OfficeScan 3.

52 Release Note

Prepared by: Allen Chou

Date: 12/10/2010

Version:
Table of Contents
1 Minimum System Requirements...........................................................................4
1.1 Server Using File-Based Communication........................................................................4
1.1.1 Windows 2000/NT Server..........................................................................................................4
1.1.2 Novell NetWare..........................................................................................................................4
1.1.3 Server Using HTTP-Based Communication..............................................................................4
1.2 Client Software................................................................................................................4
1.2.1 DOS and Windows 3.1 (PCCDOS/PCCWIN)............................................................................4
1.2.2 Windows Me/98/95 or Windows NT Workstation (PCC97/PCCNT)..........................................4
1.3 Management Console.....................................................................................................5
1.3.1 Web-Based Management Console............................................................................................5
1.3.2 Windows-Based Management Console....................................................................................5
2 New Features in OfficeScan 3.53..........................................................................5
3 Important Information About Version 3.53...........................................................6
4 Supplemental Tools and Utilities..........................................................................6
5 Bug Fixes and Enhancements..............................................................................8
6 Important Features Information That Must Be Noted..........................................8
6.1 Virus Protection...............................................................................................................8
6.2 Notifications and Log Files...............................................................................................9
6.3 Network Management Issues..........................................................................................9
6.4 Database Issues..............................................................................................................9
7 Installation/Update/Upgrade/Registration/Licenses..........................................10
7.1 Installation.....................................................................................................................10
7.2 Image Setup Support.....................................................................................................10
7.2.1 How to Use the Image Setup Utility.........................................................................................10
7.3 Default Installation Path Does Not Exist........................................................................10
7.4 Garbage Directories Created During Installation...........................................................10
8 Update...................................................................................................................11
9 Upgrade................................................................................................................11
9.1 Upgrading the OfficeScan Server From 3.13 to 3.5x.....................................................11
9.2 Uninstallation/Rollback..................................................................................................11
10 Specific Features...............................................................................................12
10.1 Synchronization (Mobile Support)................................................................................12
11 Debugging and Compatibility Issues...............................................................12
11.1 Enabling the Debug Log to Troubleshoot Client Side Problems..................................12
11.2 Using the Registry.......................................................................................................12
12 Server Side Debug Log......................................................................................12
12.1 Enabling the Debug Log..............................................................................................12
12.1.1 HTTP-based Server...............................................................................................................12
12.1.2 File-based Server..................................................................................................................13
12.2 For Client.....................................................................................................................13
12.2.1 HTTP-Based Server..............................................................................................................13
12.2.2 File Base Server....................................................................................................................13
12.2.3 Client Side.............................................................................................................................13
13 Compatibility Issues..........................................................................................13
14 Other Issues.......................................................................................................13
15 Known Bugs.......................................................................................................13
16 Performance and Limitations of This Product.................................................15
Executive Summary...............................................................................................15
Testing Environments...........................................................................................15
Client Testing Environments...............................................................................................15
Server Testing Environments.............................................................................................15
16.0.1 Small Enterprise....................................................................................................................15
16.0.2 Medium Enterprise................................................................................................................15
16.0.3 Large Enterprise....................................................................................................................15
16.0.4 Extra-Large Enterprise..........................................................................................................15
OfficeScan Limitations..........................................................................................16
16.1 Small Enterprise..........................................................................................................16
16.2 Medium Enterprise......................................................................................................16
16.3 Large Enterprise..........................................................................................................16
16.4 Extra Large Enterprise.................................................................................................16

2
Testing Results......................................................................................................17
Recommendations.................................................................................................21
16.5 Small Enterprise..........................................................................................................21
16.6 Medium Enterprise......................................................................................................21
16.7 Large Enterprise..........................................................................................................21
16.8 Extra Large Enterprise.................................................................................................22

Tables
Figure 1. Privileges for the HTTP-based OfficeScan Server Directory.................6
Figure 2. Bug Fixes and Enhancements in OfficeScan 3.53..................................8
Figure 3. Known Bugs in OfficeScan 3.52.............................................................14

3
1 Minimum System Requirements

1.1 Server Using File-Based Communication

1.1.1 Windows 2000/NT Server

• Intel Pentium processor 166 MHz or equivalent
• 128 MB RAM
• Windows 2000 Server (with or without SP1) or Windows NT 4.0 Server with SP3, 4, 5 or 6
• 400 MB free hard disk space with extra 50 MB in the system's temp dir
• Enough Windows NT or Windows 2000 Professional licenses so that every workstation can
connect to the server simultaneously. This can be verified by having every client workstation
map a drive to the \\pccsrv directory on the OfficeScan server
• The server where the OfficeScan server is installed should be shared as admin$ for login
script setup
• When installing the OfficeScan server, the user requires Administrator or Domain Admin
privileges to the Windows NT server to which OfficeScan is being installed.

