RE: Computers becoming unresponsive accross entire network.
Fwiw, we are implementing such a system (basically, by creating an additional layer between the engine and the detection, so if a detection starts to spin, it will get stopped). We have been testing it and the results look quite promising (it will take some time to get into the engine, though, as it's not trivial). If you're curious, I wrote a little technical bulletin on what happened Friday here: http://forums.sunbeltsoftware.com/messageview.aspx?catid=27threadid=4653enterthread=y Alex -Original Message- From: Ken Schaefer [mailto:k...@adopenstatic.com] Sent: Monday, May 10, 2010 9:58 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Who knows, but if the machine is pre-empting the AV scanner, then that's how the issue that Kurt highlighted yesterday starts to creep in. Your malicious code gets to do something in between the various bits of code that the AV scanner is running. So, I agree with Ben. For a regular disk-scan, a cap might be good (or lower scheduling priority). For on-access scanning, I think you want to the AV scanner to run at high priority and avoid being pre-empted if possible. Cheers Ken -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Sent: Tuesday, 11 May 2010 12:07 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. But doesn't that beg the question; should an AV app EVER require 75% of a machines resources for ANYTHING? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Monday, May 10, 2010 9:02 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. On Sun, May 9, 2010 at 6:03 PM, Andrew S. Baker asbz...@gmail.com wrote: Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... For a general system scan, that sounds like a good idea. But for on-access scans (real time, auto protect, whatever you call it), I think you'd want the system to run it as fast as possible. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Good write-up, thanks for providing that. I am curious however, 75000 new pieces of malware daily? Phillip Partipilo Parametric Solutions Inc. Jupiter, Florida (561) 747-6107 -Original Message- From: Alex Eckelberry [mailto:al...@sunbelt-software.com] Sent: Tuesday, May 11, 2010 9:30 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Fwiw, we are implementing such a system (basically, by creating an additional layer between the engine and the detection, so if a detection starts to spin, it will get stopped). We have been testing it and the results look quite promising (it will take some time to get into the engine, though, as it's not trivial). If you're curious, I wrote a little technical bulletin on what happened Friday here: http://forums.sunbeltsoftware.com/messageview.aspx?catid=27threadid=4653enterthread=y Alex -Original Message- From: Ken Schaefer [mailto:k...@adopenstatic.com] Sent: Monday, May 10, 2010 9:58 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Who knows, but if the machine is pre-empting the AV scanner, then that's how the issue that Kurt highlighted yesterday starts to creep in. Your malicious code gets to do something in between the various bits of code that the AV scanner is running. So, I agree with Ben. For a regular disk-scan, a cap might be good (or lower scheduling priority). For on-access scanning, I think you want to the AV scanner to run at high priority and avoid being pre-empted if possible. Cheers Ken -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Sent: Tuesday, 11 May 2010 12:07 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. But doesn't that beg the question; should an AV app EVER require 75% of a machines resources for ANYTHING? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Monday, May 10, 2010 9:02 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. On Sun, May 9, 2010 at 6:03 PM, Andrew S. Baker asbz...@gmail.com wrote: Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... For a general system scan, that sounds like a good idea. But for on-access scans (real time, auto protect, whatever you call it), I think you'd want the system to run it as fast as possible. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Anyone else getting this when they try to goto Sunbelt's Message of the Day (May 7th) from within Vipre? The web site you are accessing has experienced an unexpected error. Please contact the website administrator. The following information is meant for the website developer for debugging purposes. Error Occurred While Processing Request Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Invalid object name 'munchkin_links'. The error occurred in D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 279 : /cfquery 280 : !--- Marketo: Munchkin code + links --- 281 : cfquery datasource='sunbelt' name='master_munchkin_links' cachedwithin='#master_cache_timespan#' 282 : select * from munchkin_links where active = 1 283 : /cfquery SQLSTATE 42S02 SQL select * from munchkin_links where active = 1 VENDORERRORCODE 208 DATASOURCE sunbelt Resources: Check the ColdFusion documentation http://www.macromedia.com/go/proddoc_getdoc to verify that you are using the correct syntax. Search the Knowledge Base http://www.macromedia.com/support/coldfusion/ to find a solution to your problem. Browser Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Remote Address XXX.XXX.XXX.XXX Referrer http://www.sunbeltsoftware.com/MOTD/401/?license=XXX version=3.1.3121.0 http://www.sunbeltsoftware.com/MOTD/401/?license=XX Xversion=3.1.3121.0 Date/Time 10-May-10 09:25 AM From: Andrew S. Baker [mailto:asbz...@gmail.com] Sent: Sunday, May 09, 2010 6:03 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... -ASB: http://XeeSM.com/AndrewBaker On Sun, May 9, 2010 at 5:39 PM, Ben Scott mailvor...@gmail.com wrote: On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
