I’m trying to take the temperature from the community here on an issue that I’ve seen pop up on a few of the computers at a few of my sites. I’ve lodged the issue with Trend now here in Australia, and I’ve started to hear from a few others around the world that they too might be experiencing the same issue. So what I’m trying to do is to use the power of the community to feedback to Trend some additional information so that they can better investigate and resolve the issue. If you are experiencing the issue I mention below, please lodge the case with your local Trend support line and then let me know directly via email your case number. What I’ll do with that is to pass it on to the Trend Product team so that they can look at the issues as one rather than individually. My email address is [email protected]
The issue I’m talking about seems to affect CSM 3.6 for SMB only. What occurs is that a few (maybe 1 or 2) computers in a network with CSM 3.6 installed will take abnormally long to start up and be VERY slow for some time after it’s booted up. From my investigations I have seen large amounts of disk activity and the TSC.EXE (Trend System Cleaner) running hard on CPU. Initially I thought it was as a result of an infection and that TSC was doing it’s job cleaning the system, however this now appears to not be the case. Other potentially unrelated aspects to this may be error messages indicating that the client is out of system resources and the like. I must stress that this issue does not affect ALL systems. Certainly out of the many hundreds of Trend clients we have, we’ve seen it now on a total of 6 PCs across all of them. From what I can see, it does not affect Vista clients, only XP and 2000 clients. It does not seem to affect 2003 servers themselves either.
So if you have this problem – please – let me know so that we can help resolve it sooner than individual cases might allow.
8th December 2007 Update – Trend have released patches and fixes for this – please see my blog post for more information
Hi Wayne,
As you know, we’re running CSM 3.6 – we are seeing severe performance issues affecting several machines around the network, including my own.
I’ll keep a closer eye on things and see if I can spot tsc.exe causing the issues here as well. Yesterday we assumed that it was SQL that was causing the slowdowns. After kicking everybody out and rebooting the server the performance of SQL related applications improved, but this morning I see things are slowing down again.
Wayne, I have one SBS server with 20 workstations where I’ve seen the same situation as you described – affecting a single computer. I, too, thought the computer wa infected. At the time I completely uninstalled and reinstalled the Trend Client. I will be on site on Wed and will try to see if I can gather any other info.
I am not sure if this is exactly the same thing that you are experiencing. But we have started noticing major issues with Trend Micro SMB 3.6.
We have had 5 clients that have had random server crashes or workstations give error messages like ‘Out of Resource’ errors. The common thread has been that they have had the Trend Micro Client 3.6 installed on them.
Apparently there is a flaw in the scan engine that is is leaking paged pool memory and then causing the machines to ‘crash’.
I spoke to Trend Micro on 11/20/07 and they said they are ‘overwhelmed’ with the issue (even though there was no notice on their website about a problem – Thanks Trend!).
Their development team is trying to come up with a fix for the problem. They sent me the following work around that applies to Windows XP, 2000, and Sever 2003:
The following are the workarounds that their tech team sent to me:
Note: Option 1 is considered a more effective approach as it guarantees larger additional space to hold virus pattern.
Option 1: Enlarge paged pool – reboot required
1. Open the Registry Editor (regedit.exe).
Important: Always make a back up copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
2. Go to HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.
3. Look for the “PagedPoolSize” key and change its value to ” 0xFFFFFFFF”.
4. Reboot the server.
Option 2: Enable SystemMapView reboot required (for VSAPI 8.55-1001)
1. Open the Registry Editor (regedit.exe).
Important: Always make a back up copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
2. Go to HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters.
3. Add a new DWORD value called “EnableSystemView” then assign it a value of “1”.
4. Reboot the server.
Important: If there is a startup option “/3GB” in boot.ini for the server, these workaround will not work.
Thank you,
Trend Micro Support Center
We have Client Server Messaging Suit3 3.6. We are also facing same problem with our XP OS installed client. I have inquired with Trend and they have send some hoxfix. But still problem has not sloved.
One of our clients have a similar problem that has been occurring regularly with workstations giving error messages like “Insufficient System Ressources”, when attempting to open a file on a network drive.
It happens randomly on different computers and at varying times. Not everyone is affected at the same time.
They are running CSM 3.6 for SMB. We have now implemented Option 1 (Enlarged paged pool) as recommended as a workaround and are waiting to see if that solves the problem.
Btw – I couldn’t see any notes on Trend’s web site yet…
Regards
I thought it was a dodgy MS Update!
Clients have experienced network drives randomly unavailable, insufficient resource errors, you do not have permission and other messages.
Slow boot has also been an issue.