1.1.2 Novell NetWare

• Intel Pentium processor 100 MHz (133 MHz if using NetWare 5.0)
• 32 MB RAM (48 MB if using NetWare 5.0)
• Novell NetWare 3.12, 4.10, 4.11 or 5.x with SP1 or SP2
• 300 MB free disk space available, with extra 50 MB in the system temp directory

1.1.3 Server Using HTTP-Based Communication

• Intel Pentium processor 233 MHz or equivalent
• 128 MB RAM
• Windows 2000 Server with SP1 or Windows NT 4.0 Server with SP 3, 4, 5 or 6 with IIS 3, 4
or 5 (IIS 4 or above
• 400 MB free hard disk space with extra 50 MB in the system's temp dir
• Enough Windows NT or Windows 2000 Professional licenses so that every workstation can
connect to the server simultaneously. This can be verified by having every client workstation
map a drive to the \\pccsrv directory on the OfficeScan server.
• Users need to have a C$, D$, E$ share for master installation
• The server where the OfficeScan server is installed should be shared as admin$ for login
script setup
• When installing the OfficeScan server, the user requires Administrator or Domain Admin
privileges to the Windows NT server to which OfficeScan is being installed.

1.2 Client Software

1.2.1 DOS and Windows 3.1 (PCCDOS/PCCWIN)

• 486 class CPU
• 16 MB RAM
• DOS 6.22, Windows 3.1/3.11. Localized Chinese and Japanese versions of the client
program require the localized Chinese and Japanese versions of Windows
• 640*480/800*600/1024*768 resolution
• 256/65536/True Color resolution
• 10 MB free disk space

1.2.2 Windows Me/98/95 or Windows NT Workstation (PCC97/PCCNT)

• Intel Pentium processor 100 MHz or equivalent
• 32 MB RAM
• Windows NT 4 Workstation SR 3, 4, 5 or 6, Windows Me/ 95/98, Windows 2000
Professional
• 640*480/800*600/1024*768 resolution
• Colors=256/65536/True Color
• 15 MB free disk space

4
Note: Client support for Windows NT 3.51 will be phased out by summer 2001.
While the OfficeScan 3.51 Windows NT client software will likely work on the
Windows NT 3.51 platform, client software on Windows 3.51 will no longer be
tested. Windows NT 3.51 users need to login as an Administrator (local
admin or domain admin)

1.3 Management Console

1.3.1 Web-Based Management Console

• Intel Pentium processor 133 MHz or equivalent
• 64 MB RAM
• Microsoft Internet Explorer 4.0 or above
• 800*600/1024*768 resolution
• 256/65536/True Color resolution
• 30 MB free disk space available
• Should use the local code page, e.g., using Unicode UTF might cause error code in Chinese
Internet Explorer 5.0

1.3.2 Windows-Based Management Console

• Intel Pentium 133 MHz or equivalent
• 64 MB RAM
• Windows 2000 Professional and Server, Windows NT 4 Workstation or Server with SP 3, 4,
5 or 6, Windows Me/98/95
• Microsoft Internet Exlorer 4 or above for ActiveUpdate support
• 800*600/1024*768 resolution
• 256/65536/True Color
• 30 MB free disk space available
• Secur32.dll should be version 4.10.1057 or above
• To run the OfficeScan Windows Administrator (including its utilities), users should login to
the OfficeScan server with Administrator privileges

2 New Features in OfficeScan 3.53

1. Can uninstall more competing products, as well as Trend Micros’s own programs. These include:
• Trend PC-cillin 2000
• Norton AntiVirus 5.x/7.x/2000
• McAfee VirusScan 4.x
• Dr. Solomon 7.77/7.95
• CA Inoculate 4.53
• Intel LDVP 5.x
• Sophos Anti-Virus
• V3Pro 2000 Deluxe
• Panda Antivirus 6.0
• F-Secure 4.x
2. Manual Scan can now clean the first layer of an infected ZIP file – without the need to uncompress
the file beforehand.
3. The Web Console can now find IP addresses.
4. An hourly scheduled update for Http and File base servers has been added.
5. Supports two more notification methods: NT Event Log and SNMP trap
6. Web Console features a new Update Log button for quick inspection of the update logs.
7. The View Virus Log can now support up to 1,000,000 entries.
8. Supports the Socks 4 protocol for both file-based and HTTP-based servers
9. The Proxy cache is now a configurable option for both HTTP and file base server
10. The Client polling interval is now a configuable option for file-based servers

5
 11. The Web server can now configure the client to automatically perform updates whenever it
boots up.

3 Important Information About Version 3.53

1. Before attempting to do a hot fix, copy or otherwise manipulate the file so that the date stamp on
the file changes. This is because the hot fix algorithm uses a date comparison.
2. If installing to a Windows 95 platform, TCP/IP protocol support must be installed before running
the installation program. If not, the installation program will skip the software setup without any
warning.
3. Upgrade from version 3.13 to 3.5x is supported; upgrade from v3.0/v3.11/3.12 to v3.5x is not
supported.
4. If using OfficeScan for Microsoft SBS Version, the SMEX and OfficeScan directories must be
configured within OfficeScan as exception directories. This is to prevent two antivirus products
from catching the same virus in the Windows temp directory.
5. Internet Explorer 4.0 or above must be installed on all Windows NT or 95/98/Me clients where
you intend to install the OfficeScan client software. It is also needed for viewing the web-based
management console.
6. If customers are using 10 Mbit/s network bandwidth, the recommend maximum number of client
software installations should be less than 100. For 100 Mbit/s bandwidth, the recommended
number of clients is less than 1000.
7. Microsoft Cluster server is not supported.
9. Everyone should be granted full control to the \pccsrv directory on the OfficeScan server for file-
based communication. The following privileges for the HTTP-based OfficeScan server should be
granted:
Directory/User Administrator Everyone Iuser System
\pccsrv full control RX rwdx full control
\pccsrv\httpdb full control No rw full control
\pccsrv\log full control RW rw full control
\pccsrv\web\cgi full control NO rwx full control
\pccsrv\virus full control W rw full control
\pccsrv\web\clientinstall full control No rwdx full control
Figure 1. Privileges for the HTTP-based OfficeScan Server Directory
10. The OfficeScan client software will no longer support Windows NT 3.51. Web-based
installation is not supported. OfficeScan 3.53’s new features are not supported.

