stevecooper

Services.exe High CPU Usage with 6.0.4.1212

39 posts in this topic

Hello,

 

I have been testing the 6.0.4.1212 workstation product in my lab environment and all 10 machines running this client have a services.exe process running at between 35 and 50% CPU. This has a very noticable effect on the machines performance (the machines are a faily decent spec Core2 Duo's with 4GB running x86 XP). Using Tasklist /SVC I can see that the particular services.exe process is responsible for Eventlog and PlugPlay.

 

Uninstalling the Kaspersky product resolves the issue in every case. Obviously this isnt an ideal resolution, but I cant push out a product to my user community which is going to cripple their machines. Incidently removing just the NDIS driver makes no difference- its only when the entire client AV program is removed (though the network agent remains).

 

I'd appreciate any suggestions as to what might fix the problem.

 

Cheers

 

Steve

Share this post


Link to post
Share on other sites

Please try to deactivate self-defense in the settings of WKS and have a look, if the problem still persists.

Share this post


Link to post
Share on other sites
Please try to deactivate self-defense in the settings of WKS and have a look, if the problem still persists.

 

It seems rather hit and miss. Sometimes deactivating the protection via a policy, then reactivating it cures the problem and sometimes it doesnt. Sometimes removing the product and reinstalling it cures the problem and sometimes it doesnt.

 

The only thing that works every time is removing the product. Is 6.0.4.1212 the latest build? I wonder if I'm missing a patch or something?

 

Thanks

 

Steve

 

Share this post


Link to post
Share on other sites

We've got half a dozen machines that are really slow when using some apps in the last week or two. Even just saving a doc in Word takes a while. I was suspecting a windows update maybe the culprit, but I don't know yet. I tried exiting the AV but it made no difference, I may try uninstalling it altogether on one of our problem machines and see it it helps.

Share this post


Link to post
Share on other sites
We've got half a dozen machines that are really slow when using some apps in the last week or two. Even just saving a doc in Word takes a while. I was suspecting a windows update maybe the culprit, but I don't know yet. I tried exiting the AV but it made no difference, I may try uninstalling it altogether on one of our problem machines and see it it helps.

 

I dont think my issue is related to a Windows Update specifically. I have 200 or so clients in production using 6.0.3.837 and I have exactly zero instances of the problem I described. I have 10 clients in test using 6.0.4.1212 with 10 instances of high (around 40% on average) CPU usage by Services.exe (executing Eventlog/PlugPlay). The production and test clients have the same Windows Updates installed (I know this for a fact as I use SCCM to deploy them). In every case removing the AV client resolves the problem.

 

If its related to a Windows Update, then its an incompatibility introduced in 6.0.4.1212. In any event theres no way I can push MP4 out while this issue persists.

Share this post


Link to post
Share on other sites
I dont think my issue is related to a Windows Update specifically. I have 200 or so clients in production using 6.0.3.837 and I have exactly zero instances of the problem I described. I have 10 clients in test using 6.0.4.1212 with 10 instances of high (around 40% on average) CPU usage by Services.exe (executing Eventlog/PlugPlay). The production and test clients have the same Windows Updates installed (I know this for a fact as I use SCCM to deploy them). In every case removing the AV client resolves the problem.

 

If its related to a Windows Update, then its an incompatibility introduced in 6.0.4.1212. In any event theres no way I can push MP4 out while this issue persists.

 

I don't think it's windows updates personally. We've updated all our clients to 6.0.4.1212 in the last 4 weeks. I've also removed any updates that have been installed since 1st November and it's not made any difference. Some of the clients that have seen high cpu useage are on both Vista and XP which makes me unsure if it actually is anything to do with windows updates.

Share this post


Link to post
Share on other sites

Uninstalling the 6.0.4.1212 from one of our machines having the issues has brought it back to up to speed. The user plans to reinstall all the windows updates and service packs they removed when diagnosing the problem, and see what it's like. If it's ok, i'll put the older MP3 version back on as it looks to be something odd on with 6.0.4.1212

Share this post


Link to post
Share on other sites
Uninstalling the 6.0.4.1212 from one of our machines having the issues has brought it back to up to speed. The user plans to reinstall all the windows updates and service packs they removed when diagnosing the problem, and see what it's like. If it's ok, i'll put the older MP3 version back on as it looks to be something odd on with 6.0.4.1212

 

I'll be interested to see your findings. Going back to MP3 seems a good idea on the face of it.

