Update 5003 - SBAMsvc.exe clocks 100% CPU utilisation

In the new MX-V system, malware is executed in a virtual Windows environment that mimics many of the core Windows functions -- registry, file system, internet connection, mouse clicks, etc. The actions of the malware are then analyzed for behavioral characteristics common to malware, or to look for certain malware signatures. This is not known to conflict with Excel, But another thing that we may try to prevent the slow down is as follows.

1. Within VIPRE, go to View > Manage Malware > Always Allowed.

2. From here you will be in the “Always Allowed” list, which lists everything you have set VIPRE to ignore, whether it be through an Active Protection popup or a scan.

3. To manually add something to the list, select the “Add” button at the bottom.

4. Now you will have to navigate to the folder of the program you want to allow, which is the first option. If its just a single file, select the third option, Allow files by file name only, and navigate to the specific file. If you are unsure what file or folder to add, just email me back with the information VIPRE flagged, and I’ll let you know what to add.

Once you have added the file, you should see it listed in the Allowed List section and VIPRE should not flag this file or program anymore.

If you need any further assistance, just let me know.

I have a similar problem. I've had two Vista (one x32 and one x64) machines running Vipre without problem for months. Not long after booting, SBAMSVC takes over the CPUs. I've just been running without VIPRE at all for the past couple weeks, occasionally loading it up for an overnight scan. On computer A (core 2 duo 8500) the problem seems related to Outlook. On computer B (AMD 64 X2), there's NOT a lot of choices for application conflict since I don't have much installed on it. It's either Nero 9 or Firefox. I'll take your advice and start exempting applications until I find the problem. It took me about a week to figure out Vipre was the system hog. I just never thought to suspect it!

Jacob, thanks for the information. I'm going to experiment with what you suggest, but with the changes I've seen so far, I don't expect to have any more problems.

Many thanks.

Greg, thank you for contacting Sunbelt Software.

There was at one point a conflict with an older version of Nero so that may be something we want to troubleshoot first. I'd suggest you send an email to support@sunbeltsoftware.com so we can open a ticket with you. We'll probably want to get some system information from you to get a better idea of what might be causing the conflict.

Thanks, Nick. I had a chance to check and the problem affects a host of programs that do a lot of file open/close, including Windows Explorer. Turning off open/close scanning feature fixes the lot of them. Previously I had to give up automatic deep scanning using Vypre because the old scan wouldn't finish before the next scan was due the next night. I'd hate to have to give up open/close scanning too, because then what would Vyper actually be doing?

We suggest you send an email to support@sunbeltsoftware.com with a brief discription of the problem. So we can open a ticket with you. We'll want to get some system information from you to get a better idea of what might be causing the conflict.

Jacob,

I set the email earlier this morning.

Hi Greg,
Thank you for letting us know. One of the techs will contact you before the end of the day.

I'm having the same exact issue with Vipre. On system boot the SBAMsvc.exe will lock out the system by using 100% of cpu and will use ~ 200/300 Mb of ram. After some time it releases the iron grip and will occationaly choke the machine upon me initiating any program or exe. I've notice this behaviour since def update 5010. It is impossible to do any work since with Vipre enabled.

Things had gotten so bad (slow) that I had thought that my XP install was in need of a repair until I checked that SBAMSvc.exe with taking 50% of my CPU. As with the other respondents this has happened in last few weeks (not sure when). Doesn't quite equate with the reason why I bought VIPRE in the first place, which was because it was relatively light on resources. Unchecking 'Check files when they are opened or copied' has improved response markedly but turning off Active Protection is the only thing that restores performance to normal. Please get this fixed (and fast).

Thank you both for your posts. To anyone that is having this issue please use the directions below and send an email to support@sunbeltsoftware.com with a brief description of the problem. So we can open a ticket for you. We will need to get some system information from you to get a better idea of what might be causing the conflict.

1. First open VIPRE by double clicking on the Vipre icon in the System tray (Down by the time on your computer)

2. Click on the word “Help” then “About”

3. Then click on the button labeled “Support tools” then “Run Diagnostics”

4. Make sure that all the boxes are checked and click “ok”

5. Once this starts, it will take a couple minutes while the utility gathers information. It will create a file on your desktop called “Sunbelt VIPRE Antivirus + Antispyware Diagnostics.rar”

6. After that file appears, run the following utility: http://www.sunbelt-software.com/suppo...

You will be asked for your support ticket number. You can locate this in the Subject line of this email.