4 Supplemental Tools and Utilities

The following utilities are provided together with OfficeScan 3.53 and are located in the . . .
PCCSRV/ADMIN/UTILITY folder. Also refer to the help file: Utility.hlp for information on how to
use the tools. For users upgrading from previous versions, please ask for these tools from a Trend
Micro Support Engineer.
• Server Selection Tool (ipxfer.exe). This tool is run on the client site and moves clients
from one OfficeScan server to another. It accomplishes this by modifying the login script.
This operation is usually performed on client software that was incorrectly installed during a
standalone installation.
• Change GUID Tool (chguid.exe). This tool is used to change the GUID used by a
OfficeScan client running in Windows 95 (the Windows NT client is not supported by this
tool). This is useful when the client software was installed using imaging software, and a
new GUID must be assigned.

6
• RAS Block Tool (rasinfo.exe) Rasinfo.exe is added to the login script to prevent Remote
Access Service (RAS) users from running AUTOPCC
• Windows Client Removal Toolkit. (ComUnUI.exe & ComUninst.exe) This toolkit can
uninstall OfficeScan clients, from versions 3.1x to 3.5, running on either Windows 95 or
Windows NT. Use this tool if the Windows uninstaller cannot remove the client.
• File-based Client Scheduled Update Tool (SchUpd.exe). This tool allows you to schedule
when AUTOPCC.exe is launched, ensuring that OfficeScan clients are always updated.
• File-based Client Update Tool (AutoUpd.exe). This tool, and its its supporting dll and ini
files, allows you initiates an update every time the client is activated, ensuring that the
OfficeScan client is always updated.
• Change Read Only Tool (CRO.EXE). Having the attributes of certain critical files
changed to Read Only sometimes causes update failures. This tool returns the attributes of
all files to normal.
• Real-Time Scan Scheduling Tool(ClnSchRT.exe) This tool schedules the activation of the
real-time scanning function – to avoid conflicts with third-party programs
• Check Client Status Toolkit (Chkconn.exe & chkstatus.exe). This toolkit verifies the
existence of a connection between a client(s) and the OfficeScan server. It is composed of
two tools: Chkstatus.exe and Chkconn.exe. Chkstatus.exe features its own UI and checks
the client connections using the OfficeScan client database. The verification results may be
exported as a CSV file. Chkconn.exe is a DOS-based program and can be used to check the
connection status servers – without the need for the above mentioned database. Unlike the
above tool, it can only verify the connection of one client at a time.
• Explorer virus Removal Tool (Chkworm.exe). This tool searches for and removes the
Explorer virus from the system
• Change Subnet Tool (ChnSubIP.exe). This tool detects the available IP addresses for
connecting to an OfficeScan server. This is useful for clients that frequently change
locations.
• Icon Cleanup Utility (CleanDB.exe). This tool removes icons of non-existent clients from
the browser tree of both File-based and HTTP-based OfficeScan consoles. It accomplishes
this by deleting duplicate records in the OfficeScan databases. After deletion, the databases
are packed and re-indexed.
• Client Self-Extract Package (ClnPack.exe & ClnExtor.exe). This package is used when
deploying update and/or setup files to machines in limited bandwidth environments -- where
using ActiveUpdate is not feasible.
It can pack setup and/or update files into a single self-extracting file, thus simplifying
delivery of files either by CD or similar media. The package UI also features an email
function that can access the MS Outlook address book, allowing you to send the self-
extracting file from within the tool.
• Client String Reset Tool (Clientstr.exe). This tool corrects time stamp induced errors in
updates, by resetting the ClientString registry key to 0
• Client Installation Verification Tool (CNIC.exe). This tool looks for Windows NT
machines that do not have the OfficeScan Windows NT client installed, then installs the said
software on them.
• Database Backup Tool (DBBackup.exe). Use this tool to schedule a regular backup of the
OfficeScan databases, to either a remote or local machine. Performing backups are
recommended to allow you to restore your settings should any of the databases ever become
corrupted.
• Pack Database Tool (dbPack.exe). This tool is used to pack OfficeScan databases with
records that have been marked for deletion, then reindex them.
• Virus Log Export Tool (LogWatch.exe). This is a tool to copy the log database of
OfficeScan servers and export them to a CSV file
• Server Update Schedule Toolkit. (ServerSchduleUpdate.exe). This kit performs
scheduled updates for OfficeScan servers.
• Performance Tune-up Tool (Svrtune.exe). This tool facilitates the performance
optimization of OfficeScan servers.
• Touch Tool (Touch.exe). This tool will synchronize the time stamp of the destination file
with the source file
• OfficeScan NT.msi. This is a localized installer package file (*.msi) for OfficeScan. This
file makes OfficeScan compatible with the Windows 2000 installation system.

