Norton Internet Security / Norton AntiVirus

[SGSMikeG]

Hi,

I had a problem with my Vista Pro machine where it was running quite slowly.   In using the performance monitor tool to monitor what files were being accessed I found a service was constantly reading the off-line files cache in :

C:\WINDOWS\CSC

I added this directory to the exclusions lists in Norton Internet Security - performance problem solved.

Can anyone tell me why this might be ?

Regards

Michael

[Tony_Weiss Administrator]

Which process name was accessing this directory? If you try to scan this folder separately, are there any errors? Also which version of Norton Internet Security are you running? I apologize for the questions; this can help determine the cause of the slowdown. Thanks!

[SGSMikeG]

Hi,

Process showing in Vista 'Reliability and Performance Monitior' is svchost.exe - which doesn't help much.  However as I said adding the exclusion to NIS stopped this scanning.

I was on Norton Internet Security 2007 but took the free upgrade to 2008 - current version is  15.5.0.23.

Issue occurred on both versions.

[SpencerL]

Here is a brief explanation on SvcHost.exe:
Svchost.exe is a process on your computer that hosts, or contains, other individual services that Windows uses to perform various functions.
http://windowshelp.microsoft.com/Windows/en-US/help/057580a1-7002-4f43-9240-a74f42cb05c91033.mspx

I believe Windows caches offline files under \windows\csc. If the original network resource is not available, then Windows will uses the corresponding offline file in this folder. I am not sure why svchost.exe is constantly acccessing offline files in \windows\csc. Are you using any application that maybe accessing these offline files?

NIS real-time protection is designed to monitor all file access. If files under this folder is being constantly modified and accessed, NIS will monitor the changes. Adding the directory exclusion helps with this particular performance issue, however, the machine is also a little less secure.

Let's see if we can identify which application is constantly accessing this folder, which may be the root of this performance problem.

[SGSMikeG]

Hi,

I have a large quantity of off-line files synchronised with a Windows 2003 Server.  Specifically several drive mappings are made off-line on my laptop.  99% of these files do not change.

I do not see why NIS would be constantly scanning the the off-line file cache.  Its as if NIS is scanning the entire cache because it thinks the off-line files are continously changing ????

Have you set up and tested a similar situation ?

Regards

Michael Green

[SpencerL]

Hi Michael,

I confirmed with our QA team that we do test offline files/folders use cases. In addition, I tried to reproduce the scenario you described (offline folders in mapped drives, approx. 750MB in size) and was unable to replicate the performance issue you observed.

I suspect a component is continuously modifying a file (or files) in the cache folder, causing NIS to constantly rescan the file(s). If you are interested, I would love to troubleshoot this issue over a remote session to determine the root cause. I will send you my contact information via a private message.

If not, you can try to use utilities like FileMon (from  Microsoft) to at determine if a component (i.e. SvcHost.exe) is modifying file(s) in the CSC folder.

Regards,

Spencer

[SGSMikeG]

Per http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

Hi, ote: Filemon and Regmon have been replaced by Process Monitor on versions of Windows starting with Windows 2000 SP4, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista. Filemon and Regmon remain for legacy operating system support, including Windows 9x.

So should i try Process Monitor :

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

?

[SpencerL]

Hi Michael,

Either one is fine. Since the new Process Monitor includes features in legacy FileMon, I would give that a try.

Regards,

Spencer

[Tim_Lopez Administrator]

Hello SGSMikeG,

Any update on this? 

[Davidmm]

I am having a similar issue, with heavy scanning of the csc file, resulting in very slow performance for about 15 minutes. Would appreciate any assistance you could offer. Thanks.