Insufficient Resources

I feel your PAIN.

I have the EXACT same issue. Except only 60 workstations and it's happened to 6 of them. I was concerned that it was related to Trend/Micro then I read your post. Do you have TM client istalled on the file server also? Are there any events being logged on the File server or the client?

Yes, I am using Trend/Micro Client Server Security.  You are the third person, other than myself who has Trend/Micro and is having the same issue.  I'm leaning towards an issue with Trend.  On the client that acutally hoses up, there is a System Userenv event that occurs that reads "Windows cannot unload your registry file.  The memory used by the registry has not been freed.   This is often caused by services running a user account, try configuring the services to run in either the LocalService or NetworkServiceAccount.  If this problem persists, contact your administrator.  DETAIL: Insufficient system resources exist to complete the requested service."  I checked all my services on each client, and all are either running as LOCAL SYSTEM or Network Service Accounts.  

Add another Trend user to the list... I've got an XP Pro SP2 workstation with Trend Micro SMB on it that is reporting this error when accessing a file share on a win2k3 server.  Quitting and restarting the Trend client on the computer temporarily resolves the issue.  There aren't any event log (system or application) warnings or errors at the time the issue occurs.

We've all gone over TM's support site? I haven't been able to find anything there. Except maybe a reference to a potential issue with increased port-scans which they seem to think could indicate that certain malicious entities are trying to discover vulnerabilities.  I guess we could try to rollback to a previous version. The problem is that we can not reproduce this error on demand so we have wait for it to occur after a change is made. Its all speculation at this point.

David

I just had another workstation experience this same error.  The only thing I found out that would get everything back to normal would be to kill Internet Explorer.  I went through and killed several different processes in the task manager including the Trend client with no success.  All clients are running IE7.  Can any of you try this when the problem arrises again?  It may not be IE specific, but this worked for me without having to log the user off and back in or rebooting.  Thanks for your comments.

I've noticed the same behavior with several applications. I can close outlook, IE, SQL managment studio and the problem goes away.  What about TMlistene.exe Service name = Trend Micro Client/Server Security Agent Listener

Try stopping this service and see if the issue is resolved.

Sorry got side tracked on that last post.

While closing any one application may seem to resolve the problem it may only be temporary. The resources that have been released by closing said application would eventually get consumed by the leaking service.

Has anyone noticed whether or not the problem coincides with a scheduled update?

The following are the three TM services installed on the client.

Trend Micro Client/Server Security Agent Listener  ß Suspect

Trend Micro Client/Server Security Agent Personal Firewall

Trend Micro Client/Server Security Agent RealTime Scan

> While closing any one application may seem to resolve the problem it may only be temporary. The resources that have been released by closing said application would eventually get consumed by the leaking service.

> Has anyone noticed whether or not the problem coincides with a scheduled update?

have you patched your system with the latest SP and updates? if not, patch it first.

> The following are the three TM services installed on the client.
> Trend Micro Client/Server Security Agent Listener  ß Suspect
> Trend Micro Client/Server Security Agent Personal Firewall
> Trend Micro Client/Server Security Agent RealTime Scan

as per your situation, i think you may try to uninstall ALL Trend Micro software from one problem workstation and see what happens. this will let us know if the TM software is the system resource killer.

hope it helps,
bbao

I thought the same and am currently testing this hypotheses. I'll post back with results.

We have the same issue here, but by changing the idle session time to -1, on both the servers and the clients we currently seem to have solved it. For two days now the problem did not occur.

> by changing the idle session time to -1, on both the servers and the clients we currently seem to have solved it.

could you please be a bit specific? what kind of session time are you talking about? thanks.

Where do you change this setting(idle timeout) in Windows XP?  Thanks,

in the server service you have an idle session timeout which is default 15 minutes; you can check this through "net config server" in command prompt. You can change this setting by adding /autodisconnect:-1

so : net config server /autodisconnect:-1 ( I run it from a login script, it makes deploying a bit easier...)

Attention : the value has to be -1 to disable it -> a value of 0 disconnects all the time.

<speedsteve123> We have the same issue here, but by changing the idle session time to -1, on both the servers and the clients we currently seem to have solved it. For two days now the problem did not occur.

Does this setting change require a reboot? I ask because I've made the suggested change without success.

I made the change, and it did not correct it until a reboot.  I will let you know if the problem occurs again after implementing the idle timeout change.  

I also have a server experiencing this issue, 2 of the 4 users getting the "insufficient resources" message. They are running SBS 2003 with the latest SP and hotfixes, and Trend Micro CSM for SMB on the server and PCs. I've set the idle session timeout on the server to -1 (and rebooted the server) and will let you know if this resolves the issue. If this doesn't resolve the issue I'll try applying the change to the PCs too.

Cheers,
Daniel

Description of the IRPStackSize parameter in Windows 2000, in Windows XP, and in Windows Server 2003
http://support.microsoft.com/kb/285089

pPossible cause for teh mapped drives portion of this problem.....

Chalk up another user of CSM.  I am running several servers (Win2k3/Exchange2003) and ~60 workstations(WinXPSP2).  I have come across this problem on our older workstations (<1 Gb Ram).  I have had problems with Outlook and network printers disconnecting, as well as the  disconnecting Network Drives on the workstations (~12 PCs).  CSM is installed on both the servers and the workstations.  I have applied the changes noted in this thread and am monitoring the outcome to see whether it is indeed the server timeout causing the issue.

Cheers,
Matt

Update: We've had the issue recur (on the clients) after installing the idle session timeout fix on the server and clients.  We've also had a couple of machines experiencing performance problems (major disk thrashing) in the mornings, apparently due to TSC.exe (Damage Cleanup Services).  The default configuration seems to cause it to run quite frequently... whenever users log in, whenever virus definitions are updated, and so forth.  The following TM  KB article addresses the problem in OfficeScan... some of the controls are missing in SMB editions, but I'm trying the others...

http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-124431&id=EN-124431

I'm trying to find out from the users if the error is happening while TSC.exe is active...

-R

As you all know I have been struggling with this for some time now.  I do KNOW that if I uninstall TM the problem goes away. Now... whether this is a Microsoft (server service) or trend micro problem I do not know. I also know that I have paid for a subscription to TM and have yet to receive adequate support...

The TSC is only active after a catastrophic stoppage with a subsequent restart. I have yet to see the problem occur directly following a restart. It usually takes a day maybe less for the problem to come up. Which would indicate a leak of the memory flavor.

Would someone please get TM to comment on this???

I've replaced the network switch on my network that is experiencing these problems, and I THINK it's helping. If you have a spare switch handy try swapping it over and let me know how you go.

Cheers,
Daniel

hi MortgageInvestors

are you still here with us? any update from you?

cheers,
bbao

Update : 4 out of 3 clients don't have any issues anymore after changing the idle timeout. One client reported the same issues on three machines last friday. I did the same changes Idle timeout -> -1 .
I instructed the user to start working and to let me know, I was there the whole day, if the problem occured again. After 20 minutes he reported the same issue. I checked the problem and indeed it was the "Insufficient Resources" issue when trying to gain access to the drive shares. Next step was to add the IRPStackSize parameter in the registry. 30 minutes later he reported the same issue, I raised the IRPStackSize parameter value from the default 15 to 30, just to see what happend. 30 minutes later .. yes the same issue.