7
5 Bug Fixes and Enhancements
Problem/Bug/Issue Solution
General Protection Faults happen in the ofcservice.exe Fixed . Now it can support at
when many clients report to it. least one thousand clients
reporting within a 4 minute
interval. It can however
accommodate more when
working in optimum network
conditions.
Login Script does not support Windows 2000 Fixed

Memory Leak in PCCNTMon.exe Fixed

Email Notification failure Fixed

File-based Windows NT remote installer fails on some Fixed

non-English OS’
Client does not display correct version after upgrading Fixed
to v3.5x
Can not delete the temp files created by the ActiveUpdate of pattern Fixed
files
Virus-infected files in the Windows \XLStart directory Fixed
could not be moved
Uninstallation of NAV 7 failed Fixed
“Hold on server” did not work. Manually initiated updates can still be Fixed
performed even if the server is set to hold.
Export virus log action failed Fixed

Pager alert can not support COM1 setting (it only supports COM2 , Fixed
3…)
Figure 2. Bug Fixes and Enhancements in OfficeScan 3.53

6 Important Features Information That Must Be Noted

6.1 Virus Protection

1. Shutdown floppy drive scan feature only scans for boot viruses. Any file virus on the diskette will
not be detected.
2. Expanding a folder might trigger real time scanning when:
• folder contains *.exe files
• user has installed IE 4 or above
• when they have configured their Windows Explorer to display as a web page
3. The real time scan action for boot viruses will always be “leave alone” on the Windows NT client.
For the Windows 95 client, it will do the clean action.
4. OfficeScan 3.53 supports adding file directories to the exception file. When adding a file to the
exception list, only the file name (not the path) should be added, e.g., user can type “config.sys”
into the exception file list to skip scanning every file named config.sys. If the configuration is
typed as c:\config.sys, it will not take any effect. Directories should include the drive name such as
c:\temp.

8
5. The Windows NT 3.51 client does not support local exception file list configuration
(administrators must configure it remotely via the management console). The exception file list
menu item will appear disabled.
6. A new Windows NT kernel driver has enhanced scanning performance by 30%.
7. OfficeScan 3.53 supports shell extension scanning which can also scan network resources.
8. Virus logs will not be sent to the OfficeScan server when the IO Monitor is not enabled. The
Windows NT 3.51 client program will not enable the IO Monitor for remote installation or
upgrade.
9. An OfficeScan client for Windows 95/98/Me which is installed on a workstation using the
NetWare client 32 will perform real-time/manual scanning of files that are located on the mapped
drive of a NetWare server.
10. Manual scanning does not scan the root drive.

6.2 Notifications and Log Files

The virus log can contain a maximum of 1,000,000 log entries. If the OfficeScan server attempts to
exceed this maximum, then there might be a virus log recording error or else the management console
might hang.

6.3 Network Management Issues

• Only one instance of viewing the OfficeScan client status is permitted at the same time. Two
instances of the management console should not be run at the same time. This applies to both the
web-based and Windows-based management consoles.
• Remote configurations will take effect when client restarts the related program or component.
• Real-time scan settings will be valid when the real time scan service is restarted.
• Manual scan settings will be valid when the main program is restarted.
• Schedule scan settings will be valid immediately.
• Privilege settings that allow the client to change the scan configuration will be valid when
the main program is restarted.
• Other configuration settings will be valid immediately.
• OfficeScan 3.53 supports site configuration. If the user tries to do site configuration to change the
scan options or set privileges, it will support two buttons. If you click Apply, it will only save
your configuration to the ofcscan.ini file and will not notify the clients. If you choose “Apply” to
all clients, it will save the changes to the ofcscan.ini file and notify all clients.
• For file-based configuration, the client will not be immediately notified. It will periodically poll
the server to find the configuration at a random time from a time range which is recorded in the
registry key Filebase Polling Range.
• Users need to delete the browser’s cache when the information is renewed.
• The administrator, client unload and uninstall passwords are limited to 8 characters.
• The IO monitor should be be run on the Windows NT client otherwise the virus log report will not
be sent to the OfficeScan server.
• It might take a few minutes to notify a client to perform the upgrade. For single clients, if the
connection is OK , the update is performed quickly and the time can be ignored. However, for
clients that have lost connection with the server, it might take an average of 1 minute.

6.4 Database Issues

The database might be locked by database tools such as Foxpro so using Foxpro to open any file in
\pccsrv\httpdb or \pccsrv\filedb will cause the client to fail to write information to the server.