That's what they get for using CF. ;-) Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: David Mazzaccaro [mailto:david.mazzacc...@hudsonhhc.com] Sent: Monday, May 10, 2010 9:25 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Anyone else getting this when they try to goto Sunbelt's Message of the Day (May 7th) from within Vipre? The web site you are accessing has experienced an unexpected error. Please contact the website administrator. The following information is meant for the website developer for debugging purposes. Error Occurred While Processing Request Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Invalid object name 'munchkin_links'. The error occurred in D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 279 : /cfquery 280 : !--- Marketo: Munchkin code + links --- 281 : cfquery datasource='sunbelt' name='master_munchkin_links' cachedwithin='#master_cache_timespan#' 282 : select * from munchkin_links where active = 1 283 : /cfquery SQLSTATE 42S02 SQL select * from munchkin_links where active = 1 VENDORERRORCODE 208 DATASOURCE sunbelt Resources: Check the ColdFusion documentationhttp://www.macromedia.com/go/proddoc_getdoc to verify that you are using the correct syntax. Search the Knowledge Basehttp://www.macromedia.com/support/coldfusion/ to find a solution to your problem. Browser Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Remote Address XXX.XXX.XXX.XXX Referrer http://www.sunbeltsoftware.com/MOTD/401/?license=XXXversion=3.1.3121.0 Date/Time 10-May-10 09:25 AM From: Andrew S. Baker [mailto:asbz...@gmail.com] Sent: Sunday, May 09, 2010 6:03 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... -ASB: http://XeeSM.com/AndrewBaker On Sun, May 9, 2010 at 5:39 PM, Ben Scott mailvor...@gmail.commailto:mailvor...@gmail.com wrote: On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.commailto:al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Looks like a transient issue. Are you still finding this to be the case? From: David Mazzaccaro [mailto:david.mazzacc...@hudsonhhc.com] Sent: Monday, May 10, 2010 9:25 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Anyone else getting this when they try to goto Sunbelt's Message of the Day (May 7th) from within Vipre? The web site you are accessing has experienced an unexpected error. Please contact the website administrator. The following information is meant for the website developer for debugging purposes. Error Occurred While Processing Request Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Invalid object name 'munchkin_links'. The error occurred in D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 279 : /cfquery 280 : !--- Marketo: Munchkin code + links --- 281 : cfquery datasource='sunbelt' name='master_munchkin_links' cachedwithin='#master_cache_timespan#' 282 : select * from munchkin_links where active = 1 283 : /cfquery SQLSTATE 42S02 SQL select * from munchkin_links where active = 1 VENDORERRORCODE 208 DATASOURCE sunbelt Resources: Check the ColdFusion documentationhttp://www.macromedia.com/go/proddoc_getdoc to verify that you are using the correct syntax. Search the Knowledge Basehttp://www.macromedia.com/support/coldfusion/ to find a solution to your problem. Browser Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Remote Address XXX.XXX.XXX.XXX Referrer http://www.sunbeltsoftware.com/MOTD/401/?license=XXXversion=3.1.3121.0 Date/Time 10-May-10 09:25 AM From: Andrew S. Baker [mailto:asbz...@gmail.com] Sent: Sunday, May 09, 2010 6:03 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... -ASB: http://XeeSM.com/AndrewBaker On Sun, May 9, 2010 at 5:39 PM, Ben Scott mailvor...@gmail.commailto:mailvor...@gmail.com wrote: On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.commailto:al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
It's not a bad idea and we'll look into it. -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Sunday, May 09, 2010 5:39 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
It works now. thx From: Alex Eckelberry [mailto:al...@sunbelt-software.com] Sent: Monday, May 10, 2010 11:14 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Looks like a transient issue. Are you still finding this to be the case? From: David Mazzaccaro [mailto:david.mazzacc...@hudsonhhc.com] Sent: Monday, May 10, 2010 9:25 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Anyone else getting this when they try to goto Sunbelt's Message of the Day (May 7th) from within Vipre? The web site you are accessing has experienced an unexpected error. Please contact the website administrator. The following information is meant for the website developer for debugging purposes. Error Occurred While Processing Request Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Invalid object name 'munchkin_links'. The error occurred in D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 281 Called from D:\inetpub\wwwroot\app_2008_vars.cfm: line 1 Called from D:\inetpub\wwwroot\Application.cfm: line 21 279 : /cfquery 280 : !--- Marketo: Munchkin code + links --- 281 : cfquery datasource='sunbelt' name='master_munchkin_links' cachedwithin='#master_cache_timespan#' 282 : select * from munchkin_links where active = 1 283 : /cfquery SQLSTATE 42S02 SQL select * from munchkin_links where active = 1 VENDORERRORCODE 208 DATASOURCE sunbelt Resources: Check the ColdFusion documentation http://www.macromedia.com/go/proddoc_getdoc to verify that you are using the correct syntax. Search the Knowledge Base http://www.macromedia.com/support/coldfusion/ to find a solution to your problem. Browser Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Remote Address XXX.XXX.XXX.XXX Referrer http://www.sunbeltsoftware.com/MOTD/401/?license=XXX version=3.1.3121.0 Date/Time 10-May-10 09:25 AM From: Andrew S. Baker [mailto:asbz...@gmail.com] Sent: Sunday, May 09, 2010 6:03 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... -ASB: http://XeeSM.com/AndrewBaker On Sun, May 9, 2010 at 5:39 PM, Ben Scott mailvor...@gmail.com wrote: On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben . . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
