08-14-2008 12:07 PM
I'm posting this issue to a Lenovo Forum, even though it refers to Symantec Anti-Virus, because I believe there is a TVT process that could be causing issue as well (Maintenance Manager?). Also, I'm finding the response quality really great on this forum...
Symantec Anti-Virus and Symantec Client Security Firewall
Symptom is that user states machine is running slow and I check Event Viewer logs
What I see are tons of the following messages (multiple within 1 second), going for a long time
Symantec Tamper Protection Alert
Target: c:\program files\symantec client security\symantec antivirus\rtvscan.exe
Event Info: Suspend Thread
Action Taken: Blocked
Actor Process c:\windows\system32\ipssvc.exe
Typically, I've run SAV updates and checked quarantine which appeared to resolve, but I'd like a better understanding of what's going on so I can more completely troubleshoot and address the problem. The same symptom started happening again on same machine (Lenovo T60p) and I didn't see anything in quarantine.
08-22-2008 05:35 AM
08-22-2008 07:46 AM
I've fixed my problem and hope this helps you....
Target is the process that is being attacked. (In this case Rtvscan.exe)
Actor Process is the process that is attacking the Symantec application. (In this case ipssvc.exe)
My T60 was running slow because Symantec Tamper Protection was constantly writing event logs, I could see this because I had the 'Display a notification message when tampering is detected:' box checked within SEP11's Client Management Settings.
While logged in as administartor, I ended the process - ipssvc.exe in Task Manager and then ended Rtvscan.exe (which should start up again automatically). Symantec Tamper Protection stops logging events and the machine returns to normal speed. However when you reboot the machine the problem starts again.
I found that ipssvc.exe is part of the IPS Core Service which is a VPN Client Service made by LanCom and wondered how the hell it was on my new T60 image as I had not installed any applications. I then found that this service was part of ThinkVantage Away Manager, which is installed on the manufacturers image. After uninstalling this, Symantec Tamper Protection stopped logging events and the problem went away.
So in conclusion, uninstall ThinkVantage Away Manager!! (Unless the user needs this....in which case I can't help you there!)
08-22-2008 09:12 AM
I appreciate your digging further in to this. I wanted to clarify my understanding.
The Away Manager, within ThinkVantage menu, is the same as Maintenance Manager.
Within Maintenance Manager there are options to run various applications in whisper mode -- one of them is "Scan for Virus Using Symantec Antivirus" -- which is probably the culprit.
In your case, before you uninstalled Maintenance/Away Manager, did you have this checked?
Question: If this setting is left unchecked, does the problem go away? -- if so, then that would be ideal because I'm sure that when you do another ThinkVantage Update, Maintenance Manager may sneak back in again and you'd have to remember to either not install or uninstall again.
Thanks for your efforts.
08-25-2008 04:34 AM
I would suggest to uninstall Norton and use a smaller program like Antivir oder AVG and you´ll
never had a problem again!
Norton ist known for problems and slow down computer system, this suite makes sense, when you
are in a corporate environment.
Follow @LenovoForums on Twitter! Try the forum search, before first posting: Forum Search Option
Please insert your type, model (not S/N) number and used OS in your posts.
I´m a volunteer here using ThinkPad X1 Carbon 5th Gen. Silver Edition, ThinkPad 13, Yoga 900, ThinkPad T430s, IdeaCentre B540.
TIP: If your computer runs satisfactorily now, it may not be necessary to update the system.
03-07-2009 10:28 AM
10-11-2009 03:20 PM
THANK YOU!! THANK YOU!! Three weeks ago my corporate IT securinazis installed the hated Symantec AV on my X60S laptop which had been running just fine. Ever since then, the performance tanked. I went to the IT director who unctuously told me that was impossible as Symantec AV was on everyone's PC and no complaints. I may be the only one in the company with a Lenovo X60S. I could never get them to take me seriously. Finally, I happened to notice a huge set of files during a defrag - they were logs from Sym AV filled with the same message about IPSSVC.EXE. I Googled the name and landed here. I just turned off Whisper Mode and EUREKA! the performance is back to its old self. So I am eternally grateful to the people who posted here.