OfficeScan 10.6 Administrator's Guide - Trend Micro™ Online Help

Scanning for Security Risks
Clients build the digital signature cache file according to a schedule, which is
configurable from the web console. Clients do this to:
• Add the cache for new files that were introduced to the system since the last cache
file was built
• Remove the cache for files that have been modified or deleted from the system
During the cache building process, clients check the following folders for trustworthy
files and then adds the caches for these files to the digital signature cache file:
• %PROGRAMFILES%
• %WINDIR%
The cache building process does not affect a computer’s performance because clients
use minimal system resources during the process. Clients are also able to resume a cache
building task that was interrupted for some reason (for example, when the host machine
is powered off or when a wireless computer’s AC adapter is unplugged).
On-demand Scan Cache
The on-demand scan cache file is used during Manual Scan, Scheduled Scan, and Scan
Now. Clients do not scan files whose caches have been added to the on-demand scan
cache file.
Each time scanning runs, the client checks the properties of threat-free files. If a
threat-free file has not been modified for a certain period of time (the time period is
configurable), the client adds the cache of the file to the on-demand scan cache file.
When the next scan occurs, the file will not be scanned if its cache has not expired.
The cache for a threat-free file expires within a certain number of days (the time period
is also configurable). When scanning occurs on or after the cache expiration, the client
removes the expired cache and scans the file for threats. If the file is threat-free and
remains unmodified, the cache of the file is added back to the on-demand scan cache
file. If the file is threat-free but was recently modified, the cache is not added and the file
will be scanned again on the next scan.
6-59