On Sun, May 9, 2010 at 6:03 PM, Andrew S. Baker asbz...@gmail.com wrote: Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... For a general system scan, that sounds like a good idea. But for on-access scans (real time, auto protect, whatever you call it), I think you'd want the system to run it as fast as possible. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
But doesn't that beg the question; should an AV app EVER require 75% of a machines resources for ANYTHING? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Monday, May 10, 2010 9:02 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. On Sun, May 9, 2010 at 6:03 PM, Andrew S. Baker asbz...@gmail.com wrote: Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... For a general system scan, that sounds like a good idea. But for on-access scans (real time, auto protect, whatever you call it), I think you'd want the system to run it as fast as possible. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
On Mon, May 10, 2010 at 12:06 PM, Charlie Kaiser charl...@golden-eagle.org wrote: But doesn't that beg the question; should an AV app EVER require 75% of a machines resources for ANYTHING? Software that needs resources will use as many of them as it can. Using less of them but leaving the rest of the system idle is pointless. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
Capping the usage at 80-90% of available processing power, however, is not as useless. -ASB: http://XeeSM.com/AndrewBaker On Mon, May 10, 2010 at 12:11 PM, Ben Scott mailvor...@gmail.com wrote: On Mon, May 10, 2010 at 12:06 PM, Charlie Kaiser charl...@golden-eagle.org wrote: But doesn't that beg the question; should an AV app EVER require 75% of a machines resources for ANYTHING? Software that needs resources will use as many of them as it can. Using less of them but leaving the rest of the system idle is pointless. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
On Mon, May 10, 2010 at 12:49 PM, Andrew S. Baker asbz...@gmail.com wrote: Software that needs resources will use as many of them as it can. Using less of them but leaving the rest of the system idle is pointless. Capping the usage at 80-90% of available processing power, however, is not as useless. If the system has no other use for a resource, why not put it to work? What benefit is there to putting the system in an idle loop for 10-20% of wall clock time? Conversely, if you're trying to get other work done, having only 10-20% of system resources available to you likely isn't going to be enough. I think what you're really looking for is lower priority. If the system has nothing else to do, might as well use it to make the AV get done quicker. But if the system has anything else to do, put resources towards that, and make the AV wait. Yah? (Again, this is for the full system scan scenario. On-access scanning has different parameters.) -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
I think what you're really looking for is lower priority. If the system has nothing else to do, might as well use it to make the AV get done quicker. But if the system has anything else to do, put resources towards that, and make the AV wait. Sure, All of this debate point blank surrounds software failing at an earlier process and we neglect trying to fix it there? Reminds me a demo I had last year online: The guy shared his screen and didn't release Visual Studio was running, the module he was working on was crash protection. It worked by zipping the project LITERALLY every minute or so and restarting and reopening when it shit the bed. I thought you have got to be kidding me, next. To avoid being inflammatory I have neglected to chime in and state I have NEVER had an FP or a machine overwhelmed by ForeFront and MS has not released a bad dat that frankly simply failed QA. Whether or not a fan boy from another product can argue on any other premise of that software, its proof it *can* be done right without treating the fallout instead of the root cause. If you told me Vendor A who has continued to release poorly written updates that wreak havoc on my network can be mitigated by controlling the severity of their wreckage, do you *really* think I am interested? Uhm, no. I'd rather they learn how to get it right. jlc ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
On Mon, May 10, 2010 at 3:20 PM, Joseph L. Casale jcas...@activenetwerx.com wrote: To avoid being inflammatory I have neglected to chime in and state I have NEVER had an FP or a machine overwhelmed by ForeFront and MS has not released a bad dat that frankly simply failed QA. To the best of my knowledge, both the recent Sunbelt and McAfee bugs made it through QA. I think the implicit assumption here is that all software has bugs. My own experience backs this up. The ideas under discussion are to minimize collateral damage when problems occur. That's why OSes have implement memory protection between processes -- so if one process blows up, it doesn't take down everything. Etc. I've certainly encountered countless bugs in other Microsoft software, and I find it unlikely in the extreme that the Forefront people know how to create bug-free software. I will certainly agree that some software/companies have more bugs than others. Perhaps Forefront is indeed better in that regard; I wouldn't know. But perfection? No. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Who knows, but if the machine is pre-empting the AV scanner, then that's how the issue that Kurt highlighted yesterday starts to creep in. Your malicious code gets to do something in between the various bits of code that the AV scanner is running. So, I agree with Ben. For a regular disk-scan, a cap might be good (or lower scheduling priority). For on-access scanning, I think you want to the AV scanner to run at high priority and avoid being pre-empted if possible. Cheers Ken -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Sent: Tuesday, 11 May 2010 12:07 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. But doesn't that beg the question; should an AV app EVER require 75% of a machines resources for ANYTHING? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Monday, May 10, 2010 9:02 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. On Sun, May 9, 2010 at 6:03 PM, Andrew S. Baker asbz...@gmail.com wrote: Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... For a general system scan, that sounds like a good idea. But for on-access scans (real time, auto protect, whatever you call it), I think you'd want the system to run it as fast as possible. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