The I found something interesting on his machine. When I closed Outlook (!) the issue disapeared ! I let the user work without Outlook open and he worked for more the 3 hours without any problem. I then started Outlook again and -> the problem popped up again !

When he just had the issue, with Outlook open -> I could not gain access to the drive shares -> I closed Outlook -> directly tried to open a drive share -> it openend instantly!

So it seems that Outlook has, in some cases, has something to do with it aswell.

What the exact reason can be in this specific case, I don't know yet, but maybe you guys can see if closing Outlook lets you gain access to the drive shares again (?)

So we can see if this is a "standalone" case or a beginning of a possible solution...

Thought I'd throw my 2 cents in...

We are experiencing this too - as well as some other issues - after upgrading to TrendMicro OfficeScan Client/Server Security for SMB v3.6 (from v2.0). Our problem manifests itself as:

1) problems accessing network folders (either access is denied or insufficient resources errors),
2) problems accessing printers, and
3) network applications (software being run from a network share) crashing or locking up.

We're not experiencing the issues constantly, but they are frequent, and when they do occur they all occur together, before resolving themselves maybe 30 seconds later. Even though the people in this thread are talking about #1 above, I'd imagine #2 may be happening too, and #3 would be happening if you were running network software (tis fairly uncommon nowadays).

Interesting that someone else (djMundy) mentioned that replacing a network switch helped the problem - we had this experience too. Our main switch was showing signs of being faulty anyway, so when we upgraded to SMB v3.6 and started experiencing these problems last week, the first thing we did was replace the switch.

This reduced the impact of the problems - rather than 50%+ of our workstations being affected by the above problems all the time, after the new switch went in the majority of workstations "got better" to the point that they are experiencing issues maybe once a day rather than once every 30 minutes. Interestingly, though, there are still a couple of workstations that are just as bad as before.

I have no idea why a switch replacement would have this sort of impact, except to guess that maybe the problems are caused by the new OfficeScan Client being VERY sensitive to network problems? Therefore perhaps if your network is not perfect you see the above problems, and a partially faulty switch makes the problem that much worse? Out of interest, those that are experiencing the problems, what sort of switch(es) are you using - perhaps it's related to a specific brand? Ours was/is a Linksys SRW2048 (48-port gigabit).

One other thing I did discover while trying to fix this problem is that Trend Micro's documentation says you can't upgrade straight from Client/Server Security SMB v2.0 to v3.6 - althouth this is exactly what we did (and the installer let us). I'm wondering if this could somehow have had an impact - I haven't had a chance to re-install everything yet to check (and want to avoid it if I can :-S).

Those of you that are also experiencing this problem, how did you get to CS Security SMB v3.6? Fresh install? Upgrade? If so, from what version? Thought it was worth checking, maybe we all did the "incorrect" upgrade from v2.0 to v3.6 and that's what causes the problem.

Anyway, sorry for the long post, thought my findings & ideas may be useful. If someone does solve this PLEASE post the answer - I'm getting desperate.

Add another user to the list.  I found this thread very interesting so far.  We are experiencing the exact same issues in our enviroment (same versions, same symptoms and same temporary fixes).   We were able to recreate this at will on one machine.  Just uninstalled OfficeScan from that machine. Since reboot have not seen issue so far, time will tell.

Keep posting any new information....

Hi mattjk,

It's interesting to hear that replacing the network switch also helped you - but more interesting that you had a gigabit switch - mine was a 24 port Netgear gigabit. Did you replace it with a gigabit or 100MB? (we replaced ours with a 100MB and it actually seems QUICKER now...)

We are also having problems printing - but the printer is attached via USB to one PC (not the server), and the other PCs map the printer from that PC.

We are also running Trend CSM SMD 3.6 - but this is a new server - it was a fresh install of Trend.

Cheers,
Daniel

Forgot to mentione one big thing in my original post - it;s definately OfficeScan causing the problems. As soon as we unload the client from a workstation (not even uninstall, just unload so it stops running), all problems go away. I've also tried excluding C:\ from scanning (so it' essentially scanning nothing), and the problems still remain - unload they go away. I guess this suggests the problem lies in the Trend Service or some related component, rather than it being real-time scanning interfering with things.

djMundy:

We replaced with gigabit - exactly the same model that we removed.

Thanks for the info re fresh install of Trend, I guess that rules out dodgy upgrades as being the cause.

Update- we discovered a correlation between the problem and users who make heavy use of offline files.  The people who lose access to shares tend to be those who have made a large number of files on that share available offline.  Dropping down the amount of offline data seems to improve things.

robertdana: Just FYI, that doesn't correlate with our experience - while we do use folder redirection, none of our workstations have Offline Files enabled.

Update : I uninstalled the Officescan client -> cleaned registry to make sure everything was clean -> deployed the Officescan client again. The Roaming profile of the PC was also corrupted, but probably the disconnections caused that. So I also created a new profile. The problem seems solved.
I am going to keep the idle timeout disabled, can't hurt.

I just wanted to add that we too are experiencing the issue.  I plan to deploy the idle timeout changes this evening and I will report back next week what results we have.

I've had workstations with the idle timeout set to -1 still report the problem.

I've also set the idle timeout to -1 on the server and all PCs - it seemed to help a little but the problems have come back.

I also replaced the network switch which seemed to help a lot - but again the problems have come back - although not as frequently (as far as I can tell).

robertdana, some of our PCs had offline files enabled, but all had folder redirection (via SBS group policy). I've turned it all off and will report back on whether this helps.

I'd be interested to know how many people experiencing this issue are using SBS.

Cheers,
Daniel

djMundy:

Re Folder Redirection - we have this turned on for all users too. Please do report back if turning it off helps, perhaps it's linked to this. We're experiencing problems accessing non-redirected network shares as well as redirected ones, but who knows.

Re SBS - we're not using SBS - W2K domain controller, network folders + CS Suite server component are on a regular W2K3 server.

Has anyone been talking to Trend support about this issue? We're having trouble even getting a resposne from them :-S

Guys .. please read my previous post ...uninstalling Officescan on the workstation, cleaning the registry, rebooting and deploying the Officescan client SOLVES the problem (!)

speedsteve: Sorry, I did read your post before, I just forgot to reply.

Happy to hear this solved the problem for you, but unfortunately it doesn't for us - I tried uninstall/cleanup/reinstall as part of early troubleshooting and it didn't help :-(

Can I clarify though: what do you mean by cleaning the registry? Delete Officescan related keys?

We are not using folder redirection or SBS just W2K3/R2 multi-site domain with Trend Micro Client Server Security for SMB 3.6 deployed to 70+ workstations less than 10 experience the problem (Insufficient system resources exist to complete the requested service) while trying to access a network drive either by exploring it or trying to save a file. The workstations that are having this problem are the most active users in the organization, Developers/QC/DB-Admin's.

