PG issues

[dallen]

I just noticed that my processor is running at around 50% all the time. If I disable PG3, usage immediately drops significantly. However, I am not seeing anything in the alert log that would indicate why. Here is a screenshot of my task manager showing what is hogging my processor:
http://web.ics.purdue.edu/~dallen/screenshot3.JPG

[bigc73542]

there is nothing out of the ordinary at first glance, I notice that you are useing IE explorerwhere as I running firefox and it shows that firefox is useing less resources. I also have PG 3.0 see my screen shot

[nick s]

Hi dallen,

It would help to see the "CPU Time" column in Task Manager (go View/Select Columns).

Nick

[dallen]

I just edited the photo above. I'm concerned that my processor is occupied at a considerably higher rate when PG is running and the marked programs are consuming higher processor time when PG is enabled as opposed to disabled. This indicates that process guard is, for example, causing vsmon.exe to struggle.

[bigc73542]

vsmon.exe info here (http://www.liutilities.com/products/wintaskspro/processlibrary/vsmon/)

[bigc73542]

ccevtmgr.exe -here (http://www.liutilities.com/products/wintaskspro/processlibrary/ccevtmgr/)

[dallen]

Here is what you requested, Nick S.http://web.ics.purdue.edu/~dallen/screenshot4.JPG

[bigc73542]

did a bit of searching and this[ SPBBCSvc.exe ] is called a trojan on every forum I looked on. It might be worth a bit of checking to see if it might be the culprit.

[dallen]

I would be very surprised if I have a trojan. I use TDS-3 from DiamondCS, one of the best anti-trojan softwares available. I think that "SPBBCSvc.exe" is associated with Norton SystemWorks Premier 2005, which is running on my system.

[jon_fl]

I have SPBBCSVC.exe running on my computer and I don't have an issue. It's from Symantec. I have zero CPU usage and memory usage 1,916K.

[bigc73542]

I just skimmed over a few forums that came up with that as a search word and the rusults were the specalist at the forums reading HJT logs and telling how to remove SPBBCSvc.exe. Without really getting into it I took it for granted it was an unwanted process. Just thought I would mention what I saw.

[edit] looks like we found out what it is. a symantec process. thanks Jon_fl

[Jason_DiamondCS]

Do those programs which have the higher CPU usage have allow flags in ProcessGuard? What is their setup in your protection list currently?

[nick s]

Norton AntiVirus 2005 (http://www.dslreports.com/forum/remark,11365332~mode=flat~days=9999) mentions compatibility issues with ZA. Tweaking NAV services, including SPBBCSvc.exe, are also mentioned.

Nick

[dallen]

I appreciate all your help. By the way, I really like PG3. I complain a lot about the time it takes for you to release programs. You all wonder why, then you release programs like PG3. When programs are this good, it should be obvious to you why we want TDS-4. Here is a screenshot of the settings you requested:
http://web.ics.purdue.edu/~dallen/screenshot5.JPG

[jon_fl]

I have NAV2005 and ZA and I have no issues whatsoever.

[Gavin - DiamondCS]

Do you have ZA self protection turned on ? sorry I haven't looked at it for a while and can't say offhand what the setting is named

[dallen]

"Protect the Zone Alarm Client"
Yes I had it on, but turning it off does not seem to fix the problem.

[Peter2150]

What does Norton System Works 2005 include. Does it have a firewall. I use Zone Alarm and I am seeing nothing like what you are showing.

[dallen]

No Firewall. It comes with Norton Anti Virus, Ghost and System Doctor.

[Jason_DiamondCS]

You might just want to close down one program at a time to see if you can find out why the SYSTEM process is using 50% of your CPU, that may help find if there is a specific process causing this.

[dallen]

I've closed down NAV, Ad-Watch, and ZA, but for some reason the only way I can stop this from happening is to disable PG. I really would like to fix this issue. How would you recommend I go about doing so?

[Peter2150]

Hi Dallen

It would seem like your problem is somehow related to your setup as there isn't a widespread problem.

You might try what Pilli suggested to another user. Uncheck all of PG's protections but leave protection enabled. If that solves the problem, then add back the protections one at a time and see what breaks it.

If there still is a problem with only the basic protection on you may have to go thru your list on programs and see if you can find the culprit.

Hopefully someone might have a better idea.

Pete

[redwolfe_98]

there could be a problem with your having both nav and virusscan installed..

i saw that someone else mentioned that they too were using virusscan: i don't understand why virusscan apparently works for some people, but not for others..

[siliconman01]

Turning OFF NAV 2005 self protection solves this high CPU useage on my XP-SP2 system. I let PG protect NIS 2005. In your case it would SystemWorks Premier self protection that you would turn off.

If you look in the Alert logs for Norton you will see rapid and multiple alert logs about Process Guard being blocked from accessing various Norton modules.

[dallen]

siliconman01,
Doing what you suggest works. Where exactly is the Alert log found? I would like to try to uncover what is the cause of this. I suspect that there are some files that if added to PG and given appropriate access rights could solve this issue.

redwolfe_98,
I only have NAV on my sytem as virus protection. I'm not sure what you are referring to when you say virusscan.

[siliconman01]

If you right click on the systray icon for NAV 2005, do you have a Log Viewer option? Open Log Viewer and there should be an Alert Log. The log entries will have stopped if you turned off Self Protection in NAV 2005 because PG is no longer blocked.

[dallen]

Thanks...I found the log viewer. However, the only repeated entries I see involve "dcsuserprotect.exe" as the "actor." So, shouldn't I be able to give dcsuserprotect full privilages and see my problem go away? I though PG was structured in such a way that giving a process privilages to access overrides a protected process from being protected. In other words, giving dcsuserprotect the right to read takes priority over NMain (another protected process) having "protect this application from" reading checked.

[siliconman01]

If you have Self Protection turned off in NAV 2005, the log events should not be occurring. Clear your log and see if any more appear.

It's NAV that is blocking any attempts by the PG executable dcsuserprotect.exe to access the NAV routines that are protected by NAV itself. None of the ALLOWS or Options in PG for dcsuserprotect.exe will let it access the NAV files if Self Protection is turned on.

Incidentally, TrojanHunter affects NAV in the same way because of the injection routine of TH for protection.

NMain is part of NAV.

[dallen]

siliconman01,
I knew that NMain is part of NAV. However, I did not realize that NAV was doing the blocking. That's very helpful and I thank you for the insight into this issue. Something interesting though. My home PC is set up identically as my laptop, but I am only experiencing this processor usage issue on my laptop. Any thoughts on that?

[siliconman01]

Are you sure the other system is not being affected? It's possible that the affect is much less than on your laptop because of the processor type, etc. My system only sees about a 15% increase in CPU utilization with NIS 2005 self protection on, but that is significant and undesirable to me.

Take a prolonged look at the other machine's CPU utilization with it turned on and then turn off self protection and see how much it drops. Also check if you are getting the log entries prior to turning off self protection.