9
7 Installation/Update/Upgrade/Registration/Licenses

7.1 Installation
Note: Master installation supports server upgrade from v3.13 or v3.5 to v3.5x
1. Close all OfficeScan consoles before master setup when trying to do the upgrade
2. Close the IIS Admin console and disable the Trend VCS service.
3. If, after master installation, the OfficeScan HTML console cannot be accessed, run ofcservice.exe
–officescan. This can help build up the environment.
4. OfficeScan servers installed from a Windows 95/98/Me machineonly support file-based setup.

7.2 Image Setup Support

Note:Image Setup does not support Windows NT 3.51

7.2.1 How to Use the Image Setup Utility

a. Obtain an image utility program like Norton Ghost, etc.
b. Administrator installs the OfficeScan client to the computer which is used as the source of the hard
disk drive image.
c. Execute imgsetup.exe on this machine. The imgsetup.exe program will create one RUN registry
key under the HKEY_LOCAL_MACHINE.
d. User uses Norton Ghost or other image utility to create the hard disk image.
e. After the machine is rebooted, imgsetup.exe will automatically start and create one new GUID
value. The client software will report this new GUID to the server and create one new record.
Note: Please change the computer name (or domain name) to avoid having 2
machines with the same name in the OfficeScan database.

7.3 Default Installation Path Does Not Exist

When the default client installation path does not exist, e.g., the user might try to install the client
software to the D: drive but the computer only has a C: drive), it will install the software to the
following locations:
• DOSWin31_InstallPath=$BOOTDISK\PCCI5
• Win95_InstallPath=$ProgramFiles\OfficeScan 95
• WinNT_InstallPath=$BOOTDISK\OfficeScan NT

7.4 Garbage Directories Created During Installation

• The installation will create garbage directories on the user's hard drive. The user must delete them
manually. The directory names are _istmp0, _istmp1, etc. The installation will also copy a lot of
garbage files to the user’s NT directories \system32\%Default% and c:\temp. The user must
delete them manually.
• The web installation method disables the debug mode by default. The other installation methods
will enable the debug mode.
• Web-based remote installation will not enable the Windows NT 4.0 IO monitor.
• Users need to manually start up the IO Monitor on Windows NT 3.51 clients after remote
installation.
• The File-based Master setup will abort when a virus is found. Clean the environment using a
command line virus scanner like pcscan.exe and then run the installation program again.
• File-based and HTTP-based communication is totally separated in OfficeScan 3.53. The next
version will support upgrade from v3.13 to v3.5x where a mixed environment (HTTP and File-
base ) database can be separated into File-based and HTTP-based servers.
• The OfficeScan 3.53 installation program will automatically remove NAV5 and Viruscan 3.x

10
• OfficeScan 3.53 supports standalone installation where users can install the client by copying the
pccsrv directory (the server’s installation directory). There is no need to connect to the server
directly.

8 Update
• Remote pattern update will not enable the Windows NT client’s IO monitor. It has to be started
manually.
• If a file download fails, the process will be aborted and the server’s original condition will be
restored.
• Manual and scheduled update from the ActiveUpdate server is not currently supported. If users
want to do the update, use the hot fix to update.
• Updating separate components is supported in OfficeScan 3.52, where the program is separated
into pattern, engine and program. It also allows hot fix update whereby the user puts the newest
file into the server directory (default is c:\pccsrv) and then the server will automatically notify the
client to update to the newest file.
• OfficeScan 3.52 supports incremental pattern update that only updates the virus pattern files that
have changed since the last release. This saves bandwidth use by approximately 30% compared to
the previous version.
• BBS update has been removed.
• Trial versions are allowed to perform an update.

9 Upgrade
When the server is upgraded to v3.5x, all clients must be upgraded to v3.5x together. Using autopcc is
recommended.
Note: The upgrade function does not work perfectly this version; users have to
uninstall and then reinstall the software.

9.1 Upgrading the OfficeScan Server From 3.13 to 3.5x

Backup the \pccsrv directory.
The installation program will ask the user to input the serial number when the user tries to install at the
v3.13 machine.
Upgrade only supports File-based to File-based, HTTP-based to HTTP-based and mixed environments.
In previous versions, OfficeScan allowed users to set up the server to support both File-based and
HTTP-based servers to be upgraded to HTTP-based servers.
In OfficeScan 3.53, mixed environment servers will be upgraded to HTTP-based servers and there will
be an extra file-based server database separated out and put in the folder \tmoliver.

9.2 Uninstallation/Rollback
Some files are often left on the OfficeScan server after uninstallation. They should be manually
deleted. They are \pccsrv\*.*, c:\ofcdebug.log ,ofcdebug.ini, ofcscan.ini in the Windows directory and
c:\temp also contains a lot of garbage files.
In the management console, “allow client to uninstall” means allowing the client to uninstall without a
password. “Not allow client to uninstall” means client can only uninstall with the below password. The
same meaning is applied to the unload password.
After uninstallation, it is necessary to check in the management console that the client has been deleted.
If not, delete this client from the management console, otherwise it will create a duplicate record the
next time client software is installed to the workstation.
Remote uninstallation does not support uninstalling OfficeScan 3.0 or 3.1x Windows NT clients.

