Windows Forum

Ask something
Discussion Locked

high cpu utilization of rtvscan.exe

0 helpful
42 replies

by xiea

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have several windows 2000 servers and bunch of windows xp clients. All the servers have norton corporate edition and xp machines have managed norton clients.

Everything worked fine until installing update rollup for service pack 4 on the server. Now the rtvscan.exe will take up 50% of cpu cycles on the servers and 100% of cpu cycles on the clients. Restarting the norton service will help the problem temporally. It usually spikes back up within 24 hours.

I have uninstalled the update rollup, but the above problem still exists. Any help would be appreciated.

42 replies

by w2ktechman

I saw this problem with Symantec AV corp. ed. v. 9, and our server guys uninstalled Symantec completely on the system because backups were taking 9 hours (from 4 previously). I believe they have since installed Symantec corp v.10

by sgt_shultz

how rude to reject the above correct answer with no comment.
did you even bother to google this to try to fix it yourself? did you this:
ftp://ftp.symantec.com/public/english_us_canada/linked_files/ent_sec/RemoveStartScan.reg
lastly, if you actually own norton corporate and are not boot legging it it should be 1) no problem for you to get tech support from them on this and
2) you should be getting updates in the mail and probably have your hands on the solution already

by xiea

The version we have (7.5) is no longer supported by symantec.
Yes, I have actually googled this problem and found no correct solutions

by rsat04

For the record, I did contact Symantec support and they provided this registry edit which did not work. I subsequently uninstalled, deleted any AV folders and re-installed the program. For one day everything was ok but like the post says it returns and takes up a lot of the computer's resources slowing everything down for quite an extended period of time.

by rtucker318

removescan.exe doesn't work...it never has. Why not, instead, just keep your notes to something positive. You wasted 2 or 3 minutes posting that.

...???

by shawns

1st it is near impossible to get support from Symantec and 2nd I have had the same problem on some of the workstations I manage. I have a legit copy and get updates sent to me, none of which have solved the problem. Further more what is wrong with someone reaching out their peers for help? Most of the time it is a lot easier then jumping through all the hoops most of the software companies make you go through to get an answer that doesn?t work or for them to tell you that it isn?t a problem with their software it?s something else causing the problem.

by mfhawn

Symantec's support has become an absolute joke. It used to be pretty decent but it has deteriorated significantly. It is nearly impossible to even get routed to a line that will have a real person until 20 minutes of pressing 1,000 buttons! And then you have to wait another 30, if not 45 minutes!

by abby

Shultz, are you having a bad day or are you normally this rude?
Sorry for the people you support...

Second note, I've had no luck with Symantec either

by abby

Shultz, are you having a bad day or are you normally this rude?
Sorry for the people you support...

Second note, I've had no luck with Symantec either

by blackcurrant

Hi

This applies to V9 and 10, so may apply to your version:

If you start the Symantec system Center, unlock the server group then right click the server, select All Tasks, Anti-Virus, and then look at the settings for both server and client autoprotect options. Near the bottom of the page is an option to scan the network, floppy, and CDROM - make sure the network option is not checked.

Failing this, you should be able to do this on each client individually.

Also, and I know this may not be desirable, but have you tried uninstalling and reinstalling? Also, as a final thought, is V7 designed to run on these OS's (I don't know - I have only just started using this product).

Good luck

by xiea

The network option is not checked in server and client realtime scan options.
Reinstalling client installings does not seems to help the situation. I would really prefer not to uninstall/reinstall on the server.
Version 7.5 has been running stable on the current systems for over three years now. I believe something in the update rollup for windows 2k service pack 4 caused this, but I can't confirm it or reverse it.

by blackcurrant

Hi again

I wonder if the update has affected the security of the machine. Is the rtvscan process trying to access something it is no longer allowed to access? Maybe checking the event logs might shed some light on this.

