XADM: Information Store Uses 100 Percent of the CPU with Exchange 2000 SP1 and GroupShield 4.5

After you install McAfee GroupShield Exchange 4.5 and Exchange 2000 Server Service Pack 1 (SP1), the information store process (Store.exe) may use a large percentage of CPU time (up to 100 percent) for an extended period of time. This may cause degraded server performance.

Microsoft and McAfee have identified a problem that may cause high processor use while GroupShield Exchange 4.5 for Exchange 2000 is scanning certain attachments on a server on which Exchange 2000 SP1 is installed. Exchange 2000 SP1 introduces a change in behavior in the virus scanning application programming interface (virus scanning API 2.0).

Because of this change in behavior, GroupShield Exchange 4.5 and the virus scanning API may enter a loop; this causes the information store process to use up to 100 percent of the processor in Task Manager. After this condition occurs, you must restart the Information Store service to return to normal CPU use.

A fix (Gs452kh1.zip) is available from McAfee to resolve this problem. To resolve this problem, either contact your McAfee technical support representative to obtain this fix, or upgrade to GroupShield Exchange version 5.0.

To work around this problem and alleviate the symptoms, temporarily disable antivirus scanning. To do so, you need to edit the registry.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To temporarily disable antivirus scanning:

1. Stop the MSExchangeIS service. Typically, if the information store is using 100 percent of the CPU, you cannot stop the service gracefully and you must use Task Manager to end the process.
2. Stop all of the GroupShield services.
3. Start Registry Editor (Regedt32.exe).
4. Locate the Enabled value under the following key in the registry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan
5. On the Edit menu, click DWORD, type 0, and then click OK.
6. Quit Registry Editor.
7. Start the MSExchangeIS service.
8. From a command prompt, type tlist -m gsevs.dll.
9. Make sure that Store.exe is not listed with the GroupShield scanning DLL loaded.

Microsoft has confirmed that this is a problem in Microsoft Exchange 2000 Server.

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.