11
10 Specific Features

10.1 Synchronization (Mobile Support)

Whenever the computer is restarted (or tmlistener is restarted) and the OfficeScan icon in the Windows
taskbar is right-clicked, a menu will display the last item as "Synchronization". If the client computer
cannot connect to the OfficeScan server, this menu item will be enabled.
If the user clicks this menu item, the client can be synchronized with the OfficeScan server, whereby
the synchronization items include:
• Newest pattern
• Newest engine
• Newest program
• Hot fix
• Virus alert message and client side configuration
• Client’s virus log synchronization
Note: For synchronization through a proxy , the user name and password must be
entered into the synchronization UI.
This version supports ActiveSupport which can be used to gather client information. To use this
function, just click the Help menu and then select ActiveSupport. This will run the client’s debug mode
and gather the necessay client information. It might take a few minutes to gather the ActiveSupport
information. Additionally, WinMSD might hang; try again, it will work.

11 Debugging and Compatibility Issues

11.1 Enabling the Debug Log to Troubleshoot Client Side Problems

Use ActiveSupport to enable the debug log. Files called ofcdebug.ini and ofcdebug.log will be created
in the user’s root directory. This file will record the debug information. To turn off the debug log,
simply delete the ofcdebug.ini file and restart 2 relative services in the NT Client and log off /log in
again from the Windows 95 client.

11.2 Using the Registry

In the Windows NT registry, find hkey\LOCAL MACHINE\Trend Micros\PC-cillin
NTCorp\CurrentVersion\RealTimeScan

• Add a DWORD AMB with value 2

• Add a DWord DInfo with value 2
• Restart the 2 services. There will be two logs, tmlisten.log and ntrtscan.log. The debug logs of the
master setup of both the HTTP-based server and the File-based server is located in the Windows
NT directory named ofcmas.log.

12 Server Side Debug Log

12.1 Enabling the Debug Log

12.1.1 HTTP-based Server

Create a file called ofcDebug.ini file in the c:\ pccsrv directory or the relative OfficeScan server
directory. The OfcDebug.ini file should have these entries:
[debug]
DebugLog=C:\ofcdebug.log
DebugLevel=9
This will create the debug log at c:\pccsrv\ofcdegbug.log.

12
The second way (on the HTTP-based server only) to do this is to run the HTML management console.
Click the “D” of the “Trend OfficeScan Corporate Edition” banner.

12.1.2 File-based Server

Use the same procedure as the HTTP-based server. However, there is no master service.

12.2 For Client

1. Run ActiveSupport and turn on the debug log. The File-based client will create the log
<<Windows directory>>\ofc95.log or ofcnt.log. On the HTTP-based client, the log will be created
at c:\ofcdebug.log.
2. Turn off the debug log.

12.2.1 HTTP-Based Server

Delete the ofcdebug.ini file and restart the OfficeScan Master service.
The second way (HTTP-based server only) to do this is to run the HTML management console and
click the “D” of the“Trend OfficeScan Corporate Edition” banner.

12.2.2 File Base Server

Use the same method as the HTTP-based server, except that there is no master service.

12.2.3 Client Side

Delete ofcdebug.ini at root dir then restart all the services

13 Compatibility Issues
• If the user installs Trend’s ServerProtect on the OfficeScan server, set pccsrv\virus as an
exception directory. Otherwise, when the user copies a virus to the server (the default move path
is set to pccsrv\virus on the server side), it will be caught by ServerProtect.
• The master setup debug log is created at \pccsrv\result.log.
• This product is Office 2000 compatible.
• This product supports Windows Me, NT Service Packs 5 and 6 and Windows 2000 SP1 (for both
server and client).
• Supports Netware 5.x with SP1 & SP2.
• This product can support dates up to 2036 (Y2K issue)

14 Other Issues
All time information will use the local time in both the HTTP and File-based servers, except for some
internal information, like hotfix. Version 3.5x will not support multiple time zones; users can handle
these kinds of situations by themselves.

15 Known Bugs

Virus Protection
If moving the virus fails, the log may not be sent.
Move does not support auto-rename.
Multiple instances of scan might cause problems. For example, real
time scan + manual scan +shell extension scan might cause
multiple instances of pccnt.exe which might cause a GPF.

13
Network Management
Browser might time-out and show update failed when Internet is
very slow.

Your browser’s "Go back” button might not go back to the right
page, especially during update/upgrade.

After notifying Windows 3.1x clients to update to 3.5x, all clients

are shown as stop signs. The user needs to restart the browser.
Notification might cause browser to hang. User needs to restart
browser.

Scan Now will not use the current configuration (it uses the
previous one)
A corrupt virus log might cause the management console to hang

Installation/Upgrade/Update

If the scan engine is updated via hot-fix, the user needs to manually
modify the engine version in the ofcscan.ini file.
The program shortcut will not be created if the Windows NT 3.51
workstation is connected to the server with a domain user login
when doing remote installation. When upgrading, the client needs
to log off and then log on again.
When upgrading to 3.5x, the client will not be able to read old virus
logs.

The IIS service might not be able to be stopped when Trend VCS is
installed.

There are always some Windows NT clients that might report

"default" as their domain name.
Web site MIDI might cause the pattern update to fail. This might
might lead to a system hang.