 

I'm surprised that this issue has slipped through testing. Its not like I'm using any strange hardware configurations, unless you consider HP Elitebook's and XW workstations to be "strange".

 

Share this post


Link to post
Share on other sites

Another test.

 

A 2 year old dual core, 3.0Ghz Processor with 2gb RAM dell machine, running XP sp2, when sending an e-mail in Outlook with automatic spell check, took around 20 seconds to actually show the spell checker.

I removed 6.0.4.1212, rebooted, sent another e-mail, and the spell checker appeared in around 1 second. I've now installed the MP3 version, and all is still ok. :)

 

As a side note, when I pushed MP4 out through the admin kit, I didn't remove MP3 first, and simply rolled out the MP4 package. I'm not sure how people others have rolled out their MP4, but I don't remember reading anything saying that I should or shouldn't need to remove MP3 first.

I do think it's this latest KAV though, as I've got users in remote offices complaining of slow machines, with the AV being the only thing in common.

Share this post


Link to post
Share on other sites

I did the same as you- my test clients all had 837 on prior to installing 1212.

 

I haven't really tested many applications on the machines running MP4- I was hoping to resolve the "40% CPU usage while idle" problem first so other than observing the machines to be "generally slow" I havent really spent any time putting a figure on just how bad they are.

 

I've just tried a few cursory tests- literally minutes to open a 97KB PDF - even longer to print it. 20 seconds+ to navigate from email to email (as in the time to render the preview in the reading pane) in Outlook. Even just firing up Word is slow (as in 30 seconds or so).

 

I think I'll create a task to remove MP4 from my test environment, and maybe I'll have another look at it when it gets through being beta tested.

Share this post


Link to post
Share on other sites

 

 

I too have been installing and testing version 6.0.4.1212 workstation. Machines run so slow that we cannot release them to our users.

 

I end up going back to the competitors product. I will wait until the next version and then try again.

 

This is the game we have been playing for several months now. So far we have never been able to successfully deploy KAV anywhere.

 

Can anyone recommend ANY version that works without side effects ?

 

 

 

Share this post


Link to post
Share on other sites
I was being ironic- well, partially. Do you feel that this software is release quality?

 

Ah, sorry . :b_lol1:

 

I agree. Definately something up with it.

 

On the Dell machines that have this problem (its not specific to Dells though) with mp4, the fans just seem to spin up to full belt for a few minutes at a time. All with seemingly normal user activity. They were fine for a few weeks after installation, so maybe it's an updated pattern file, or a windows update causing conflict, or maybe it's just what i'm coming to expect from KAV.

I've already had management saying they're willing to sign off on another vendor at renewal.

The scary thing is, we're a distributor of Kaspersky too (amongst other products) :huh:

Share this post


Link to post
Share on other sites
Can anyone recommend ANY version that works without side effects ?

 

I'm trialling re-installing Workstation MP4 to see how that goes.

On our problematic machines, going back to MP3 appears to work as well as can be expected (with our Admin Kit 8).

 

Share this post


Link to post
Share on other sites

The combination of admin kit 8 and MP3 works ok for me, though I still have the usual slowdown when the workstation update task is running that I've always had with KAV (and what prompted me to go to MP4 in hope of it being less of an issue)

 

Regarding my test environment, I created a task to remove MP4 and configured automatic deployment of MP3 on that collection. It seems to be working ok- well, at least I dont have a services.exe process chewing my CPU time up (at the moment anyway)

Share this post


Link to post
Share on other sites

im having the exact problem when i installed mp4 on the client pc's..

got quite a few customers complaining about slow computers now, any solution yet ?