A long shot... but maybe it will help

Good luck

by xiea

You brought up a good point that has baffled me. The rtvscan process appears to run fine on boot up or when the service is restarted. But then later, something is triggered and the cpu cycles spikes up. The event log appears normal and the norton log doesn't help any.

by a.kroll

I am experiencing this same CPU problem. When I shut down my computer I get a End Program prompt for 'Missing Virus Definition' or something very similar to that. When I check my virus definition version it is always the most current. I do not get this everytime I shut down, maybe 50%. Maybe it is this virus definition that it is looking for.

by blackcurrant

Hi again

Could the process be battling with another process? I wonder if there is an incompatability that is preventing rtvscan from running properly.

This may be a laborious process but I would find out as much as possible about the update rollup you applied. I know you said you uninstalled the update and that the problem persists, but I would try to find out if there is some basic setting that has changed, affecting the way processes are allowed to interact with the OS.

Have you tried talking to Microsoft about this?

by xiea

I have talked to Microsoft about this. As expected, they referred me to Symantec because it's a third party software. Microsoft's website and other newsgroup have detailed some known issues to Update Rollup, but none of those included my issues, presumably because my version is kinda outdated.
The thing that bothers me the most is why the norton clients are acting up. All of the clients run on windows xp and nothing were done to them. The norton clients are managed so servers do talk to them. I don't know if the server is sending wrong commands to the clients or whatnot.

I do appreciate your help here.

by blackcurrant

Hi again :)

Something that has occurred to me - are your 'servers' run from the 2000 Server? And - do you have a secondary server?

If so - have you tried transferring the primary server role to an XP machine? This is how I run mine. I initially installed the Security Center on our Win2k3 server and did a remote client install to an XP machine. Both locked up.

After talking to Symantec, they said they do not recommend installing the AV server on an OS Terminal Server (which mine is not). However, I downloaded a removal tool, ran it to clean up both the machines, then made an XP machine the 'server'. Now, everything runs fine.

I use Symantec Client Security 3, and I have to say that I wish the installation guide was a lot better. The product also claims to run on machines running Windows 2000 upwards which have at least 64MB RAM. I installed it on a Win2k with 128MB RAM and the machine became unusable. I installed SAV V9 on it (SCS3 can manage V9), and everything works again as it should.

So, try switching a server to an XP machine and run SAV on the Win 2000 servers as clients and see if that helps.

Good luck.

by ted_04

Actually, I still can't sure the root cause of this problem; however, I have a workaround solution for it (I have tried this and it works for me).

In my company, NAVCE Client 7.53 is installed on all W2KSP4 and WXPSP2 clients. All of them got the problem of "rtvscan 99%". Besides, I found that the LiveUpdate component is not functioning properly, so I tried to install the latest Symantec LiveUpdate version 2.6 from ftp://ftp.symantec.com/public/english_us_canada/liveupdate/lusetup.exe and run the liveupdate immediately.

Hoping that this may help you to fix the problem @_@

by xiea

This is a question for ted_04@...
Your answer seems to be the closest to my problem. However, I didn't know how to accept your answer and leave the question open.

I have a question before I try it. Did you install LU v2.6 on both the w2k servers and the xp clients or just the servers?

by ted_04

I updated the LiveUpdate component of all NAVCE 7.53 clients installed on W2KSP4 clients/servers and WXPSP2 clients.

The LiveUpdate component of NAV server need to be updated also.

[I suggest you to do so on you NAV server and one of your client machines, and keep monitoring the machines. If it really works for you, you can do the same thing on all your clients.]

Thanks @_@

by gkrew

We are running NAV CE 7.50 and have had this same problem for the last two weeks. I have updated LiveUpdate with no success and changed the client schedule scan to run at Saturday night at midnight which did not change as some clients ended up running a scheduled scan at all hours of the day.I have seen on the Symantec boards where some Admins have upgraded and have not seen a resolution to the problem.

by sir_kardis

Here is my question for those of you still having problems with their RTVSCAN.EXE constantly running on your Win2k clients. Is there a file in the WinNT\system32 directory by the name of account_fix2.exe? File will be about 57k in length. I'm doing a bit of an investigation to see if this file and our problem are related to what is going on or not. We're having all sorts of issues with the rtvscan using up 99% of system usage but it seems to only exist on the systems in which if have found and deleted that file. At this point I can't offer any solutions just a possible cause. If you have this file it is likely that you have a trojan/worm by the name of dropper.kifer.a. Least that is the name AVG gives when you scan the file. Norton is generally not able to find this problem and in a search all you'll find information on is W32.Kifer which is not the same thing.

