XADM: Information Store Uses 100 Percent of the CPU with Exchange 2000 SP1 and GroupShield 4.5 (304232)

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

After you install McAfee GroupShield Exchange 4.5 and Exchange 2000 Server Service Pack 1 (SP1), the information store process (Store.exe) may use a large percentage of CPU time (up to 100 percent) for an extended period of time. This may cause degraded server performance.

Microsoft and McAfee have identified a problem that may cause high processor use while GroupShield Exchange 4.5 for Exchange 2000 is scanning certain attachments on a server on which Exchange 2000 SP1 is installed. Exchange 2000 SP1 introduces a change in behavior in the virus scanning application programming interface (virus scanning API 2.0).

Because of this change in behavior, GroupShield Exchange 4.5 and the virus scanning API may enter a loop; this causes the information store process to use up to 100 percent of the processor in Task Manager. After this condition occurs, you must restart the Information Store service to return to normal CPU use.

WORKAROUND

To work around this problem and alleviate the symptoms, temporarily disable antivirus scanning. To do so, you need to edit the registry.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To temporarily disable antivirus scanning:

Stop the MSExchangeIS service. Typically, if the information store is using 100 percent of the CPU, you cannot stop the service gracefully and you must use Task Manager to end the process.
Stop all of the GroupShield services.
Start Registry Editor (Regedt32.exe).
Locate the Enabled value under the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan
On the Edit menu, click DWORD, type 0, and then click OK.
Quit Registry Editor.
Start the MSExchangeIS service.
From a command prompt, type tlist -m gsevs.dll.
Make sure that Store.exe is not listed with the GroupShield scanning DLL loaded.

MORE INFORMATION

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.