engine
  • Tag E.1000 for 64-bit Engine

List of changes:

  1. Change the paths to reflect the engine package
  2. Change the version to reflect the build version
  3. Change the size in bytes to reflect the size of the engine package
  4. The ‘6.51.1002’ value is a legacy/default value and remains unchanged

Example server.ini snippet with the following attribute values:

  • 32-bit Engine path = engine\tmengNT32.zip
  • 64-bit Engine path = engine\tmengNT64.zip
  • 32-bit Engine version = 9.900.1008
  • 64-bit Engine version = 9.900.1008

Size in bytes

Click image to enlarge

[ENGINE]
E.10=VSAPI32_NT_KD, engine/tmengNT32.zip, 9.900.1008, 1383504, 6.51.1002
E.1000=VSAPI_AMD64_NTKD, engine/tmengNT64.zip, 9.900.1008, 1251242, 6.51.1002

Path_VSAPI32_NT_KD=engine/tmengNT32.zip, 9.900, 1383504
Path_PREVSAPI32_95=engine/tmengNT64.zip, 9.900, 1251242

4. Update the version in the Dashboard page.

 
Make a backup of ofcscan.ini before making changes.
  1. Open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Under "INI_PROGRAM_VERSION_SECTION", change the value of:

    1. "EngineNT_Version" parameter to x.xxx.yyyy (the version and build number of the Scan Engine).
    2. "EngineX64_Version" parameter to x.xxx.yyyy (the version and build number of the Scan Engine).
  3. Save and close the file.

5. Update component.ini in \PCCSRV\Private\component.ini

Preparation

 
Make a backup of component.ini before making changes.
  1. Convert the scan engine version to decimal.

    1. Scan Engine Version and Build = 9.900.1008 (MajorVersion.MinorVersion.Build)
    2. Set build to 0 => 9.900.0
    3. Convert Hex to Decimal (remove periods and use a scientific calculator)

      Convert hex to dec

      Hex: 99000 = DEC: 626688

    For 32-bit Engine:

    1. Scroll to component [6104]
    2. Modify the ‘Version’ value to be ‘Engine version as DEC engineBuild 0’:

      The following example is for engine 9.900.1008:

      Version=626688 1008 0

    3. Modify the PkgFile value:

      PkgFile= tmengNT32.zip

    For 64-bit Engine

      1. Scroll to component [6035]
      2. Modify the ‘Version’ value to be ‘Engine version as DEC engineBuild 0’:

        The following example is for engine 9.900.1008

        Version=626688 1008 0

      3. Modify the PkgFile value:

        PkgFile=tmengNT64.zip

    Once you have updated the component.ini file as above, close and save your changes.

    6. Verification

    Console:

    Console verification

    Click image to enlarge

    Agent:

    Perform a manual update and verify the version details.

    Agent verification

    Click image to enlarge

  1. Go to the Trend Micro Scan Engine Updates page and then download the latest Scan Engine for Windows NT/2000/XP (vsapi-KD-x.xxx-yyyy.zip).
  2. Stop the following services:
    • OfficeScan NT Listener
    • OfficeScan NT Real-time Scan

    To do this:

    1. Click Start > Run > type in "services.msc". The service window will open.
    2. Scroll down and select the OfficeScan NT Listener Service.
    3. Right-click on the OfficeScan NT Listener Service and then click Stop.
    4. Repeat steps 2 and 3, but this time for the OfficeScan Real-time Scan Service.
  3. Create a back up of the following files in the C:\Program Files\trendmicro\OfficeScan Client folder.
    • tmfilter.sys
    • vsapint.sys
    • tmpreflt.sys
    • tmxpflt.sys
  4. Extract the contents of the downloaded zip file to the :\Program Files\trendmicro\OfficeScan Client folder.
  5. Start the following services:
    • OfficeScan NT Listener
    • OfficeScan NT Real-time Scan
Premium
Internal
Rating:
Category:
Update
Solution Id:
0122633
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.