Ok, winded enough.
Laters folks

by sir_kardis

Hi All,
I'm going to finish this one up as best I can. If you have notice that the file ACCOUNT_FIX2.EXE file is in your C:\WINNT\SYSTEM32 directory then you have a worm by the name of dropper.kifer.a. This worm is hardly detectable by norton at this point(maybe soon). Once it's installed it will cause your rtvscan.exe to begin eating up resources till it can't consume anymore. The fix is as follows.

Step 1. Delete the installer file account_fix2.exe from your system32 directory.
Step 2. Download and reinstall the latest version of Live Update. (Doesn't matter if you have already done this)
Step 3. Restart the computer.

I will find out tomorrow if this completely works but considering how quickly the worm eats up the resources on a 1.5Ghz system I'd say this works.

*another note for you sysops and IT pros who have been truely working on this, KUDOS. I'm used to IT Pros that would have fixed this problem by wipi ng the system and reinstalling everything causing the users to have to reinstall all their working software.

I hope this helps anyone who has not gotten their problem fixed yet.

Kardis

by luis.morin

I have the same symptoms in my network. But I searched for the file: ACCOUNT_FIX2.EXE and it was not there.

I downloaded and installed the last LiveUpdate and it seems all is working just fine.

anybody knows any other cause of this malfunction?

by normh3

Updating LIVEUPDATE will solve this issue. We have used this fix at several client sites with 100% success rate. Still don't know the why's...but haven't seen any adverse affects with the fix.

by gkrew

updating liveupdate does not fix the problem. LU has been updated on the NAVCE server and I have looked for Account_fix2.exe on the clients and did not find it. Symantec's product only seems to be affected by certain definition files since the problem go away but come back after a definition update is pushed out. Win2K clients running SP3 or SP4 are both affected.On some workstations all MS patches have been updated but this does not help. This has been going on for about 2 months now.

by tito999

From the Symantec website:

This happens if you chose to install the Norton AntiVirus Corporate Edition mail plug-in during the installation of Norton AntiVirus Corporate Edition 7.61, although neither Microsoft? Exchange nor Lotus Notes is installed. Upgrading to Symantec AntiVirus 8.0 does not upgrade the plug-ins, because the mail client is not installed.

This problem is fixed in Symantec AntiVirus 8.01, build 457. If you do not want to upgrade to Symantec AntiVirus 8.01 or later, you can resolve this by manually removing the plug-in.

To remove the plug-in manually

1. Rename the following files (change the file to .dll.old):
* nlnvp.dll
* notesext.dll
2. Restart the client.

by tito999

From the Symantec website:

This happens if you chose to install the Norton AntiVirus Corporate Edition mail plug-in during the installation of Norton AntiVirus Corporate Edition 7.61, although neither Microsoft? Exchange nor Lotus Notes is installed. Upgrading to Symantec AntiVirus 8.0 does not upgrade the plug-ins, because the mail client is not installed.

This problem is fixed in Symantec AntiVirus 8.01, build 457. If you do not want to upgrade to Symantec AntiVirus 8.01 or later, you can resolve this by manually removing the plug-in.

