Client Server Messaging Security 3.5/3.6 Issues – Resolution

Problems

1. Machine boots up slowly with heavy disk IO

2. Computer performance is slow during start up and DCE (tsc.exe) keeps running for a long time after start up

3. High memory utilization

4. Overuse of kernel memory prevents the system drivers and applications from working properly

Phenomenon, Root cause, Solutions, and References of the Problems

1. Machine boots up slowly with heavy disk IO

Phenomenon: Heavy disk IO causes the machine to boot slowly. Using a performance monitor to observe the CSA process (pccntmon.exe), the IO graph peaks continuously.

Fig. 1: Performance of the CSA process using a performance monitor

Root Cause: A CSA function needs to traverse the CSA folder. If the login user profile setting (My Documents path) is on a remote machine, this problem arises.

Solution: CSM 3.6 hotfix 1142 (already released). Customers may either get the hotfix through tech-support, or wait for CSM 3.5/3.6 2007 Q4 patch that include this hotfix (available December 15). Customers may download the patch from the following URL:

Client Server Messaging Security:

http://www.trendmicro.com/download/product.asp?productid=39

Client Server Security: http://www.trendmicro.com/download/product.asp?productid=40

Reference: Refer to the following Solution Bank entry: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034528&id=EN-1034528

2. System performance drop down and become slow during start up. DCE (TSC.exe) keeps running for a long time after start up. Ntrtscan.exe s CPU utilization is high.

Phenomenon: Slow start up and tsc.exe is running for extended periods.

Root Cause: When CSA starts, by default, TSC.exe scans for Trojans. Typically, it takes about 10 seconds to complete the scan. However, in a few environments TSC.exe needs much longer times to scan; up to 10 minutes to complete the scan.

Solution: CSM 3.6 hotfix 1159 (already released).
Customers may either get the hot fix through tech-support then follow the hotfix instruction to apply it, or wait for the CSM 3.5/3.6 2007 Q4 patch that includes this hot fix (available December 15). Customers may download the patch from the following URL:

Client Server Messaging Security: http://www.trendmicro.com/download/product.asp?productid=39

Client Server Security: http://www.trendmicro.com/download/product.asp?productid=40

3. High memory utilization

Phenomenon: The memory utilization of CSA increased rapidly after October 2007.

Root Cause: Many new samples have been added to the virus/spyware pattern (signature file) causing its size to increase drastically.

Solution: Trend Micro has optimized the pattern file and released the downsized spyware pattern (5.75) on 11/28/2007. The new pattern reduces at least 15~20 MB memory.
Trend Micro continuously strives to optimize the size of the patterns files.

4. Overuse of kernel memory prevents the system drivers and applications from working properly

Phenomenon: CSA s system resource (kernel mode memory) usage is very high and prevents other applications and/or system drivers from working properly.

Root Cause: Scan Engine 8.55 (released on 10/31/2007) disabled the SystemMapView option, to fix a conflict with Express Mail Server. Disabling the option increased kernel memory utilization by 18~20MB. The growing virus pattern (LPT$VPN.*) also uses kernel memory.

Solution: Enable the SystemMapView option and set the PagePoolSize option to the maximum value.

Customers can contact technical support and ask for the hotfix and a server-side tool that can automate this process for all clients.

Note: These settings are retained during upgrades.