Power saving might cause Windows 95 to hang when being notified

by the web server.
Upgrade from 3.13 to 3.5x does not change the uninstall program to
right path.
Lack of rtscan will cause 3.13 upgrade to 3.5x to fail.
There may be a double record of clients when doing installation.
OfficeScan 3.13 clients that are displayed as stop signs cannot be
upgraded.
Client31 can't get user name if user uses NDS and OU.
Uninstallation/Rollback
Windows NT 3.51 will keep the program workgroup for remote
uninstallation if the login user is a domain user.
instreg will be triggered when doing remote uninstallation.
Compatibility

Using OfficeScan 3.13 clients together with the 3.5x Server might
cause errors (e.g., Scan now might fail)
Figure 3. Known Bugs in OfficeScan 3.52

14
16 Performance and Limitations of This Product

Executive Summary
This performance report explains how various loads of OfficeScan client software installations will
influence OfficeScan performance, on both the client and server side.

The following resources will be considered:

• CPU, memory and handles usage

• Network bandwidth comsumption
• Performance loading

Testing Environments

Client Testing Environments

• Windows 95/98/ME client: Intel Pentium® processor running at 133 MHz, 32 MB RAM. Actual
OS used in testing environment was Windows 95 OSR2.
• Windows NT/2000 client: Intel Pentium® processor running at 166 MHz, 64 MB RAM. Actual
OS used in testing environment was Windows NT SP5.

Server Testing Environments

The following four testing environments were set up to approximate small, medium, large and extra-
large sized enterprises that have installed OfficeScan on their network workstations.
Note: All of the OfficeScan server testing machines were running Windows NT 4

16.0.1 Small Enterprise

• Processor: Intel Pentium® processor running at 166 MHz
• Memory: 128 MB RAM
• Network bandwidth: 10 Mbps

16.0.2 Medium Enterprise

• Processor: Dual Intel Pentium® II processors running at 266 MHz
• Memory: 512 MB RAM
• Network bandwidth: 100 Mbps

16.0.3 Large Enterprise

A Compaq Proliant ML 5500 server with the following configuration was used:

• Processor: Quad Intel Xeon® processors running at 400 MHz

• Memory: 1 GB RAM
• Network bandwidth: 100 Mbps
• Hard disk drive: Three SCSI 3 HDDs (Compaq 4 GB pluggable UW2 HDD operating at 7200
revolutions/sec) + RAID5 (using a Compaq Smart Array 3200 SCSI RAID card). Disk I/O 80
MegaBits/sec

16.0.4 Extra-Large Enterprise

A Compaq Proliant ML 570 server with the following configuration was used:

15
• Processor: Quad Intel Xeon® processors running at 700 MHz
• Memory: 1 GB RAM
• Network bandwidth: 100 Mbps
• Hard disk drive: Three SCSI 3 HDDs (Compaq 18 GB pluggable UW3 HDDs operating at 10,000
revolutions/sec) with RAID (Compaq Smart Array 3200 SCSI/RAID card). Disk I/O 160
Megabits/sec

OfficeScan Limitations
The following are the OfficeScan product limitations.
Note: Whenever the number of clients exceeds the limitation, the bandwidth might
be used heavily which may cause the user’s network environment to become
busy. This could lead to data loss or synchronization problems.

16.1 Small Enterprise

The maximum number of clients supported is 100.

16.2 Medium Enterprise

The maximum number of clients supported on a file-based OfficeScan server is 500. The maximum
number of clients supported on a HTTP-based OfficeScan server is 1000.

16.3 Large Enterprise

The maximum number of clients supported on a HTTP-based server is 1000 to 2000.

16.4 Extra Large Enterprise

The maximum number of clients supported on a HTTP-based server is 2000 to 5000.

16
Testing Results
The following is the OfficeScan performance report:

Note: Server-side performance is highly correlated with hard drive speed and disk I/O performance. The following testing results were
achieved on a server with a SCSI HDD with disk I/O of 80 MegaBits/second.
Client Programs Server Programs
Windows 95/98/ME Windows NT HTTP-based File-based
General Installation Data
Disk space 13.2 MB 12~13 MB 46.8 MB 42.7 MB
Memory usage 10~25 MB (process 12~18 MB 3~8 MB ignored
uses 9 MB but (average 5 MB)
system might
increase to 25 MB)
Handles usage 200~300 100~200 ignored
(average 128)
Page file 1600 KB 9000 ~ 10000 KB 900 ~ 1500 KB ignored
CPU usage 1% ignored ignored ignored
Processes 1 5 (4 services and 1 0
1 I/O Monitor)
Threads 6 32 18 0
File cache 24 KB 4000~5000 KB 2000~6000 KB 0
(average 2744 KB)

17
 Client Programs Server Programs
Windows 95/98/ME Windows NT HTTP-based File-based
Network Management Performance
Client Installation via Autopcc or Windows NT Remote Installation (per client)
Bandwidth usage 14 MB 18 MB
Installation time 3 min 3 min 1 min/client 1.2 min/client
Handles usage 100~150 0
Memory usage 700~1200 KB 0
Configuration
Handles usage 4 2 0
Memory usage 80 ~820 KB 0
Bandwidth usage 6 KB 5 KB 3~20 KB/client 40 ~90 KB/client
Sending Virus Logs
Handles usage 4 46
Memory usage 8 KB 400~800 KB
Bandwidth usage 1 KB 1 KB 3 KB/client 3 KB/ client

