Symantec Tamper Protection Alert messages causing laptop to slow down

[pgarth]

I'm posting this issue to a Lenovo Forum, even though it refers to Symantec Anti-Virus,  because I believe there is a TVT process that could be causing issue as well (Maintenance Manager?).  Also, I'm finding the response quality really great on this forum...

Windows XP

Symantec Anti-Virus and Symantec Client Security Firewall

Symptom is that user states machine is running slow and I check Event Viewer logs

What I see are tons of the following messages (multiple within 1 second), going for a long time

Symantec Tamper Protection Alert

Target: c:\program files\symantec client security\symantec antivirus\rtvscan.exe

Event Info: Suspend Thread

Action Taken: Blocked

Actor Process c:\windows\system32\ipssvc.exe

Typically, I've run SAV updates and checked quarantine which appeared to resolve, but I'd like a better understanding of what's going on so I can more completely troubleshoot and address the problem.  The same symptom started happening again on same machine (Lenovo T60p) and I didn't see anything in quarantine.

Thanks.

Paul

[philevans02]

Hi, I'm having the same problem... I have a T60. From the factory OS installation I've un-installed SAV 9 or 10?, then installed SEP11. Now I keep getting SYMANTEC TAMPER PROTECTION ALERTs constantly. If I find anything I'll let you know, other than that I'm close to just 'blue buttoning' and trying maybe installing SEP11 over the top.

[philevans02]

pgarth,

I've fixed my problem and hope this helps you....

Target is the process that is being attacked. (In this case Rtvscan.exe)

Actor Process is the process that is attacking the Symantec application. (In this case ipssvc.exe)

My T60 was running slow because Symantec Tamper Protection was constantly writing event logs, I could see this because I had the 'Display a notification message when tampering is detected:' box checked within SEP11's Client Management Settings.

While logged in as administartor, I ended the process - ipssvc.exe in Task Manager and then ended Rtvscan.exe (which should start up again automatically). Symantec Tamper Protection stops logging events and the machine returns to normal speed. However when you reboot the machine the problem starts again.

I found that ipssvc.exe is part of the IPS Core Service which is a VPN Client Service made by LanCom and wondered how the hell it was on my new T60 image as I had not installed any applications. I then found that this service was part of ThinkVantage Away Manager, which is installed on the manufacturers image. After uninstalling this, Symantec Tamper Protection stopped logging events and the problem went away.

So in conclusion, uninstall ThinkVantage Away Manager!! (Unless the user needs this....in which case I can't help you there!)

[philevans02]

supporting info.... 

http://www.file.net/process/ipssvc.exe.html

[pgarth]

Philevans02:

I appreciate your digging further in to this.  I wanted to clarify my understanding. 

The Away Manager, within ThinkVantage menu, is the same as Maintenance Manager. 

Within Maintenance Manager there are options to run various applications in whisper mode -- one of them is "Scan for Virus Using Symantec Antivirus" -- which is probably the culprit. 

In your case, before you uninstalled Maintenance/Away Manager, did you have this checked?

Question:  If this setting is left unchecked, does the problem go away? -- if so, then that would be ideal because I'm sure that when you do another ThinkVantage Update, Maintenance Manager may sneak back in again and you'd have to remember to either not install or uninstall again. 

Thanks for your efforts. 

Paul 

[Agotthelf Community Moderator]

I would suggest to uninstall Norton and use a smaller program like Antivir oder AVG and you´ll

never had a problem again!

Norton ist known for problems and slow down computer system, this suite makes sense, when you

are in a corporate environment.

[Fezman2k4]

just came across this problem on my T60. Stopped immediatly when I disable whisper mode in the productivity center config. Hope you all have it fixed by now but this should help those following!

[kaltmann]

THANK YOU!! THANK YOU!!  Three weeks ago my corporate IT securinazis installed the hated Symantec AV on my X60S laptop which had been running just fine.  Ever since then, the performance tanked.  I went to the IT director who unctuously told me that was impossible as Symantec AV was on everyone's PC and no complaints.  I may be the only one in the company with a Lenovo X60S.  I could never get them to take me seriously.  Finally, I happened to notice a huge set of files during a defrag - they were logs from Sym AV filled with the same message  about IPSSVC.EXE.  I Googled the name and landed here.  I just turned off Whisper Mode and EUREKA!  the performance is back to its old self.  So I am eternally grateful to the people who posted here.

Thanks

Kerbey

[dparker54291]

How do you shut off the quite mode?  Is there a path that can be provided??

Thank you,

David