Oh and still no response from Trend Micro

Anything think it would be a good idea to share support ticket number? Perhaps we might get more action if we can say "we're not the only ones, see tickets x, y and z"?

has anybody heard from trend....??? i too am having this issue and running offscan on client workstations....what a frustrating one this is?! only happening to one user at the mo...

Here is my service request number  1-118089326

I finally got in contact with helpful people at Trend, who told me they'd had multiple reports of this issue.

No proper fix yet, but they did suggest two workarounds - they're detailed below. While it looks like one is the not-completely-effective IRPStackSize idea already floated in this thread, the other is new.

They instructed me to apply "Solution 1" first, see if that resolved the issue, and then move on to "Solution 2" if it didn't.

So far I've trialled Solution 1 on one (badly affected) PC with great results - the problem seems to be entirely gone. I will roll out to more workstations on Monday and provide an update then, but for now if anyone else wants to try, here are the suggested workarounds:

Solution #1:

Enlarge paged pool - reboot required
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Value: PagedPoolSize
Data: 0xFFFFFFFF



Solution #2:

To resolve the issue, increase the IRPStackSize value in the registry:

1.  Open the Registry Editor:
   a. From the desktop, click Start > Run.
   b. Type "regedit" then click OK.

Important: Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

2.  Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters.

3.  In the right pane, double-click IRPStackSize.

      Note: If IRPStackSize does not exist, create it by doing the following:

      a.  Right-click on the right pane and then click New > DWORD Value.
      b.  Type "IRPStackSize" exactly as it is shown here and then press Enter.

4.  For the Base section, choose the option Decimal.

5.  In the Value data field, type a value higher than the existing value and then click OK.
    It is recommended that you increase the existing value by 3.

6.  Close the Registry Editor.

7.  Restart the computer.

If the issue persists, increase the IRPStackSize value again or set it to 20.

Let me join the club.  We are experiencing the same issue on two of our four clients.  The two affected clients are both laptops (using hibernation regularly) and heavily used with network shares open most of the time.  The other two clients are low usage workstations and don't _seem_ to be affected.

The rest of our environment is similar to others described already in this thread:
- Windows SBS2003 server, all patches except SBS2003 SP2, WSUS 3.0
- Exchange/Outlook2003 email setup
- Trend Micro SMB v3.5.1113
- 3com Baseline 24x100Mb unmanaged switch
- We do not use offline files
- We use mapped drives continuously and heavily
- Both affected clients are HP nw8440 laptops with 2Gb memory, running XP SP2, IE6, TM Client, Skype, Outlook, and CAD software using  wired network connections
- Hardly a murmur in any of the Event Logs on my system

This issue seems come and go thru the day - sometime you get a quiet patch then it comes back again and so far only a logoff-logon sequence or reboot seems to fix it, but next time I'll start by unloading the TM client and seeing what effect that has (remember, that may work simply because it frees up resources)

It seems to me that the idle timeout solution it not completely effective, and therefore not the root cause.  I intend to try the solution proposed my Trend as described by mattjk if this problem continues.

Some things I forgot to mention:

- Skype rides right thru the storm, so I doesn't look like a IP level issue directly?
- Outlook reports sync issues if you try to send mail while experiencing the problem
- ipconfig /release - ipconfig /renew does not fix the problem
- this issue was one that prompted an upgrade from 1Gb to 2Gb memory to no avail, and from 1Gb to 3Gb on the server to not avail (although the server was strugging before - 1Gb is not enough for SBS with Exchange, WSUS, SBSMonitoring, Sharepoint, TM CSM, etc!)

Another comment!

- We crossgraded from Symantec's SMB package to Trend Micro CSM in May this year.  This may be a problem in our case - see article Q_20617680

And a question:

It gather the PagePoolSize and IRPStackSize settings are intended to be set on the client computers? or should it be the server? or both?

I don't especially like reg tweaks to keep a network running smoothly - something is not so hot somewhere.

nicolasn: PagePoolSize and IRPStackSize should be done on the workstation as far as I can gather.

I don't like registry tweaks like this either, but so far PagePoolSize is working wonders (rolled out to 3 out of 25 workstations, all seem fine). I'd assume a "proper" fix (i.e. new software version) is in the works, so if you apply the registry setting via Group Policy at least it's easy to revert later.

An update:

I applied the first "solution" (PagedPoolSize) a couple of days ago and it appears to have helped the problem. Unfortunately it has not resolved it completely, but there is a definate improvement.

I then applied the second "solution" (IRPStackSize=18) yesterday and haven't had any noticable improvement. I will be increasing IRPStackSize to 20 today and will post back the results.

Has anyone else made any progress?

If anyone wants to try the above two "solutions" in an Active Directory environment, I've attached the custom ADM file I made to apply the fix centrally.

CLASS MACHINE
CATEGORY "Custom"
    CATEGORY "Trend Micro"
        CATEGORY "OfficeScan Client-Server Security Agent"
            CATEGORY "Registry Hacks"
                POLICY PagedPoolSize
                    EXPLAIN !!PagedPoolSizeHelp
                    KEYNAME "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
                    PART !!PagedPoolSize_Configure DROPDOWNLIST REQUIRED
                    VALUENAME "PagedPoolSize"
                    ITEMLIST
                        NAME !!Default VALUE NUMERIC 0 DEFAULT
                        NAME !!Maximum VALUE NUMERIC 4294967295
                    END ITEMLIST
                    END PART
                END POLICY
                POLICY IRPStackSize
                    EXPLAIN !!IRPStackSizeHelp
                    KEYNAME "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
                    PART !!IRPStackSize_Configure DROPDOWNLIST REQUIRED
                    VALUENAME "IRPStackSize"
                    ITEMLIST
                        NAME !!Default VALUE NUMERIC 15 DEFAULT
                        NAME !!Eighteen VALUE NUMERIC 18
                        NAME !!Twenty VALUE NUMERIC 20
                    END ITEMLIST
                    END PART
                END POLICY                
            END CATEGORY;
        END CATEGORY;
    END CATEGORY;
END CATEGORY;
 
[strings]
TrendMicroOfficeScanHacksCustomADM="Trend Micro OfficeScan Client/Server Security Agent related settings"
PagedPoolSize_Configure="Set the Paged Pool Size to: "
Default="Default (automatically detected)"
Maximum="Maximum"
PagedPoolSizeHelp="Sets the PagedPoolSize key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6." 
 
IRPStackSizeHelp="Sets the IRPStackSize key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters. This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6."
IRPStackSize_Configure="Set the IRP Stack Size to: "
Default="Default (15)"
Eighteen="18"
Twenty="20"

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:

Mattjk,

  --> This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6."


A perfect description. Thanks for the ADM.

Gotta have accurate descriptions :-) No worries.

