Endpoint Protection

Good morning. I  work for a local municpality.  We use the current version of endpoint.   Most of our clients are Windows XP and our endpoint server is a Server 2008 server.  We use a software called incode for our financial and human resource needs.  This software uses a program called acuserver to connect the client software to the servers.  We recently upgraded to version 9 of the incode software and all of the sudden the incode software is really slow.  I worked with the incode tech for several hours and they blame endpoint.  I didn't believe them until I uninstalled endpoint and the problem went away.  What happens is that when you click on one of the modules  an executable named wrun32.exe starts.  Ever since the upgrade when the wrun32.exe runs it takes between 35 to 50 percent of the CPU and takes anywhere from a 40 seconds to a minute to open the module.  This executable is located on the server that contains both software packages.  I created an exception for the wrun32.exe and the folder it is located in.  I have my the endpoint set to only scan modified files and I even set it to not scan remote PCs.  The only weird this is that while the wrun32.exe uses huge amounts of CPU no other process uses a lot of memory or CPU including the Anti-virus.  The incode technicians are not being very helpful and I was hoping someone here might have experience with either incode or acuserver.  Thanks.

So the issue is only with the acuserver server?

What components do you have installed on it. Preferably only install the AV component.

As far as I can tell the issue only occurs when the client software on the workstation attempts to run the wrun32.exe file that is on the  server.  I uninstalled the network managed installation on my test PC and reinstalled an unmanaged client.  I deselected every option I could so it installed the bare minimum.  I still have the problem.

And you excluded all the relevant directories for this software on both client and server?

I believe so.  I added an exception to ignore the wrun32.exe.  I also created an exception for the folder it is located in.  We already had the suggested exceptions for the incode software files and folders.  The strange thing is when you try to run a moduile the wrun32.exe takes up almost half the CPU usage but little memory and the antivirus processes don't seem to jump up.  You would think that if it was the antivirus causing the problem you would see an increase in CPU use or memory in the antivirus related processes.

Remove every component except the AV one. Hopefully this will start to narrow it down.

Turns out throughout the years when the software was upgraded they didn't remove old versions of the accuserver folders, they just renamed them.  I downloaded a task manager program that gave me more information about the process that was locking up the machine.  I realized the folder we had been told to add to the exemption did contain an executable but not the one that was actually being used.  Once I added an exemption for the file and folder that was actually being used it seems to have solved the problem.  Thanks for all the helpful advice everyone gave.

Glad it's solved. Thanks for posting the update.

You're welcome.  Thanks for the help.