Or something that ensures that no more than 75% of remaining CPU will ever be consumed by the AV app and its processes... -ASB: http://XeeSM.com/AndrewBaker On Sun, May 9, 2010 at 5:39 PM, Ben Scott mailvor...@gmail.com wrote: On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.com wrote: And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. Would it be feasible to build some kind of governor into the scan-engine, such that if a scan on a single file takes more than a given amount of CPU time, the scan is assumed to have gone haywire, and will be throttled or killed? With suitable administrator alerts, of course. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
What happens if you unplug the network cable? Able to look at taskman on any of them? -sc -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
It is/was a Vipre issue. Force a defs update and you'll be good. Must have been a bad def. Luke tesla...@gmail.com 5/7/2010 10:56 AM The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ Confidentiality Notice: This e-mail message, including attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Is active protection on and is it set to scan all files on open for the policy group? Start looking at the policies and see if those are doing it. If you're in one policy and your colleague in another, look at the difference between the two policies. Good luck. Jason -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 9:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ -- The pages accompanying this email transmission contain information from MJMC, Inc., which is confidential and/or privileged. The information is to be for the use of the individual or entity named on this cover sheet. If you are not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, or copying of this communication is strictly prohibited. If you received this transmission in error, please immediately notify us by telephone so that we can arrange for the retrieval of the original document. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
From Sunbelt support Everyone, IT is working on getting the support forums back online. Regarding the 100% CPU usage issue, the next set of defs will alleviate this issue. The new defs version should be 6275 and should be available shortly. Sorry for any inconvenience! John W. Cook Systems Administrator Partnership For Strong Families 315 SE 2nd Ave Gainesville, Fl 32601 Office (352) 393-2741 x320 Cell (352) 215-6944 Fax (352) 393-2746 MCSE, MCTS, MCP+I, A+, N+, VSP4, VTSP4 -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ CONFIDENTIALITY STATEMENT: The information transmitted, or contained or attached to or with this Notice is intended only for the person or entity to which it is addressed and may contain Protected Health Information (PHI), confidential and/or privileged material. Any review, transmission, dissemination, or other use of, and taking any action in reliance upon this information by persons or entities other than the intended recipient without the express written consent of the sender are prohibited. This information may be protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other Federal and Florida laws. Improper or unauthorized use or disclosure of this information could result in civil and/or criminal penalties. Consider the environment. Please don't print this e-mail unless you really need to. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Scheduled scan's running...did you run scheduled scans in the past? Task Manager to see what is beating them down -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Have you been reading this list this morning at all?! :) If not, then go ahead and catch up. You've already found the answer on your own, the earlier posts will just solidify it for you. Don Guyer Systems Engineer - Information Services Prudential, Fox Roach/Trident Group 431 W. Lancaster Avenue Devon, PA 19333 Direct: (610) 993-3299 Fax: (610) 650-5306 don.gu...@prufoxroach.com -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Yes, Saw some posts about 100% CPU Usage but have been too busy answering the phone to really read through any of them ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
Sallah: [catches def and points to dead server] Bad defs. On Fri, May 7, 2010 at 11:29 AM, Tom Miller tmil...@hnncsb.org wrote: It is/was a Vipre issue. Force a defs update and you'll be good. Must have been a bad def. Luke tesla...@gmail.com 5/7/2010 10:56 AM The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ Confidentiality Notice: This e-mail message, including attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Hardly able to open taskmgr... Once it finally opens the computer has returned to normal operation. It's no use at that point. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Turned out to be a bad Deff. Bad def = 6274. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Agreed!! ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Wait a minute - You whole-heartedly agree with ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ? Luke tesla...@gmail.com wrote on 05/07/2010 10:46:31 AM: Agreed!! ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