Another of my clients is now experiencing the "insufficient resources" errors on one of their PCs and also problems printing - but the interesting thing to me is that they don't have a server running CSM for SMB. This client has PCs in a workgroup and the one experiencing the problems is running Trend Micro Internet Security Suite 2007.

Another technician is looking at this, I suggested he try disabling Trend - this immediately fixed the errors and allowed the PC to print. He then applied the "paged pool size" hack and rebooted but the PC reboots while loading the profile. This is not a result of the hack as they informed him it was doing this earlier...

Last week I applied the "paged pool size" hack on the PCs affected where the client is running Trend CSM for SMB as so far they have not seen the error - although it might be too early to tell (they are a small client with only 3 users).

Cheers,
Daniel

I also have had great success with the PagedPoolSize registry hack. Additionally I have been in contact with TrendMicro's tech support for some time now, I recently asked if there were any plans to provide a permanent solution. The following was the support engineers response.

"" To be honest with you, please be advised that this is a known issue.  Our engineers are already working on this and hopefully release a hotfix soon.

For the meantime, I will be asking for your permission to close this case.

Thank you very much.

Best regards,

Ferdinand Bañaga
TrendLabs HQ, Trend Micro Incorporated ""

It appears we can put this issue to rest now... right?

David

The timeout fix appears to have worked for all but 2 machines in my case.  I reinstalled Trend on both of those computers and have had no more reported issues.  That being said I still hope Trend releases a hotfix ASAP as I have a feeling the issue could start to rear it's ugly head again.

Do you know if you have to contact Trend for the coming hotfix, or will it be released in an update?

An update from my end: IRPStackSize = 20 might have improved things slightly, but the problems is still occurring.

I've been in contact with Trend support again and they have offered up one more possible workaround, and if that fails, want me to rollback to an earlier version of the scan engine until the problem is fixed in the latest version. Details are as follows:

Solution 1:

1. Enlarge paged pool - reboot required
HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Value: PagedPoolSize
Data: 0xFFFFFFFF

2. Enable SystemMapView - reboot required (for VSAPI 8.55-1001)

HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters
Value: EnableSystemView
Data: 1  (DWORD)

Solution 2:
http://esupport.trendmicro.com/support/search.do?cmd=displayKC&docType=kc&externalId=PUB-en-1034342

ck-EE: Interesting that they told you here would be a hotfix. The guy I've been dealing with (Joey) was quite explicit in saying there wouldn't be a hotfix, and the problem would only be fixed properly in the next official release of CS Security for SMB, which would be early next year.

Great thread.

I just finished reading this after many of our users are experiencing the same insufficient resources error and losing network drive access and network printing access over the last couple of weeks.  The whole time, the network SEEMS ok as the client never loses a ping packet to the server even when these errors are occuring.

We are using SBS 2003 here  and Trends AV.  Now it's time to determine what version of the software we're at on the server and the clients (I'm a consultant here and did not set that piece up) and look into implementing these supposed fixes if necessary.  Great input from everyone!  Thanks.

-JR

Howdy All,
We have been beating our heads against the wall for a couple of months now. The users will usually beat me to the punch and reboot thier computers. Over the last couple of days I saw another post pointing to the Trend Micro issue. Sure enough unloading the Client fixes the symptoms immediatly.

I finally came to this thread and the posts shed a huge amount of light on my issues with 35 networks all with TM CSM 3.6. Needless to say we have been pulling our hair out.

I called TM Tech Support Open Ticket 1-119568834 and talked to Tech Chito. He begain asking me to turn on logging on the server etc. I turned this whole post into a PDF and emailed it to him asking him to read the whole thing while I waited on the line. When he was done he put me on hold and said there was a possible hotfix for this citing Article 103528 which led me to HotFix B1142. He said that only level 2 tech support and send the file and to use the following procedure before they would send it. I will apply this on my largest network with the most screaming users and report back. Some of this has already been cited in this thread however I asked him for a specific orded procedure to diagnose this problem.

Here it is in all it's Glory. I will apply this on my largest network with the most screaming users and report back.

==On the affected computer==

1. Verify the memory usage of NTRtScan.exe and PccNTMOn.exe if its more than 25mb try to stop that process and see if that fixes the issue.

2. verify the version of NTRtScan.exe and PccNTMOn.exe  -right click on it  -click properties  -click version tab

3. Go to services and stop Trend Micro realtime scan or Officescan realtime scan -replicate problem to see if stopping realtimescan fixes the problem.

4. Enlarge paged pool - reboot required

  a.  Open the Registry Editor (regedit.exe).

 Important: Always make a back up copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

  b.  Go to HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.
  c.  Look for the "PagedPoolSize" key and change its value to " 0xFFFFFFFF".
  d.  Reboot the server.

5. Enable SystemMapView  reboot required (for VSAPI 8.55-1001)
   a. Open the Registry Editor (regedit.exe).

 Important: Always make a back up copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

  b. Go to HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters.
  c. Add a new DWORD value called "EnableSystemView" then assign it a value of "1".
  d.  Reboot the server.

6.
  a. Click Start > click Run > type Regedit
  b. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\Memory Management\ and make sure that the value of the registry entry SystemPages = 0.
  c. Close the registry hive
  d. Restart the Trend Micro Services.

7. If the solutions above does not work just reply back to this email to inform me.

Looks like we're getting close! A couple questions about Trend's suggestions:

Step 2 says, "verify the version of NTRtScan.exe and PccNTMOn.exe." What about the version are we to verify?

I see mention of the CSM server in the directions from Trend, but only to reboot the server in steps 4 and 5. Are steps 1, 2, 3, and 6 to be applied to the server or clients, or some on one and some on the other?

Thanks,
Nathan

Yes, Nathan I was quickly confused by the procedure as well so I did nothing until I called them back to clarify the steps. He verified that all the steps are for the workstation. He did say however that if you are having the issue on a server that is running the Client the procedure can be used there as well. I will make changes to the procedure and post below my opening comment. I told mike this was BS having to make registry changes manually and that they should have an executable or batch file that takes care of this for us. He said he did have a batch file that does all three steps and sent it to me zipped. I will be happy to forward it to anyone that needs it. My email address is larry@pathwayits.com.

After interogating Mike the TM Tech some more he told me there will be an updated Scan Agent first quarter next year. This will be included in the automatic update processes on the Server/Workations.

In answer to your post the version for 3.6 should be 7.6.0.1095 for both exe files. He said that was a typo and the steps should be fore the affected Client machine server or workstation affected. I think we are all having the issue on the workstations so far although I have not concentrated on some odd server issues lately. Namely CSM Spam stops working with no warnings or events showing up. I usually will get a call from my clients screaming about spam. All I do is either kill the SMEX or restart the Service then go into the dashboard and run a manual update. Fixes it every time. The other issue I am having is the Exchange Clients will not get mail and Outlook will say "Attempting to Retrieve". In the past a reboot of the server fixes the issue. The last time I had a hunch with all the TM BS going on and killed the SMEX Spam Process and immediatly the mail began flowing. For the last couple of months or come to think of it I have had nothing mut trouble with TM 3.6. I skippted 3.5 on all my networks and don't recall ever having a problem with 3.0. 3.0 was so good I dumped Symantec Client Security which I don't miss.