Since we have been using Trend Worry Free Remote Manager we have started to ensure our 40 or so sites were up to 3.6. I think I may put this on hold for a while!
I’ll open a case with Trend tomorrow. And I’ll make the change in Option 1 and let you know.
50 workstations upgraded to 3.6 with a hugh performance drop as result. It noxw takes for some people more then 10 (!) minutes before their PC is started up.
We had four machines running 2000 client, and we had four machines toasted.
I have a client that is experiencing similar problems on multiple PCs that run Trend Micro Internet Security 2007. This problem has just started to occur recently. Has anyone else experienced this? Is there a common code base?
For about a month now I’ve had about 5 of my 25 client workstations (all XP Pro) getting the Insufficient System Resources when trying to access network drives on two Windows 2003 Storage Edition Servers. Running in an SBS environment on two week old hardware and a clean install of SBS2003 (did it before the hardware upgrade as well). Could this have anything to do with a MS patch that was forced via Windows Update? The reason I ask is I was running Trend CSM 3.6 without issue for quite awhile before this started to happen!
out of resources on 3 of 20 clients when accessing the shared drive, using TM CSM 3.6, just installed on server 2003 SMB and on 25 clients. We used to use office scan, but I uninstalled officescan on each client and loaded the server version. Wow, I look stupid to the boss now.
It affected one SBS 2003 R2 and one XP client (at the same site) in my case. Trend Micro confirmed the registry work around. EventID’s of 2020 and 1009 were what they wanted to see to confirm the problem. In my case I manage the server by RDP. The first symptoms were I couldn’t RDP or RWW to the server. I could establish a VPN connection, stop all the Trend Micro services, then RDP and RWW would work again.
We’ve seen this at a few clients now in the last month. Trend just got back to me today with the pagepool and memorymap fix mentioned above. Trends solution on changing the registry is kinda sad – they should create a tool to push this out to clients though the management IMHO.
I’m going to thy the fix on a few machines today and see if this helps. We have also seen this affect a server.
We have directly experienced the loss of connectivity issue here (QB access to data file on server share). We have lots of clients with SBS2K3 that have reported various issues that appear to be related to this issue (CAD, Timberline/Acctg, Access 2003 program, network shares dropped, etc.). I called TM today: Service Request #: 1-120905334 and have applied the Option 1 fix to various computers. Jerome at Trend Micro Support Center told me that they continue to work on a solution and that one would be coming out (not date).
In our case it appears that the size of the pattern file (which continues to get larger as new updates are distributed) is the problem. The programmers at Trend Micro are rewriting the program to handle it within the default parameters provided by MS not have us change the registry settings to accomodate their program/process.
I also have a problem with very slow startup on one of my PCs, with tsc.exe hogging the CPU for 10 minutes.
Looking at the problem with some of the SysInternals tools, tsc.exe reads 230 MByte of files duing the first system startup each day (but less on subsequent startups), which is equivalent to the data read by all the other processes put together. Using Filemon I can see that it is reading various exe files, but seems to repeat the same cycle of file reads, so that, for example the point32.exe is read a significant number of times.
We recently stopped selling Computer Associates eTrust and moved to Trend SMB. We have it installed at two clients and they both experience very poor performance on all their XP machines. Their older machines are the worst. We installed an eval version at a third client, and after 3 days, I had to spend as much as 8 hours on my own dime, pulling it from their computers and installing eTrust. I have quit selling Trend until they come up with a solution.
We have had a long standing problem with these issues. Users taking 10 or more minutes to login to the call handling system, IE, Word, Outlook etc but strangely as mentioned above not on all machines. Unloading or disabling “Runtime” service gets rid of the problems and on trying Avast there were also no problems. Our software house has given us the old “not seen it on other sites” routine and applied fixes and patches recently released so my ntrtscan is now at 1161. An engineer from the software house renamed the user profiles on a machine and a slight improvement was seen – but not much! I have also noticed that the “Update in progress” seems to hang around for a long time and the machines (including mine) do get better with continual restarting. However browing network drives is always slow to respond until I implement one of the above when it becomes almost instantaneous to show the files in the selected folder.
Slightly different problem – we have a client running SBS2K3 and we installed Trend Client Server Security last week. It has somehow killed Remote Desktop services. Cannot reach their network from outside, except the SBS Webpage and RWW. And internally, no machines can RDP to another. In the Security Dashboard, Trend cannot list any workstations, OR servers; but if we pick a machine out of the ADUC list and try to install antivirus client, it reports that it is already installed. So all the clients have AV running, but Trend cannot centrally discover/manage them. Any ideas?