I have a box with 6273 that's just sitting here spinning at full throttle. Nobody really uses it, I figured I would let it keep spinning in case it was an isolated thing that support could look at. Phillip Partipilo Parametric Solutions Inc. Jupiter, Florida (561) 747-6107 -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 11:43 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. You are right... Def 6274. seems to be the bad deff. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Ok. That is two bad defs in two weeks? 1 Vipre 1 McAfee? Next is Trend? -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 11:45 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Turned out to be a bad Deff. Bad def = 6274. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
knock on wood. On Fri, May 7, 2010 at 10:47 AM, David W. McSpadden dav...@imcu.com wrote: Ok. That is two bad defs in two weeks? 1 Vipre 1 McAfee? Next is Trend? -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 11:45 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Turned out to be a bad Deff. Bad def = 6274. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
I bet this one doesn't make national news though... From: Tom Miller [mailto:tmil...@hnncsb.org] Sent: Friday, May 07, 2010 10:29 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. It is/was a Vipre issue. Force a defs update and you'll be good. Must have been a bad def. Luke tesla...@gmail.com 5/7/2010 10:56 AM The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ Confidentiality Notice: This e-mail message, including attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
You better knock, knock, knock on wood, baby Whooo Phillip Partipilo Parametric Solutions Inc. Jupiter, Florida (561) 747-6107 From: Steve Ens [mailto:stevey...@gmail.com] Sent: Friday, May 07, 2010 11:49 AM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. knock on wood. On Fri, May 7, 2010 at 10:47 AM, David W. McSpadden dav...@imcu.commailto:dav...@imcu.com wrote: Ok. That is two bad defs in two weeks? 1 Vipre 1 McAfee? Next is Trend? -Original Message- From: Luke [mailto:tesla...@gmail.commailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 11:45 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Turned out to be a bad Deff. Bad def = 6274. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
How the @#* do you force an update to 6275 on a machine that is pretty much unresponsive? VIPRE console says Inactive, which seems in this case to apply to the whole machine... -- RMc Tom Miller tmil...@hnncsb.org wrote on 05/07/2010 10:29:22 AM: It is/was a Vipre issue. Force a defs update and you'll be good. Must have been a bad def. Luke tesla...@gmail.com 5/7/2010 10:56 AM The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ Confidentiality Notice: This e-mail message, including attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
I had one office that took the update fine and deployed to all machines, but another office doesn't seem to want to go either...stuck on the 6274. On Fri, May 7, 2010 at 10:54 AM, richardmccl...@aspca.org wrote: How the @#* do you force an update to 6275 on a machine that is pretty much unresponsive? VIPRE console says Inactive, which seems in this case to apply to the whole machine... -- RMc Tom Miller tmil...@hnncsb.org wrote on 05/07/2010 10:29:22 AM: It is/was a Vipre issue. Force a defs update and you'll be good. Must have been a bad def. Luke tesla...@gmail.com 5/7/2010 10:56 AM The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ Confidentiality Notice: This e-mail message, including attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
Re: Computers becoming unresponsive accross entire network.
You've got to kill it and start over man That deff really grabs the machine by the ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
Just to clarify for everyone, what happened was the following: Customers running a scan with definition versions 6272, 6273 or 6274 would often experience extremely high CPU usage when running a scan. This became apparent when agents started running scans, in most cases at 1 AM EDT (the default time). If an agent didn't run a scan, nothing happened. The issue started with definition 6272, released yesterday evening. The issue was caused by a virus detection (Virus.VBS.Redlof.f) that caused a loop condition when hitting a file of a certain type and size. This problem was fixed in definitions version 6275, which was released at 10:30 am EDT this morning. As the KB below explains, getting out of this loop state required killing the service, or shutting down VIPRE. http://support.sunbeltsoftware.com/Default.aspx?answerid=2015 Yes, it sucks. The only positive thing I can look at is that a number of systems kicked in internally that were not there in the past and we were able to fix the problem in a few minutes and release defs once our engineers diagnosed the problem. And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. We are expanding our test-bed and seeing what else we can do to mitigate this type of thing from happening again. Alex Alex Eckelberry, CEO Sunbelt Software 33 N. Garden Avenue, Clearwater, FL 33755 p: 727-562-0101 x220 e: a...@sunbeltsoftware.com MSN: alex...@hotmail.com w: www.sunbeltsoftware.com b: www.sunbeltblog.com -Original Message- From: Greg Olson [mailto:gol...@markettools.com] Sent: Friday, May 07, 2010 1:05 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We completely removed Vipre from one PC that was having trouble and it seemed to fix the problem. The PC has been running fine since. Any thoughts? ~ Finally, powerful endpoint security
RE: Computers becoming unresponsive accross entire network.