OK enough blather. Here are the updated manual instructions or send me an email and I will send you the file they send me. I will take no responsibility if you machines blow up LOL

==On the affected computer==

1. Verify the memory usage of NTRtScan.exe and PccNTMOn.exe if its more than 25mb try to stop that process and see if that fixes the issue. Workstation

2. Verify the version of NTRtScan.exe and PccNTMOn.exe  (7.6.0.1095)  -right click on it  -click properties  -click version tab

3. Go to services and stop Trend Micro realtime scan or Officescan realtime scan -replicate problem to see if stopping real time scan fixes the problem.

4. Enlarge paged pool - reboot required (Workstations or Server if Affected).

  a.  Open the Registry Editor (regedit.exe).

 Important: Always make a back up copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

  b.  Go to HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.
  c.  Look for the "PagedPoolSize" key and change its value to " 0xFFFFFFFF".
  d.  Reboot

5. Enable SystemMapView   reboot required (for VSAPI 8.55-1001)
   a. Open the Registry Editor (regedit.exe).

 Important: Always make a back up copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

  b. Go to HKEY_LOCAL_MACNE\SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters.
  c. Add a new DWORD value called "EnableSystemView" then assign it a value of "1".
  d.  Reboot

6.
  a. Click Start > click Run > type Regedit
  b. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\Memory Management\ and make sure that the value of the registry entry SystemPages = 0.
  c. Close the registry hive
  d. Restart the Trend Micro Services

7. If the solutions above does not work just reply back to this email to inform me.

All,

With even more interogation I was able to get the FTP site for this VBS Script file that does all three reg hacks with one click. I probably should not post this but I think this might make things a little easier for everyone with this problem. I did ask Trend Micro Tech Mike running this Script could cause any new problems and he said no however use at your own risk.

ftp://ftp-download.trendmicro.com.ph/memory/
username = ftpuser
password = ftp-trend

password = novirus - for memory.zip

I am anxious to hear if we are getting somewhere. I did run this on one test unit and will report back.

Thanks all for leading me down the path. Since I saw this post I have been pounding Trend Micro tech support for answers. Called them 4 times since yesterday and spoke with 3 different techs to compare what they new how could they make our lives easier.  Maybe I will start sleeping better now. :-)

I can also confirm that Trend Support told me to apply the workarounds on any affected computer - be it a workstation or a server (in our case it's all workstations). I'd be loathe to apply these sorts of registry hacks to a server anyway...

lkallal: Just a quick note, there's an even quicker way to check the version of each file - if you find it in Explorer (normally in C:\Program Files\Trend Micro\OfficeScan Client) and simply single left-click on it, the status bar of the explorer window will show the version number.

Anyway, an update from my end: I applied the SystemMapView change and that hasn't helped at all. For us that means we've applied IRPStackSize = 20, SystemMapView = 1 and PagedPoolSize = 0xFFFFFFFF. The only one that made any appreciable difference was PagePoolSize = 0xFFFFFFFF, which improved the situation, but didn't fix it.

I haven't seen the SystemPages = 0 suggestion (as per solution #6 in lkallal's post), so I will try that now and report back.

I've also attached an updated custom ADM to simplify deployment of these workarounds for anyone in an AD environment. Three quick cave-ats though:

1) use completely at your own risk,
2) these are "sticky" policies - i.e., if you ever want to revert the registry keys it modifies to their original settings you will need to use another custom ADM to do this (and know what the original settings were in your environment). Simply removing this ADM WILL NOT delete / revert the registry keys being changed, and finally,
3) some of the ADM options refer to a default / original value - this is as per my environment, this may not be the same as yours.

CLASS MACHINE
CATEGORY "Custom"
    CATEGORY "Trend Micro"
        CATEGORY "OfficeScan Client-Server Security Agent"
            CATEGORY "Registry Hacks"
                POLICY PagedPoolSize
                    EXPLAIN !!PagedPoolSizeHelp
                    KEYNAME "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
                    PART !!PagedPoolSize_Configure DROPDOWNLIST REQUIRED
                    VALUENAME "PagedPoolSize"
                    ITEMLIST
                        NAME !!Default VALUE NUMERIC 0 DEFAULT
                        NAME !!Maximum VALUE NUMERIC 4294967295
                    END ITEMLIST
                    END PART
                END POLICY
                POLICY IRPStackSize
                    EXPLAIN !!IRPStackSizeHelp
                    KEYNAME "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
                    PART !!IRPStackSize_Configure DROPDOWNLIST REQUIRED
                    VALUENAME "IRPStackSize"
                    ITEMLIST
                        NAME !!Default VALUE NUMERIC 15 DEFAULT
                        NAME !!Eighteen VALUE NUMERIC 18
                        NAME !!Twenty VALUE NUMERIC 20
                    END ITEMLIST
                    END PART
                END POLICY 
                POLICY EnableSystemView
                    EXPLAIN !!EnableSystemViewHelp
                    KEYNAME "SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters"
                    VALUENAME "EnableSystemView"
                    VALUEON NUMERIC "1"
                    VALUEOFF NUMERIC "0"
                END POLICY
                POLICY SystemPages
                    EXPLAIN !!SystemPagesHelp
                    KEYNAME "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
                    PART !!SystemPages_Configure DROPDOWNLIST REQUIRED
                    VALUENAME "SystemPages"
                    ITEMLIST
                        NAME !!Original VALUE NUMERIC 798720 DEFAULT
                        NAME !!AutoCalculation VALUE NUMERIC 0
                    END ITEMLIST
                    END PART
                END POLICY                
            END CATEGORY;
        END CATEGORY;
    END CATEGORY;
END CATEGORY;
 
[strings]
TrendMicroOfficeScanHacksCustomADM="Trend Micro OfficeScan Client/Server Security Agent related settings"
 
PagedPoolSize_Configure="Set the Paged Pool Size to: "
Default="Default (automatically detected)"
Maximum="Maximum"
PagedPoolSizeHelp="Sets the PagedPoolSize key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6." 
 
IRPStackSizeHelp="Sets the IRPStackSize key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters. This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6."
IRPStackSize_Configure="Set the IRP Stack Size to: "
Default="Default (15)"
Eighteen="18"
Twenty="20"
 
EnableSystemViewHelp="Sets the EnableSystemView key (enables / disables System Map View) in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters. This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6."
 
SystemPages_Configure="Set System Pages to: "
Original="Original Value (798720)"
AutoCalculation="Automatic Calculation (0)"
SystemPagesHelp="Sets the SystemPages key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. This is a HACK to help problems with Trend Micro OfficeScan Client/Server Security Suite for SMB v3.6." 

