Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

SWV and Trend CPU usage on Windows 7 with IE6 layer

Created: 10 Aug 2010 | 10 comments

Hi,

I am running into an interesting problem.

Using the latest version of SWV (6.1 SP4) and the new IE6 Layer Tool for Windows 7 (https://www-secure.symantec.com/connect/articles/virtualized-internet-explorer-6-windows-7) I am running into high CPU usage resulting in an unusable machine.  Once I deactivate the layer, the machine works fine. 

I tracked the process down to a Trend filter driver.  Once I remove the Trend Officescan (version 10) service,  the layer works fine.

I stumbled across people referencing this problems 2 years ago, and it seems unsolved.  Trend and Symantec both have information on it:

https://www-secure.symantec.com/connect/ja/forums/svs-vista-and-trendmicro-office-scan-8

http://esupport.trendmicro.com/pages/High-CPU-usage-occurs-on-a-Windows-computer-with-Altiris-Software-Virtualization-Agent-after-installing-WFBS-or-OfficeScan.aspx

These links refer to an older version of SWV and Trend running on Vista, but I am having the same exact problems.  
Installing the registry entry only sped up the machine marginally, the layer is still pretty much unusable.

I have tried this on multiple machines with the same effect.

Other layers like FireFox, work fine with no CPU increase.

Any thoughts?

Comments 10 CommentsJump to latest comment

Palvaran's picture

1.  Add HKLM\SYSTEM\CurrentControlSet\Services\TmFilter\Parameters" - Add a DWORD value "DisableCtProcCheck" - Set the value to 1
2. The officescan.ini (on the server) was modified to disable the Trendmicro Unauthorized Change Protection Service.
3. Remove the 4 identical .sys files in the .msi with the 4 provided in the zip file.

https://dropbox.rice.edu/pickup.php?claimID=QR7ntwc8aRAVbUQk&claimPasscode=gAfwSuuud0L6f77k&emailAddr=fg2%40rice.edu

Systems Administrator
Rice University

Remember, "The happiness of your life, depends on the quality of your thoughts."

Jordan's picture

is this 32-bit or 64-bit Trend?

If a forum post solves your problem please flag is as the solution

Palvaran's picture

Would it help if we put the Trend processes in the SWV Excludes list somehow?

Systems Administrator
Rice University

Remember, "The happiness of your life, depends on the quality of your thoughts."

SilentCastle's picture

Palvaran,

That's my next step.  I'm going to try and exclude it in SWV, and also exclude the SWV folders from the trend console.

JonyAM's picture

New news about this problem?

I have 32 bits Trend Micro 10 SP1 and SWV 6.1 SP4 in Windows 7 Enterprise, and i have the same behaviour. When I activate any Layer, CPU increases a lot. I already put the Trend processes in the SWV excludes list, but the problem persists.

Thanks.

SilentCastle's picture

Putting the SWV folders in the excludes drastically helped.

Jordan's picture

By default any AV should be added to SWV's program ignore list via the registry.  There are too many for us to do this ourselves, especially because things can change between versions, so the user tends to have to do this.

What this list does is only allow the AV to see things via the FSLRDR directory and not the virtualized directory (so where it appears after an activation).

If a forum post solves your problem please flag is as the solution