Thank you for the update. What's interesting is my 2003 servers were not impacted, just my 2008 servers (only the first CPU) and some XP machines. Alex Eckelberry al...@sunbelt-software.com 5/7/2010 1:40 PM Just to clarify for everyone, what happened was the following: Customers running a scan with definition versions 6272, 6273 or 6274 would often experience extremely high CPU usage when running a scan. This became apparent when agents started running scans, in most cases at 1 AM EDT (the default time). If an agent didn't run a scan, nothing happened. The issue started with definition 6272, released yesterday evening. The issue was caused by a virus detection (Virus.VBS.Redlof.f) that caused a loop condition when hitting a file of a certain type and size. This problem was fixed in definitions version 6275, which was released at 10:30 am EDT this morning. As the KB below explains, getting out of this loop state required killing the service, or shutting down VIPRE. http://support.sunbeltsoftware.com/Default.aspx?answerid=2015 Yes, it sucks. The only positive thing I can look at is that a number of systems kicked in internally that were not there in the past and we were able to fix the problem in a few minutes and release defs once our engineers diagnosed the problem. And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. We are expanding our test-bed and seeing what else we can do to mitigate this type of thing from happening again. Alex Alex Eckelberry, CEO Sunbelt Software 33 N. Garden Avenue, Clearwater, FL 33755 p: 727-562-0101 x220 e: a...@sunbeltsoftware.com MSN: alex...@hotmail.com w: www.sunbeltsoftware.com b: www.sunbeltblog.com -Original Message- From: Greg Olson [mailto:gol...@markettools.com] Sent: Friday, May 07, 2010 1:05 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We
RE: Computers becoming unresponsive accross entire network.
Same here. Checked our 2003 SBS server. Vipre said dats version 6272 and was running a scan. Server was as responsive as usual. Updated dats to 6275 and still ok. From: Tom Miller [mailto:tmil...@hnncsb.org] Sent: Friday, May 07, 2010 2:15 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Thank you for the update. What's interesting is my 2003 servers were not impacted, just my 2008 servers (only the first CPU) and some XP machines. Alex Eckelberry al...@sunbelt-software.com 5/7/2010 1:40 PM Just to clarify for everyone, what happened was the following: Customers running a scan with definition versions 6272, 6273 or 6274 would often experience extremely high CPU usage when running a scan. This became apparent when agents started running scans, in most cases at 1 AM EDT (the default time). If an agent didn't run a scan, nothing happened. The issue started with definition 6272, released yesterday evening. The issue was caused by a virus detection (Virus.VBS.Redlof.f) that caused a loop condition when hitting a file of a certain type and size. This problem was fixed in definitions version 6275, which was released at 10:30 am EDT this morning. As the KB below explains, getting out of this loop state required killing the service, or shutting down VIPRE. http://support.sunbeltsoftware.com/Default.aspx?answerid=2015 Yes, it sucks. The only positive thing I can look at is that a number of systems kicked in internally that were not there in the past and we were able to fix the problem in a few minutes and release defs once our engineers diagnosed the problem. And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. We are expanding our test-bed and seeing what else we can do to mitigate this type of thing from happening again. Alex Alex Eckelberry, CEO Sunbelt Software 33 N. Garden Avenue, Clearwater, FL 33755 p: 727-562-0101 x220 e: a...@sunbeltsoftware.com MSN: alex...@hotmail.com w: www.sunbeltsoftware.com b: www.sunbeltblog.com -Original Message- From: Greg Olson [mailto:gol...@markettools.com] Sent: Friday, May 07, 2010 1:05 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines
RE: Computers becoming unresponsive accross entire network.
Lucky you! We had 4 mission-critical Win2003 servers hung. Three were VMWare. (Someone told me where to find the closest a VM has to a physical power switch, so they're all up and running now.) -- RMc Tom Miller tmil...@hnncsb.org wrote on 05/07/2010 01:14:51 PM: Thank you for the update. What's interesting is my 2003 servers were not impacted, just my 2008 servers (only the first CPU) and some XP machines. Alex Eckelberry al...@sunbelt-software.com 5/7/2010 1:40 PM Just to clarify for everyone, what happened was the following: Customers running a scan with definition versions 6272, 6273 or 6274 would often experience extremely high CPU usage when running a scan. This became apparent when agents started running scans, in most cases at 1 AM EDT (the default time). If an agent didn't run a scan, nothing happened. The issue started with definition 6272, released yesterday evening. The issue was caused by a virus detection (Virus.VBS.Redlof.f) that caused a loop condition when hitting a file of a certain type and size. This problem was fixed in definitions version 6275, which was released at 10:30 am EDT this morning. As the KB below explains, getting out of this loop state required killing the service, or shutting down VIPRE. http://support.sunbeltsoftware.com/Default.aspx?answerid=2015 Yes, it sucks. The only positive thing I can look at is that a number of systems kicked in internally that were not there in the past and we were able to fix the problem in a few minutes and release defs once our engineers diagnosed the problem. And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. We are expanding our test-bed and seeing what else we can do to mitigate this type of thing from happening again. Alex Alex Eckelberry, CEO Sunbelt Software 33 N. Garden Avenue, Clearwater, FL 33755 p: 727-562-0101 x220 e: a...@sunbeltsoftware.com MSN: alex...@hotmail.com w: www.sunbeltsoftware.com b: www.sunbeltblog.com -Original Message- From: Greg Olson [mailto:gol...@markettools.com] Sent: Friday, May 07, 2010 1:05 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We
Re: Computers becoming unresponsive accross entire network.