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:

Posting the memory.vbs file from Trend:

Dim objShell
 
Dim strParameter, strSystemView
strParameter ="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSApiNt\Parameters\"
strSystemView = "EnableSystemView"
 
Set objShell = CreateObject("WScript.Shell")
 
objShell.RegWrite strParameter & strSystemView, 1, "REG_DWORD"
 
 
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
 
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")
 
strKeyPath = "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\"
strValueName = "PagedPoolSize"
dwValue = 4294967295
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
 
Wscript.Echo "Done"
WScript.Quit

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:

Mattjk, I'm trying to use your both of your .adm files, but for some reason they aren't showingup properly in GPMC for me.  I can expand the categories down to Registry Hacks, but there is nothing listed under there when editting the policy.  Any ideas?  I'll do some searching around for tips on custom adm files in the meantime.

Nevermind, figured it out.  There's a filtering option in GPMC called "only show policy settings that can be fully managed" and I needed to change that.

how many EE accounts does the author have? ;-)

In another update, applying SystemPages = 0 seems to have improved things further.

That brings us to the point where applying all the fixes listed in this thread (summarised nicely lkallal's second last post) has almost resolved the problems. We're still seeing some problems - and of course have lots of dodgy registry hacks floating around - but we're down to a couple a day (on a 25 computer network).

That being said, I'm still considering rolling back to the earlier scan engine (as suggested to me by Trend support) as it would be good to fix all of the problems and get rid of all the registry hacks.

jrink1350: Sorry, should have mentioned the filtering option in my original post. So used to it that I don't think about it any more.

bbao: These posts are actually all me replying to myself so I can show Trend the thread and say "See! The problem is widespread! It's not because I'm trying to run the Trend Server on Windows 98!" :-)

Update: I tested 4 of my worst offending workstations.

The 2 where I uninstalled Trend and installed AVG Free temporarily have been trouble free for 3 days. These stations in the past would need at least one reboot a day to temporarily correct the symptoms described.

The 2 where I ran the 3 reg hacks have been fine as well.

My observations seem to indicate that the issue will hit a random workstations. I have 35 locations with TM CSM and I will say that only 25% have reported problems. That does not mean there aren't any as many users seem to get used to rebooting when they have an issue as it always seems to fix the problem for a half a day or so. Even locations with identical configurations 2 in 10 might exhibit the symptoms. I am waiting till the end of tomorrow then if no problems re-introduce the TM client with the reg hacks and see what happens.

IHow can such a once great product be turned into such crap so quickly. I have just renewed many of my clients so it looks like I'll have to keep everything together until we get the updated Scan Engine early next year. I hope the TM Tech I talked to wasn't giving me a load of BS.

At least knowing what is causing our issues is better than beting admitted to the loony bin. I was close. I now know I can stop the screamers by removing TM and installing Free AVG? How sad is this?

"How can such a once great product be turned into such crap so quickly. I have just renewed many of my clients so it looks like I'll have to keep everything together until we get the updated Scan Engine early next year. I hope the TM Tech I talked to wasn't giving me a load of BS."

Clearly something has come off the rails over at TM... I was a partner for a while, installing both their consumer and business products.  Then a new version of PC-Cillin came out (don't remember if it was 2006 or 2007) and turned a well-regarded, fast, nag-free program into a nightmare that bugs the user with frequent security warnings and slows machines to a crawl.  Literally every single customer that upgraded called me to complain.  I've been dreading the migration of the new technologies from that release into the corporate products... looks like it's starting to happen.

@robertdana

Thanks for the info

robertdana: That's concerning :-S I have no experience with PC-illin so I didn't know the situation there. I must say one of the main reasons we selected Officescan over competing products was it's small footprint - both in terms of memory and CPU usage. Will be very disappointing if that changes :-(

Last Wednesday (12/12/2007) we started having users complaining on the same issue. The problem is that the user gets the "Insufficient system resource ..." when they try logging in to the machine and as a result it doesnt load the user's roaming profile. I tried the script which increases the "PagePoolSize" and it does fix the problem. We checked with Trend Micro and Microsoft last night and they we were not recommended to change any of the registry keys. So, we are in a puzzle now waiting for Trend & Microsoft to come up with a solution on the problem.
The weird thing is that if the services of Trend Micro is switched off on the machine, everything becomes normal. I still can't understand what is Trend Micro doing to cause the memory leak even though the CPU utilization is not high the memory resources are still free.
I will really appreciate you help and support.

I stumbled across another post on EE where a member posted the following information from a tech from Trend Micro explaining the root cause of these problems. My understanding of this is that the virus patterns have outgrown the space reserved (in paged pool) for them. This explains why increasing the paged pool will fix the issue.

Quoting from http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_22946258.html :

The root causes of the issue are following:

1.       Overlarge pattern size

            Currently, 100MB in paged pool size is required to host virus pattern, 160MB is the default size for most operating systems (OS).

            For the default paged pool size on different operating systems, please click here. Note: There is no limitation of paged pool size in Vista.

2.       Default space hosting pattern has reduced from v8.50 to v8.55.

            SystemMapView was utilized to host virus pattern in v8.50, it is disabled by default in v8.55.

At last Trend confirmed today that we should go ahead with the fix and they will be releasing a new fix for the scan engine in the coming week to resolve this issue. For now we've included the keys in an msi package and deployed it to the users who are having the problem.

Has Trend come out with this fix yet anyone?

Engine version 8.550.1001 fixed the problem in our environment.

Unless I'm misreading that engine's release date (http://www.trendmicro.com/download/engine.asp), it seems unlikely that that engine fixed anything since it was released before this thread was started. (Oct. 19, 2007 vs. Nov. 08, 2007).

Our engine auto updated around December 15th from 8.50 and we have had no problems since then. Before the engine was updated I did install the patch that lkallal mentioned in the thread from December 6th on a test group of machines. The patch worked for these users.
If my memory is correct, Trend downgraded the engine to 8.320 for a brief period in early December before releasing 8.55. Confused? I am.

In every case where this issue occurred I was able to apply the fix to correct. It has been pretty quiet the last couple of weeks. TM originally said they would have new a scan engine first quarter 2008. Looks like we made enough noise tbe update came early.

I hope I can regain my faith in TM CSM. Years from now will I still remember the "The TM Incident of 2007". Maybe .... Maybe Not .... I can think of many things I would have rather spent time and resources on in 2007.

Trend Micro "Zero Admin" seemed real for a while. I guess there is no such thing :-)

thorn68: Are you using Client/Server Security for SMB, or the full Officescan Suite? Just curious as my server update logs don't show any scan engine updates (going back to 8th Dec 2007), only a spyware engine update on 10th Dec (to v5.2.1032). Yet, our clients have scan engine v8.55.1001 ?

I just noticed that Trend released Patch 1 for v3.6 of Client/Server Security for SMB (and also Client/Server Messaging Security for SMB) on 20/12/2007 - http://www.trendmicro.com/download/au/product.asp?productid=40

The release notes don't say anything about the issues we're discussing in this thread - and the update is for the Security Agent (no scan engine update) - but I decided to ask Trend support if this update fixed our problems.