To remove the plug-in manually

1. Rename the following files (change the file to .dll.old):
* nlnvp.dll
* notesext.dll
2. Restart the client.

by mred915

You say "This problem is fixed in Symantec AntiVirus 8.01, build 457." Well, some of my end users have been experiecing this same issue with the 10.1.0.394 version and according to the Symantec website (http://service1.symantec.com/SUPPORT/ent-security.nsf/0/9de45e757a1f6b6b8825713f00564bbe?OpenDocument&seg=hm&lg=en&ct=us), this issue is fixed with the installation of the 10.1.5 version. Although we technically didn't migrate from 10.0.2.2000, I thought I'd try the solution. In reality we migitrated from SAV v9.0 to 10.0.1.394. I hope to hear back from the user that this solution has remedied the problem after he reboots.

by johnmark

We are having similar problems with SAV Corporate 10.1.5. rtvscan.exe uses a large amount of system memory. I have already removed the startup scans. The previous AV was boxed product Norton Security which we uninstalled. Any ideas if we need to clean Norton up better before installing SAV 10.1.5?

by kferraro1

Even though this is an older post I wanted to respond. If you are still running 10.1.0.394 please up date it to at least 10.1.4 immediately. The older version has a serious security hole and trust me you don't want to get what it lets in. We were infected January 2007 and it took most of a month to get it completely eradicated. One of my gripes with SAVCE is how difficult it is to find out about and roll out security fixes like this.

by david.sandlin

Thanks for the help Tito999. Way to go. As for everyone else; It's a shame when people have to turn into idiots in a help forum. Remember this: We were all newbies once.

by mfhawn

I am having the same issues with 10.1.5.5001. It is infuriating, to say the least. I am tired of an AV program that nearly kills the machines!

Symantec's website is just worthless for questions like this. To call them is even worse, since you sit on hold for 16 hours!

Any help would be GREATLY appreciated!

We're running XP SP2 on the workstations, managed clients.

by a.kroll

I am on XPpro SP2. I renamed the files and restarted my computer with no change in CPU usage, except that explorer.exe usage went up.

by oskiller

I've seen the same problem with the 10.1.5.5010 version. There is no rhyme or reason to it. Some systems will be fine, some will blowup after awhile.

Tried all sorts of things, short of turning off auto-protect. What is the point of having an antivirus program that can't catch things as they come in?

by lesley_symmonds1

I have SAV 10.1.5.5000 and I still see 50% cpu utilization for rtvscan. Is this as intended? I see that it has reduced from the 80% and 90% others on this thread have reported but I would still not expect this service to take up so many cycles.

by mfhawn

In my opinion, I think 50% is still too much. You would think the purpose of an anti-virus would not be to kill your computer's performance as a side-effect.

I just wish that Symantec would fix this issue. I'm ready to switch otherwise.

by kferraro1

Symantec Broke 7.5
I too had the problem of 100% utlization with W2K and NAVCE 7.5, it happend overnight and made the machines unusable. I am pretty sure that some update that was pushed out through LU installed a component that pretty much broke the AV. We ended up installing 10.x which has its own set of problems (hence I am looking at this thread today) I also noticed about the time NAVCE 7.5 was broken on my school machines that my home edition broke and found it was the same type of thing, an update made it no longer compatible. In the home edition case it would no longer get def updates even though the license for the defs was up to date. A ploy to make sure you buy a newer version? Could very well be.

by qmacker

Every thread I've ever read on this subject from hundreds of posts always says, "Upgrade and it will fix the problem."

Every time I've upgraded, the problems always returns - but only on some machines.

This time, I'm running Windows Server 2008 64-bit. I'm running the 64-bit version of Symantec 10.2.0.298. In this case, is clocks the heck out of the CPU for about three minutes, then dies down to "normal" (1 or 2%).

I betcha the "answer" now is to upgrade to 11.0 for the "final" fix of all fixes.

Bigger fool me for sticking with them I guess, but they're the best of a bad bunch when it comes to server a/v. I'm probably wrong about that too. Anyone tried avast for servers?

by qmacker

And yes, I've checked all the usual boxes to not scan at startup, etc. etc.

I've another Server 2008 box that it doesn't go mad on at startup.

You'd think Symantec would get under the hood and PERMANENTLY FIX whatever is causing this across all their a/v products.

by tchandler

I am upto date with 10.0 but Symantec is now abandoning the corp antivirus going to endpoint when renewals come up.. I dont thnk there are many cghages , execpt mine as i am finall abanding Symantec after many years..
We aslo have performance issues/

This discussion is closed to new replies.