Thanks for the update, Alex. -ASB: http://XeeSM.com/AndrewBaker On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.comwrote: Just to clarify for everyone, what happened was the following: Customers running a scan with definition versions 6272, 6273 or 6274 would often experience extremely high CPU usage when running a scan. This became apparent when agents started running scans, in most cases at 1 AM EDT (the default time). If an agent didn't run a scan, nothing happened. The issue started with definition 6272, released yesterday evening. The issue was caused by a virus detection (Virus.VBS.Redlof.f) that caused a loop condition when hitting a file of a certain type and size. This problem was fixed in definitions version 6275, which was released at 10:30 am EDT this morning. As the KB below explains, getting out of this loop state required killing the service, or shutting down VIPRE. http://support.sunbeltsoftware.com/Default.aspx?answerid=2015 Yes, it sucks. The only positive thing I can look at is that a number of systems kicked in internally that were not there in the past and we were able to fix the problem in a few minutes and release defs once our engineers diagnosed the problem. And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. We are expanding our test-bed and seeing what else we can do to mitigate this type of thing from happening again. Alex Alex Eckelberry, CEO Sunbelt Software 33 N. Garden Avenue, Clearwater, FL 33755 p: 727-562-0101 x220 e: a...@sunbeltsoftware.com MSN: alex...@hotmail.com w: www.sunbeltsoftware.com b: www.sunbeltblog.com -Original Message- From: Greg Olson [mailto:gol...@markettools.com] Sent: Friday, May 07, 2010 1:05 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine, OS, network switch, etc. - at least from what we have been able to Identify. So far it has affected Windows 7, XP and Server 2003. However, this issue is not affecting everyone on the network. My Colleague sitting right next to me has been having all kinds of trouble with his PC and I have not. We have found that cold booting the affected machines does help a little or at least for a while, but more often than not the machine will just return to its unresponsive state after a few minutes. On the machines that I have that are accessible I am attempting scan with Vipre. We are seriously starting to suspect that Vipre is doing something (in the background that we cant see) that is actually causing all this. We
Re: Computers becoming unresponsive accross entire network.
PLEASE no!!! Not that the office is rolling out upgrades on Trend and I don't need another night of headaches. Jon On Fri, May 7, 2010 at 11:47 AM, David W. McSpadden dav...@imcu.com wrote: Ok. That is two bad defs in two weeks? 1 Vipre 1 McAfee? Next is Trend? -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 11:45 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Turned out to be a bad Deff. Bad def = 6274. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
RE: Computers becoming unresponsive accross entire network.
