Forcing the OfficeScan (OSCE) client to send virus detection results using the "clean fail/move fail" actions

- Updated:
- 24 Nov 2016
- Product/Version:
- Core Protection Module - ESP
- Core Protection Module 10.5
- Core Protection Module 10.6
- OfficeScan 10.6
- OfficeScan 11.0
- OfficeScan 11.0
- OfficeScan XG
- OfficeScan XG.All
- Platform:
- Windows 2000 Advanced Server
- Windows 2000 Professional
- Windows 2000 Server
- Windows 2003 Enterprise
- Windows 2003 Enterprise 64-bit
- Windows 2003 Standard
- Windows 2003 Standard 64-bit
- Windows 2008 Enterprise
- Windows 2008 Enterprise 64-bit
- Windows 2008 Server Core
- Windows 2008 Server R2
- Windows 2008 Standard
- Windows 2008 Standard 64-bit
- Windows 2012 Enterprise
- Windows 2012 Web Server Edition
- Windows 7 32-bit
- Windows 7 64-bit
- Windows 8 32-bit
- Windows 8 64-bit
- Windows Vista 32-bit
- Windows Vista 64-bit
- Windows XP Home
- Windows XP Professional
- Windows XP Professional 64-bit

Summary

You can force an OSCE client/agent to send virus logs to the OSCE server using the first action "Clean Fail" and second action "Move Fail" if you need to troubleshoot virus reports or OSCE email notifications when the first two actions fail.

Details

Do the following:

Log on to the target OSCE client computer and go to ...\Trend Micro\OfficeScan Client\Misc.
Open pccnt35.log and add the following line below:
20121228<;>114000<;>Eicar_test_file<;>14<;>1<;>0<;>C:\Temp\EICAR.COM<;>

The leftmost 8 digits is in the date format YYYYMMDD and the next leftmost 6 digits is in the time format HHMMSS. Both can be changed according to your preference.
Restart the OSCE client services.
Verify that the bogus virus detection above exists by generating the Virus/Malware log.