Their response was "Yes, this Patch1 is designed to address all issues regarding CSM 3.6." so I've gone ahead and installed it this evening. No immediate problems - I will roll back the registry hacks on a few PCs tomorrow and see if the problems are gone.

I've applied the patch on several sites with no noticeable improvement.

The PCs no longer have "insufficient resources" errors, but that's because I've applied the hacks. I'm not game to remote the hacks yet.

The problem that remains, though, is that the server completely locks up at about 3:00pm every day, causing everyone to lose their work. If I disable the Trend services on the server there are no problems.

However, disabling the services on the server seems to stop everyone from receiving updates (I was hoping they'd continue to download updates over the Internet) - a pain as several PCs have had major virus problems since disabling the services.

djMundy: We've applied the patch and are not getting any server lock-ups? Like you we haven't removed the reg hacks yet though, so no idea if the patch helps our other problems.

I just had a brainwave, I've created a script (and scheduled task) to stop all Trend services at 2:00pm every day, and start them again at 8:00pm - what a hack!

I have a feeling that the patch is what solved the problem and not the updated  release from Trend. I received a call from a user that they were unable to connect to mapped drives. I applied the patch and the problem went away. I think that it may have been a coincidence that I applied the patch to all the machines that were having the issues and this one slipped by.

Has anyone heard if there is a known solution to this yet?  I've been monitoring it.  I have uninstalled trend-micro off of machines and reinstalled two days later. Seems to have worked for me...

The Saga Continues
I was going over one of my clients servers and actually found one with version 3.0 CSM. I had not had any problems with this client. I just renewed thier license so I figured I would upgrade them to 3.6 since the miracle patch was in. The upgrade and finally the patch installed with no issues however the whole time I kept feeling I was making a mistake.

Now at least half of the Windows XP Pro workstations take 10 minutes or longer to startup. When I run MSConfig and turn off Trend Micro Services plus startup items the systems startup in less than a minute. If add them back and the problem returns. I checked all my settings and don't see anything that would cause this.

Needless to say I am very tweaked at this product. It continues to not only disappoint but cause me continued grief and time spent on non-billable hours.

Anyone have any ideas about this latest problem. I did not run the fix on these systems as I am now running the latest Scan Engine etc. 3.6.1161. Is the only solution to uninstall Trend Micro? I will be going back to this client very early Monday and will be yelling at TM Tech Support .... Again! I will report the outcome.

Here's the fix: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1036648&id=EN-1036648

While this page was published 3 days before the SP1 page (http://www.trendmicro.com/download/au/product.asp?productid=40), this patch requires you to contact technical support, therefore it stands to reason that it is not included in SP1. It is a server-side tool that will update all of the clients.

Finally. Seriously.

This was a fun conversation with TM tech support:
<conversation>
Dear Nathan,
Thank you for choosing Trend Micro as your network security solutions provider.
This is Nino from Trend Micro Product Support Team. I gather that you are requesting for a patch mentioned in Solution ID: 1036648.  I know the importance of this concern and I am here to assist you. Please check again: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1036648&id=EN-1036648. There is no patch mentioned in Solution ID. This KB article stated 2 options as the workarounds.
___________________________
Hi Nino, Then please explain what this means: "Option I: Contact Technical Support to request for a server-side tool that will automate the following for all clients:" Thanks, Nathan
___________________________
Hi Nathan,
Attached is the tool mentioned in the KB article.
___________________________
</conversation>

HA! Anyway, I'll be pushing this out today.

Nathan

I have the same issue with some of my workstations. I installed the patch lister below, and the issue seems to have ceased for the time being. Strangely, there is no mention of a fix for this particular issue listed within the patch notes, however it seems to have done the trick, no problems for a few days now.

-----quote----
Client Server Messaging Security 3.6 Patch 1
Platform:        Windows
Description:   This patch includes the fixes to problems discovered after the GM build. Refer to the following section for issues resolved with this release.
Date:              Dec 20, 2007
Files:              CS_36_WIN_EN_PATCH1.exe
----quote----

This patch is available from: http://www.trendmicro.com/download/au/product.asp?productid=40

I've been working with Trend on this issue and they sent me a beta versions of the 8.60-1001 scan engine. The engine seems to resolve the resource issues and greatly improve performance of machines.

They intend to release it this month to all users.


If you would like the engine, shoot me an email. I will not post it here because of the fact that it is beta. I've installed it on over 50 machines without issue, this includes servers.

mchambers @ corpitsol.com

Anyone heard what's happening with the 8.60-1001 scan engine?  We've been crippling along on v3.5 (scan engine 8.550-1001) with the hacks since it our own small network.

But I'm still wary of recommending Trend to anyone right now, and their slow response and lack of public general acknowledgment is not helping boost my confidence.  This is

By the way, we've used Symantec Corporate Antivirus previously with no hitches other than the awkward installation and configuration and I don't specifically want to go back to it.  Does anyone have any other recommendations of alternatives suitable for SBS2003?

They told me it would be released at the end of February.


If you need the 8.600 engine you can shoot me an email or otherwise get in touch with me. I can provide the same engine they gave me, works like a charm.

Ok, I apologize, but that could have included the term "Insufficient system resources" somewhere...

http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1036648&id=EN-1036648

thanks citslogin, i'll wait a little longer, then perhaps contact you.

Add me as another victim. I'm running a small 3 PC network with Trend Internet Security 2008. Installed Trend in December and had used the 2006 version previously.

Started receiving error messages several days ago:

When connecting to SQL Server "Error 1450: General Error"

When accessing network folders "Server\Share not accessible, Insufficient system resources exist...."

Add/Remove Programs - "Please wait while the list is being populated" would take 10 mins to populate.

Issues were compounded with several applications open - notably VS2005 and Outlook.

Uninstalled Trend and problems resolved.

Forgot to mention that I first noticed the problem because I was experiencing problems printing to 2 network printers- "Printer not available or offline" despite showing status as ready.

If you uninstall the product, you will not be able to reinstall without contacting Trend support.

Hey All,

I have been applying the following procedure to my networks with some success. I specifically asked Trend to send me the steps in the correct order. I know call this the "TM 3 Step Update"

Trend Micro 3 Step Patch for 3.6
update your security server in this order,

security patch
http://www.trendmicro.com/ftp/products/patches/csm_36_osce_76_win_en_securitypatch_b1149.exe
http://www.trendmicro.com/ftp/documentation/readme/csm_36_win_en_securitypatch_1149_readme.txt

patch 1
http://www.trendmicro.com/ftp/products/patches/CSM_36_WIN_EN_PATCH1.exe
http://www.trendmicro.com/ftp/documentation/readme/CSM_36_WIN_EN_PATCH1_Readme.txt

critical patch
http://www.trendmicro.com/ftp/products/patches/CSM_3.6_OSCE_7.6_Win_EN_CriticalPatch_B1175.exe
http://www.trendmicro.com/ftp/documentation/readme/CSM_3.6_OSCE_7.6_Win_EN_CriticalPatch_B1175_Readme.txt

IMPORTANT!!! When you get to Patch 1 the Information Store will be shut stopped and you must do at least these to modifications to the server. At minimum do the following post Patch 1. I have been doing it before Step 3. Not sure if it makes any difference.