FWIW, I had a few computers that I was notified of having problems, essentially becoming unresponsive and the best solution I was able to come up with was to restart the computer as I was not able to get into the management console on these machines to shut down/restart the SBAM service, nor was I able to successfully shut down the service from the Enterprise console. However, rebooting the computers (NOT computers which were scanning, mind, just computers that had active protection enabled and whos users were going about their everyday business) allowed the machines to update the definitions. John-AldrichTile-Tools From: Andrew S. Baker [mailto:asbz...@gmail.com] Sent: Friday, May 07, 2010 3:01 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. Thanks for the update, Alex. -ASB: http://XeeSM.com/AndrewBaker On Fri, May 7, 2010 at 1:40 PM, Alex Eckelberry al...@sunbelt-software.com wrote: Just to clarify for everyone, what happened was the following: Customers running a scan with definition versions 6272, 6273 or 6274 would often experience extremely high CPU usage when running a scan. This became apparent when agents started running scans, in most cases at 1 AM EDT (the default time). If an agent didn't run a scan, nothing happened. The issue started with definition 6272, released yesterday evening. The issue was caused by a virus detection (Virus.VBS.Redlof.f) that caused a loop condition when hitting a file of a certain type and size. This problem was fixed in definitions version 6275, which was released at 10:30 am EDT this morning. As the KB below explains, getting out of this loop state required killing the service, or shutting down VIPRE. http://support.sunbeltsoftware.com/Default.aspx?answerid=2015 Yes, it sucks. The only positive thing I can look at is that a number of systems kicked in internally that were not there in the past and we were able to fix the problem in a few minutes and release defs once our engineers diagnosed the problem. And yes, we do test each definition that go out. The problem with this one was that the loop condition kicks in on a file of a certain size that is not in our test bed. We are expanding our test-bed and seeing what else we can do to mitigate this type of thing from happening again. Alex Alex Eckelberry, CEO Sunbelt Software 33 N. Garden Avenue, Clearwater, FL 33755 p: 727-562-0101 x220 e: a...@sunbeltsoftware.com MSN: alex...@hotmail.com w: www.sunbeltsoftware.com b: www.sunbeltblog.com -Original Message- From: Greg Olson [mailto:gol...@markettools.com] Sent: Friday, May 07, 2010 1:05 PM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. No Vipre. :) -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 10:04 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. With SEP ? GuidoElia HELPPC -Messaggio originale- Da: Greg Olson [mailto:gol...@markettools.com] Inviato: venerdì 7 maggio 2010 18.57 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Lucky you are sir. I've got entire offices down, servers offline, and all kinds of joy. Updating them is becoming a goto each and try to run a manual update. Which is only working sometimes. Machines are so horked up that we're rebooting into safe mode, and updating from there. -Greg -Original Message- From: HELP_PC [mailto:g...@enter.it] Sent: Friday, May 07, 2010 9:33 AM To: NT System Admin Issues Subject: R: Computers becoming unresponsive accross entire network. I feel good with my poor Symantec Endpoint Protection ! GuidoElia HELPPC -Messaggio originale- Da: Carl Houseman [mailto:c.house...@gmail.com] Inviato: venerdì 7 maggio 2010 17.31 A: NT System Admin Issues Oggetto: RE: Computers becoming unresponsive accross entire network. Already discussed in another thread, update your Vipre defs. Is anyone keeping track of the number of bad defs out of Sunbelt for this year alone? Carl -Original Message- From: Luke [mailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 10:57 AM To: NT System Admin Issues Subject: Computers becoming unresponsive accross entire network. The Network Administrator and I have been working on this all morning. Since about 7:00AM random machines on the Local Network have been slipping into and out of a random state of unresponsiveness (Freezing). The symptoms are pretty serious - I have seen it take up to 5 minutes to bring an already open window from the background to the foreground on client machines - and there are servers that are so unresponsive that I am not even able to log into them (enter Username and Password and nothing happens for the next 30min.). We have had to cold boot one server 3 times in the past hour! This problem is not specific to any user, profile, machine
RE: Computers becoming unresponsive accross entire network.
All AV vendors have problems. Just Google (vendor) false positive or (vendor) update problem. It's just reality. When you have to build up to 20 new versions of your product daily, things go wrong. The problems with AV updates industry-wide started with the massive increase in malware about 5 years ago. Before that, FPs and update issues were a relatively rare event. But now all AV vendors are in a constant battle to keep up with the fire-hose of malware, and stuff goes wrong. The best that an AV vendor can do is to implement as many safety checks, redundancies, internal air-bags and testing that they can given the short amount of time to react to a new threat. The tough part is balancing quality against the need to protect the customer from threats. Our head of RD, Mark Patton, confesses to having nightmares about this stuff and obsesses over what we can do. We have implemented kill switches in the definition process (which we actually used this morning after we figured out what the problem was); we've implemented airbags that won't let VIPRE delete a Windows system file; we've implemented more rigorous code reviews and regression tests on new detections, and so on. We are also working on some interesting new technology, such as self-healing functionality inside of VIPRE that will self-heal a system in case a critical file is removed. Personally, I think the next frontier in the AV industry, now that vendors have mostly started figuring out how to deal with the volume of threats, is to figure out how to never do harm. It's actually a lot harder than it might sound. Alex From: Jon Harris [mailto:jk.har...@gmail.com] Sent: Friday, May 07, 2010 3:32 PM To: NT System Admin Issues Subject: Re: Computers becoming unresponsive accross entire network. PLEASE no!!! Not that the office is rolling out upgrades on Trend and I don't need another night of headaches. Jon On Fri, May 7, 2010 at 11:47 AM, David W. McSpadden dav...@imcu.commailto:dav...@imcu.com wrote: Ok. That is two bad defs in two weeks? 1 Vipre 1 McAfee? Next is Trend? -Original Message- From: Luke [mailto:tesla...@gmail.commailto:tesla...@gmail.com] Sent: Friday, May 07, 2010 11:45 AM To: NT System Admin Issues Subject: RE: Computers becoming unresponsive accross entire network. Turned out to be a bad Deff. Bad def = 6274. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~
