Windows sysinternals

Chapter 17 Hangs and Sluggish Performance 419
FIGURE 17-26 File open indicated by CreateFileW in frame 50 results in file reads from SRTSP64.SYS.
Sure enough, double-clicking on one of the SRTSP64.SYS lines in the stack displayed the
module’s properties. The dialog box shown in Figure 17-27 confirmed that it was Symantec
AutoProtect that was repeatedly performing on-access virus detection each time Project
opened the file with certain parameters.
FIGURE 17-27 Module Properties dialog box for SRTSP64.SYS.
Typically, administrators configure antivirus on file servers, so there’s no need for clients to
scan files they reference on servers because client-side scanning simply results in duplicative
scans. This led to the support engineer’s second recommendation, which was for the administrator
to set an exclusion filter on their client antivirus deployment for the file share hosting
user profiles.
In less than 15 minutes, the engineer had written up his analysis and recommendations and
sent them back to the customer. The network monitor trace merely served as confirmation of
what he observed in the Procmon trace. The administrator proceeded to implement the suggestions
and, a few days later, confirmed that the user was no longer experiencing long file
loads nor the errors he had reported. Another case closed with Procmon and thread stacks.
www.it-ebooks.info