Client Server Security Server
   -----------------------------
    1. For hot fix 1154 to add an option in the ofcscan.ini on the
       server side

      a. Administrators can disable/enable the TSC scan during the
         NTRTSCAN in the ofcscan.ini on the server side:

         [Global Setting]
         DisableTSCAtStart=1
     
         After the configuration is done, administrators need to go
         to the Security Dashboard -> Security Setting -> Domain
         Configure -> Client Privileges page and click save to deploy
         the new configuration too all clients.

         There is no individual configuration for each client, only
         global configuration.

      b. After the setting is deployed to clients, the next time the
         NTRTSCAN starts, it will not call TSC.exe to do a scan.
     
    2. For hot fix 1158, add a registry value to delay RealTime Scan
       service from starting at start up.    

       HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\
       Real Time Scan Configuration\NTRtScanInitSleep = 360000

       Note: The unit is milliseconds.

I'm not sure if the above information applies to the original problem in this Thread. It was communicated to me by Trend engineers that it was an issue with the Trend 8.55-1001 scan engine.


The scan engine version is now at 8.700-1001 and should resolve this issue.

8.600-1001 was provided to me as a fix.

Hmmm, Just checked a few of my networks and the engine is now at 8.700.1004. Maybe this is one of those problems that goes away over time. Corrected via automatic updates. I do have a client with similar symptoms using version 3.6.1095 with Engine 8.700.1004. So far my other clients have stopped having issues at version 3.6.1161 with engine 8.5500.1001 and up. Maybe the user just gave up, reboot when the issue occurs and don't mention it anymore.

Anyway I will run the 3 step and report back if the problem goes away.

I guess I'll just keep pounding away at the problem till the complaints stop. Sorry to say I've been fighting iterations of this problem over many months on over 50 networks. At this point I don't care what fixes it. I'm just tired. LOL

SMB 3.6 1171 w/ pattern file 5.291 and Eng 8.700 is running 300% slower for me.  With Trend 2 installed on a wokstation, my canon 2580C scanner does 10 pages at 400 pixels in 1:11 black and white.  With the 3.6 1171 load, 3:36!

Trend doesn't seem to helpful.  Maybe time to switch to NOD32.

-gsgi

I began running AVG network edition.

Yup looks like that is the solution.  

3.0 still works, right?  How about 3.5?

-gsgi

Gsgl,

I feel your pain. I had a medical office where I installed the 30 day trial and right away the scanning statiions started screaming. No matter how I configured Trend the only thing I could do is unload it. Finally went to Symantec Endpoint Security for that client as they had an older version prior to my Trend Disaster. FYI, I tried NOD32 and AVG for the fun of it and they both had adverse results on scanning the Medical Chart Manager they were running.

Wish I had an answer for ya. Endpoint Anyone? I hate to say but I was kinda impressed with the features of Endpoint and it worked well for that client. With all the hassle with Trend lately I might go back to the dark side on my new installs.

Thanks for bringing up the bad memory. I just started to have flashbacks LOL

H  aaa  viinggg to insssstaaaalllll  ssyyymmannnnttteeccc(NO NO NO) is goingggg to beeee very haaaaaaaard for me to do!   I'm not a big fan of theirs...

:-) :-)

I've seen Coporate Edition bring networks to a CRAWL!  Granted this was a couple or more years back.

-gsgi

If the product was a 30 day trial it was obviously not Client Server Messaging / Officescan 8.0.


Trend Internet Security and other retail level products run on different engines and are not a factor in these client/server model products.


As far as printer issues related to scan engines, it may be a factor but IS NOT related to this issue. The Trend issue described here has to do with paged and kernel commit memory issues. Server/PC platforms would become resource exhausted and display a message related to a lack of resources.

Eg: Browsing UNC paths (\\) would produce an error that 'Not enough memory is available to complete the operations.


If you installed a Trend retail product on a machine and experienced performance loss that's a different issue. What were the specs on it?

Let me clarify. This was just before this original post. They originally had Symantec Client Security version 9.1 which was outdated. There were specific files and folders that needed to be excluded such as .tif and Chart Manager workstation and server program folders. In my case it was the full TM 3.6 Clent Server Messaging. I applied the post install Patches at the time. There was no problem scanning at the time.

We had several scanning stations using the compact Fujitsu and Canon High Speed Sheet Fed Scanners. Before Trend I could scan a 50 page stack quick with not issue. Afterward the scanner would pull a page once every 60 seconds which was un-satisfactory. I did my own research and added exclusions tried turning off the firewall etc. with no results.

I did another test. I uninstalled Trend on a machine and tried AVG Free just to see if I had the same issue and yes I had the same issue. I think in the free version you cant do exclusions so I installed the Trial which afforded the exclusions but it made not difference. I will restate my Nod32 issue. I installed the trial and I'm not sure what the problem was but I could not see the menu correctly as it displayed un-readable characters. Yes, I tried it on a different machine with different hardware. At this point I had several many upset uers and temporarily went back to Symantec Client Security and the problem was solved immediately. I new I was going to replace there servers sometime in the future so I opted to make no more changes.

Fast forward to 2 months ago. I got 2 brand new servers. Dell PowerEdge 2900 Servers and a Dell PoweEdge Storage Server. I was at a crossroad. Do I try Trend and Possibly have the same result or go with Endpoint which was recommend by the Patient Chart Manager supplier. I went with Endpoint and did not have one problem. Same scanners etc. We did move up to Gigabit Switches and all adapters.

My other networks seem to be fine after installting the 3 step update as I call it. You can see it in this post. After doing that procedure which was recommended by a Trend Tech I get fewer complaints.

I will still use Trend Client Server and will never use the home product as It was problematic and home users were exeedingly frustrated by it. For home users I use either a combo of AVG and Windows Defender along with Windows Firewall or you might laugh but Windows Live One Care is the easiest thing in the world to explain to a home user. If its not green click on the Tray icon to see what it wants or call me if you can't figure it out. It has a backup program and a 90 day trial.

Sometimes you have to say whats the difference. I just got a call from a client who thought he had an infection on his laptop. As soon as I got on his system a big red Norton Nag box had been asking him to renew since 2006. Yes he was infected and he needed a wipe and re-install. All you can do is put something on it, maike sure it's patched attempt to train them on the do's and don'ts then set em free. Some get it and some don't OH Well.

Do these issues still occur in Trend's newest product WFBS (Worry-Free Business Security)?

If so, do manual fixes, settings, hacks etc still have to be applied?

Darryl

Trend support is still working on speeding my scanning back up from 1 minute for 10 pages at 400dpi ... It is running at 3 - 4 minutes with the new 3.6 1071 build...  I am still using trend 2.0 as a result and I will be testing kesperky this week to replace trend entirely.  it worked for several years (since 2000) but has become bloatware in my opinion