18
 Client Programs Server Programs
Windows 95/98/ME Windows NT HTTP-based File-based
Startup Report
Handles usage 8 ignored
Threads 1 1~2
Memory usage 0 20~40 KB
Bandwidth usage 2 KB 2 KB 1~8 KB/client 45~90 KB/client
(depends if there is a
new configuration)
Time usage Small = 0.48 sec
Medium 0.24 sec
Large =0.72 sec
Extra-large = 0.47 sec
Status Report (scan action report)
Handles usage 8 ignored
Threads 1 1~2
Memory usage 0 20 ~40 KB
Bandwidth usage 5 KB 5 KB 1~8 KB/client 45~90 KB/client
(depends if there is a
new configuration)
Time usage Small = 0.48 sec
Medium = 0.24 sec
Large = 0.72
Extra large = 0.47

19
 Client Programs Server Programs
Windows 95/98/ME Windows NT HTTP-based File-based
Shut Down Report
Handles usage 1
Threads 0
Memory usage 20 KB
Bandwidth usage 1 KB 1 KB 1 KB/client 1 KB/client
Pattern Update/Hot Fix Update

Bandwidth usage 5 KB + pattern size 5 KB notification +

pattern size
Handles usage 37
Memory usage 2~3 MB

Remote uninstall 20 clients

Bandwidth usage 1 KB 8 KB/client 200~300 KB/client
Handles usage 8
Memory usage 252K
File-base Polling
Bandwidth usage 0.4 KB/client

20
Recommendations
We make the following recommendations to customers who are planning to deploy OfficeScan
antivirus software to their network:

16.5 Small Enterprise

When the number of client software installations will be less than 100, the following environment is
sufficient to host the OfficeScan server:

• Processor: Intel Pentium® processor running at 166 MHz

• Memory: 128 MB RAM
• Hard disk drive: IDE hard disk
• Network bandwidth: Minimum 10 Mbps
• Operating system: Windows NT4.0 with SP4 or above using NTFS file system, IIS 4.0 or above

16.6 Medium Enterprise

When the number of client software installations is less than 1000, the following environment is
sufficient to host the OfficeScan server:

• Processor: Dual Intel Pentium® II processors running at 266 MHz or above

• Memory: 512 MB RAM
• Hard disk drive: SCSI hard disk drive
• Network bandwidth: Minimum 100 Mbps
• Operating system: Windows NT4.0 with SP4 or above using NTFS file system, IIS 4.0 or above
Note: For most enterprises, it is recommended that one OfficeScan server be
installed for every one thousand clients. Under this installation, it will take
approximately 4 minutes to have all 1000 clients report successfully to the
server. If you require faster performance, our recommendation is to install a
high performance HDD. Disk I/O is the single most important factor affecting
OfficeScan performance.

16.7 Large Enterprise

When the number of client software installations is less then 2000, the following environment is
sufficient to host the OfficeScan server:

• Processor: Quad Intel Pentium® II processors running at 350 MHz or above. Dual Intel Pentium®
III processors running at 700 MHz is also acceptable.
• Memory: 1 GB RAM
• Hard disk drive: SCSI 3 hard disk drive with RAID 5 disk mirroring where disk I/O is 80
MegaBits/sec
• Network bandwidth: Minimum 100 Mbps
• Operating system: Windows NT4.0 with SP4 or above using NTFS file system, IIS 4.0 or above

Under the above hardware environment, it will take approximately 12 minutes for the 2000 clients to
update their status to the server. If you require better performance, we recommend that you install a
high performance HDD.
Note: Resource-intensive software running on the OfficeScan server may cause
software malfunction, including sometimes preventing the OfficeScan client
from reporting to the server.

16.8 Extra Large Enterprise

When the number of client installations will not exceed 5000, we recommend that you dedicate a single
Windows NT server to running the OfficeScan server. This machine should not be the Primary domain
controller. It is strongly recommend that you do not install other software to the dedicate server,
especially resource-intensive software. It will take approximately 39 minutes for all clients to report to
the server successfully. Please remember that synchronizing the client status and generating a report
will take a long time to collect the required information.

In an extra-large enterprise, the following hardware environment is recommended:

• Processor: Quad Intel Xeon® processors running at 700 MHz or above. Select a Compaq ProLiant
or similar enterprise class server.
• Memory: 1 GB RAM
• Hard disk drive: SCSI 3 hard disk drive where disk I/O is 160 MegaBits/sec
• Network bandwidth: Minimum 100 Mbps
• Operating system: Windows NT4.0 with SP4 or above using NTFS file system, IIS 4.0 or above
Note: If you want to improve performance in an extra-large enterprise network,
enhancing hard disk drive performance is the single most important factor.
Adding RAM memory will also help, while upgrading to a faster processor will
probably not have a noticeable effect.
Note: If client report generation fails or takes a long time or causes a GPF with the
server service, please check the system environment. Low end machines, or
high end machines that are using resource intensive software often fail to
support 3000 clients.

OfficeScan 3.52 Release Note 22/22