[dba-Tech] Interesting Vipre behavior

John Bartow john at winhaven.net
Tue Mar 10 11:14:38 CDT 2009


Hi Steve,
Sorry to see you had problems. Did you try to contact Sunbelt technical
support? They have a technical support phone numbers (yes, you can actually
talk to them) and a chat directly on their web page. Used to irritate me
because it floated around. (I haven't noticed if they parked the thing or
not but I complained loudly about the floating bit.)

Valid beef - I think this may be what happened to Tina also, who I tried (in
vain) to help through this issue. I thought it was related to the 5019 issue
(see below) but it wasn't. The next day I found out about the Thunderbird
issue but it was too late to help by then.

This is a known issue that recently came about. Vipre was causing high CPU
usage when using Thunderbird. Sunbelt released a fix about 3 hours after the
issue became known.

Every security product is going to have issues. The main difference for me
(besides being a better product than the others ;o) is that Sunbelt support
actually will let you call them and for their enterprise products they have
forums where you can participate and get real answers. They do have consumer
forums but they were based on a third party forum site and they are
revamping their support site so that everything is all in one place.

Just to let you know a bit about what's going on in the Vipre world -
Sunbelt released a couple of new technologies to combat the constantly
evolving malware threats (like AntiVirusXP2009). 
This interview is a pretty good read (although it seems to be a bit too
verbatim at times). (Drew and some of you that are interested in
virtualization would probably like to read this.)
http://www.h-online.com/security/New-VIPRE-fangs-An-interview-with-Sunbelt-C
EO-Alex-Eckelberry--/features/112535/0

5019 Issue:
When Sunbelt released the MX-V technology last month (via update 5019) it
created havoc in a couple of enterprise situations. They had actually sent
out a notice to all enterprise customers and resellers that they were going
to do this and that everyone should be aware that the update for this would
be larger than normal and hence take more bandwidth than normal. Normally,
Vipre updates are purposely kept to a small size, one thing we like in an
enterprise environment (versus the McAfee Super-dats at over 100MB a crack).
Things went fairly bad on a couple of sites (6000 plus clients on a network
can use up some bandwidth). I was reading the Vipre list pretty thoroughly
as I didn't want any of clients to suffer network stoppages because of this
and I was fairly surprised at the eventual outcome of these tense
situations. (One of my clients suffered one issue, fairly minor, Oracle.exe
was prevented from starting on reboot. I didn't even know they had Oracle -
it's a background process for another product that I didn't install. Added
it to the admin known good apps and all is well.) After all was said and
done, the network/security admins all praised Sunbelt for their constant
communication and support throughout the problem. Even though this had
basically interrupted their business, these people PRAISED Sunbelt for how
they handled it because of their past horrific experiences with other
enterprise security vendors such as Symantec, McAfee, Trend, etc. I was a
bit shocked. These were the same people who a day or two earlier were ready
to hang Sunbelt staff for their sins. I guess the reality is that this is a
field wrought with problems and live support is the key to success.

After everything was back to normal the CEO of Sunbelt actually emailed a
letter of apology for the problems and listing a series of items they were
going to implement internally so that it would never happen again. In other
words they actually listen to their customer base. I wish I could find the
letter. I would forward it. Unfortunately I delete Vipre Enterprise list
emails as there is an online archive of it and I have yet to find the letter
in the archives.

I rarely think about CEO's of large companies but I think if I were to be
one, this is how I would do it. If you read the interview above - he evens
talks like me ;o)


-----Original Message-----
From: dba-tech-bounces at databaseadvisors.com
[mailto:dba-tech-bounces at databaseadvisors.com] On Behalf Of Steve Erbach
Sent: Tuesday, March 10, 2009 8:29 AM
To: Discussion of Hardware and Software issues
Subject: [dba-Tech] Interesting Vipre behavior

Dear Group,

I've used Vipre for a few months on my system (Windows XP x64) and on
my wife's XP system.  Didn't have any problems ... until a couple of
days at the end of last week.

After what I'm about to describe happened a couple of times, I started
out after a fresh reboot by running SysInternals' Process Explorer
showing the Performance Graph for the SBAMSvc.exe service.

Then I'd start Thunderbird.  The performance graph for the Vipre
service would jump up to 50% CPU utilization (most of that was core
CPU).  Then, after email was downloaded, I'd click on any message to
read it and the CPU utilization would jump to 100%.  Most of that CPU
utilization (about 70%) was core CPU.

The CPU utilization stayed at 100% so I thought I'd shut down the
service using Process Explorer.  After having accomplished that and
seeing the CPU utilization plunge back to 0, I tried re-starting
Vipre; that is, I ran it from the Start menu instead of going into
Services and re-starting it from there.  Three times this happened:
complete system freeze.  No mouse, no keyboard, no disk activity...so
I hit the power switch.

After a couple days of this, I started my system back up and ran
Process Explorer and whatever else I run normally...and everything's
fine!  I didn't un-install anything; I didn't change anything in the
startup programs...Vipre just started working as it's supposed to.

I have an Intel Core 2 Duo E6850 3.0 MHz system w/8 GB of RAM.

My wife's system (Intel Core 2 Quad Q6600 w/2 GB of RAM) has a
different problem.  She's got more disk space than I do...about 1300
GB, so a Vipre scan takes longer.  But on Feb.26 her Deep scan ran for
291 minutes.  That jumped to 459, 463, 470, and 463 minutes on March
2nd, 3rd, 4th, and 5th.  Then on March 6th it jumped to 1092 minutes!
(For what it's worth, my 244 minute scan on March 5th jumped to 488
minutes on March 6th for 500 MB of storage space).

Yesterday morning I woke up real early and saw that her Deep scan was
projected to take about 1100 minutes so I cancelled it.  I then set
the nightly scan to be a Quick scan, which took about 2-3 minutes.

I'm mainly venting and I'm happy that my system has settled down...but
I'd like my wife's system to run Deep scans at night that don't last
for 18 hours...and I don't know what to do about it.

Regards,

Steve Erbach
Neenah, WI
http://www.NeenahPolitics.com
http://www.TheTownCrank.com
_______________________________________________
dba-Tech mailing list
dba-Tech at databaseadvisors.com
http://databaseadvisors.com/mailman/listinfo/dba-tech
Website: http://www.databaseadvisors.com




More information about the dba-Tech mailing list