 

im also getting DistributeCOM errors in the event log.

somehow im thinking its connected to kaspersky, because before i had kaspersky there werent any of these errors

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 20/08/2007 6:47:25 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: R2D2\Peter
Computer: R2D2
Description:
The application-specific permission settings do not grant Local Activation
permission for the COM Server application with CLSID
{0C0A3666-30C9-11D0-8F20-00805F2CD064}
to the user R2D2\Peter SID (S-1-5-21-2890590643-2278680530-3289789162-1000)
from address LocalHost (Using LRPC). This security permission can be
modified using the Component Services administrative tool.

Thats the event log error.

 

you get rid of the error's by enabling the Network Access Protection service.

but to do that at all the clients by hand is quite the anoying solution.

 

anyone knows away to either solve the slow computer problem or know a way to put the Network Access Protection service on automaticly starting without tomuch work ?

Edited by Reinier

Share this post


Link to post
Share on other sites

You can try reinstalling MP4, remove and reinstall. I find removing it manually, then push it back out via the admin kit sometimes works.

If it's still slow, then remove the MP4 version, and push out the MP3 to it.

 

I'm in the process of pushing out 12 MP3 to our remote office since the MP4 bogged their machines down too much.

Share this post


Link to post
Share on other sites

I just sent a request off to Kaspersky about another issue (A windows 7 machine constantly telling the user to restart) and in the support ticket version options, noticed it had an option for "Version 6.0.4.1217 Maintenance Pack".

Is this some patch for 6.0.4.1212?

Share this post


Link to post
Share on other sites
"Version 6.0.4.1217 Maintenance Pack".

 

I believe thats an Italian/Spanish regionalised version of 1212 (but I could be wrong)

 

Share this post


Link to post
Share on other sites

.1217 has just changes for localization.

Share this post


Link to post
Share on other sites

Hi Guys

 

We have a similar problem. Fortunately we have only installed 1212 on two machines and we have noticed a slowdown. Simple things like spell check before sending emails, printing, opening the thesaurus in MS Word. All these things take much longer then with MP3.

 

The Kaspersky support guys have explained to switch off Self-defense which seems to help.

 

I have attached a file sent to me. KAV explained that these are workarounds till they fix the issue. Really speaking I have only noticed improvements with turning of the Self-Defense.

 

RAM

 

MP4_Slowdown_Issue.doc

Share this post


Link to post
Share on other sites
Hi Guys

 

We have a similar problem. Fortunately we have only installed 1212 on two machines and we have noticed a slowdown. Simple things like spell check before sending emails, printing, opening the thesaurus in MS Word. All these things take much longer then with MP3.

 

The Kaspersky support guys have explained to switch off Self-defense which seems to help.

 

I have attached a file sent to me. KAV explained that these are workarounds till they fix the issue. Really speaking I have only noticed improvements with turning of the Self-Defense.

 

RAM

Please ask them for a 'special' dll for testing. They should know what is meant. If not, feel free to contact me over PN. ;)

Share this post


Link to post
Share on other sites

We just picked up Kaspersky a couple months ago.... It's been a pain in the @55. I'm glad I found this post (coincidently looking for something else), I have all these problems and more.

 

I tried to get some support from KAV a while back about deployment and was so disappointed in their support I don't want to call back.

 

I went firm wide with MP4, never having MP3. I am also hiding from a mob.

 

Does anyone know if I can push MP3 over MP4 withou removing it first? One reboot is enough if I can keep it down to that.

 

Thanks to everyone here.

Share this post


Link to post
Share on other sites

Hi

 

phr3n1c -

Thanks I'll ask KAV support.

 

jadams159 -

From my experience you needed more then one reboot when installing MP3. Not sure if you can downgrade. The initial MP3 package does not contain the latest signatures, if I remember correctly it installs with 2007 signatures.

 

I believe the proper procedure is to Install -> Reboot -> Update -> Reboot -> Run full scan.

 

The good thing about MP4 is that you can update the signatures in the installation package, you cannot to this with MP3. Also MP4 does not ask for the computer to be restarted as much as MP3 did, because of updates.

 

RAM

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now