Norton Internet security constantly scanning off-line files cache C:\WINDOWS\CSC

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

Which process name was accessing this directory? If you try to scan this folder separately, are there any errors? Also which version of Norton Internet Security are you running? I apologize for the questions; this can help determine the cause of the slowdown. Thanks!

Hi,

Process showing in Vista 'Reliability and Performance Monitior' is svchost.exe - which doesn't help much.  However as I said adding the exclusion to NIS stopped this scanning.

 

I was on Norton Internet Security 2007 but took the free upgrade to 2008 - current version is  15.5.0.23.

 

Issue occurred on both versions.

Here is a brief explanation on SvcHost.exe:
Svchost.exe is a process on your computer that hosts, or contains, other individual services that Windows uses to perform various functions.
http://windowshelp.microsoft.com/Windows/en-US/help/057580a1-7002-4f43-9240-a74f42cb05c91033.mspx

 

I believe Windows caches offline files under \windows\csc. If the original network resource is not available, then Windows will uses the corresponding offline file in this folder. I am not sure why svchost.exe is constantly acccessing offline files in \windows\csc. Are you using any application that maybe accessing these offline files?

 

NIS real-time protection is designed to monitor all file access. If files under this folder is being constantly modified and accessed, NIS will monitor the changes. Adding the directory exclusion helps with this particular performance issue, however, the machine is also a little less secure.

 

Let's see if we can identify which application is constantly accessing this folder, which may be the root of this performance problem.

Hi,

I have a large quantity of off-line files synchronised with a Windows 2003 Server.  Specifically several drive mappings are made off-line on my laptop.  99% of these files do not change.

 

I do not see why NIS would be constantly scanning the the off-line file cache.  Its as if NIS is scanning the entire cache because it thinks the off-line files are continously changing ????

 

Have you set up and tested a similar situation ?

 

Regards

Michael Green

Hi Michael,

 

I confirmed with our QA team that we do test offline files/folders use cases. In addition, I tried to reproduce the scenario you described (offline folders in mapped drives, approx. 750MB in size) and was unable to replicate the performance issue you observed.

 

I suspect a component is continuously modifying a file (or files) in the cache folder, causing NIS to constantly rescan the file(s). If you are interested, I would love to troubleshoot this issue over a remote session to determine the root cause. I will send you my contact information via a private message.

 

If not, you can try to use utilities like FileMon (from  Microsoft) to at determine if a component (i.e. SvcHost.exe) is modifying file(s) in the CSC folder.

 

Regards,

Spencer

Per http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

 

Hi, ote: Filemon and Regmon have been replaced by Process Monitor on versions of Windows starting with Windows 2000 SP4, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista. Filemon and Regmon remain for legacy operating system support, including Windows 9x.

 

So should i try Process Monitor :

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

 

?

7 Likes

Hi Michael,

 

Either one is fine. Since the new Process Monitor includes features in legacy FileMon, I would give that a try.

 

Regards,

Spencer

1 Like

Hello SGSMikeG,

 

Any update on this? 

I am having a similar issue, with heavy scanning of the csc file, resulting in very slow performance for about 15 minutes. Would appreciate any assistance you could offer. Thanks.


Davidmm wrote:
I am having a similar issue, with heavy scanning of the csc file, resulting in very slow performance for about 15 minutes. Would appreciate any assistance you could offer. Thanks.

I would recommend reviewing the posts by SpencerL in this thread to help determine the cause of this performance problem. Please let us know what you find. Thanks!

Message Edited by Tony_Weiss on 09-05-2008 04:18 PM

I tried playing with Process monitor but it didn’t tell me much more - svchost.exe is stll the cause of the scanning but why is still the question…


SGSMikeG wrote:
I tried playing with Process monitor but it didn't tell me much more - svchost.exe is stll the cause of the scanning but why is still the question.......

Do you have any details of the process? Perhaps contacting SpencerL would be a good start to resolving this issue.