Please attach this file to your reply email.

Had the same problem with Word 07 and Excel 07 running the processor at 99% for about 7 minutes before settling down and running the program.

I opening Vipre 3.2.1866.2, went to the Manage tab, then clicked on "Always Allow", clicked on the "add" button, then selected "allow an entire folder."
I added "Microsoft Office" by browsing to it's locations.

Afterwords, I restarted, and tested excel and word. Vipre blinked up to 20% and then went down.

BTW, I did try allowing just winword.exe and excel.exe. Excel took, but word still ran the processor hard.

Scott, Thank you for posting you question.

We are resolving this 99% cpu problem in a definition update very soon.

Just wondering if anybody has any update on this problem. They were supposed to be sending me a batch file update so I could update my computers manually but still have not got the update. Just wondering if anybody has heard of any eta??

John you can manually download the definitions from this location, http://www.sunbeltsoftware.com/Home-H...
Or you can contact us again at support@sunbeltsoftware.com and we can assist you there.

My machine is stuck also with 100% CPU on the sbamsvc service. Very frustrating and no, I run no other services of the same type.

This just happened last night for me, so something changed at Vipre headquarters. Right now the service is terminated so I can access the Internet and email. The machine doesn't let me get enough cpu to open the vipre console so no help there either. We need help here - I have a service email in to support.

Due to a large change in the definition files posted last night, some customers are experiencing high CPU usage during the application of the definition files.

To correct this issue, please run the following utility to disable the services. You be prompted to reboot the system.

http://www.sunbelt-software.com/suppo...

After rebooting run the following utility to replace the definition files.

http://www.sunbelt-software.com/suppo...

When the second utility is finished running, please run this utility to enable the services. You again will be prompted to reboot the computer.

http://www.sunbelt-software.com/suppo...

When Windows restarts, everything should be back to normal. I apologize for the inconvenience.

So is there anyway to do a massive update of all def. files or is the only option to go to every pc on our network and do this manually ?

Most of the computers I am having the CPU resource issue with are running definition 5017.

In addition to this problem, as of this morning:

* 90% of the agents on the server show up as inactive
* 10% of agents show up as not installed
* 50% of agents show pending updates perpetually

In addition to this, after the big update last week, active protection has been annihilating nvidia graphics drivers (and a few other files) flagging them as trojans.

I have tried 4 times to contact support. The number is always busy (imagine that). I have also submitted an email to support with no support.

More thorough testing of these updates would be appreciated... At least until June when our agreement expires.

Deacon,

I am very sorry for the trouble. We are incredibly busy but we will get to you as soon as we can. If you can post your company name I will make sure a ticket is created for you ASAP and I will have a technician call you back.

Thanks,

Jamie

Gear Products, Inc.

Once again, I already have a ticket. Well, I sent an email at 10:00am CST to support@sunbeltsoftware.com. I never have received any confirmation or any other reply.

I just started a Vipre Enterprise trial last night; this morning a server and workstation were almost hung due to high CPU. Mike Williams' post looks promising but it sounds like it's for the consumer side. Is there a forum or blog similar to this for the Enterprise products? Something with the technical details on what versions are affected and how to solve and roll it out to clients?

Thank you! I did make you a ticket. That ticket number is 001-00-273553 and I am having my assistant manager get a technician on this case. You will be hearing from a technician shortly.

Thank you for your patience.

Jamie

well, it is finally fixed on my machine. the vbscripts didn't work

1. ran Servicedisable, followed prompts, rebooted - sbam restarted - 100% CPU

2. Put the sbam service in Services into Manual mode, restarted, sbam started 100% cpu

3. terminated sbam using Task Mgr, ran VCdefs, rebooted, 100% cpu

4. looked at vbscript, went to Services panel, Disabled Vipre, rebooted - normal cpu. Created new Definitions Folder, Ran VCdefs, rebooted, reset Vipre in Cntl panel, started Vipre - all is well

Far more work than I needed or wanted - this cost me arounf 4 hrs of downtime.

I suggest a far better development, testing and change controll process for future updates.

Barry

I again apologize for the extra work involved because of this problem.

There was a typo in my script, causing it to not disable the service. I have since fixed it and place it back at the same URL.

We tried reverting the definitions as repeatedly mentioned. I worked with a rep with Sunbelt as well. This did not fix the problem. As soon as we re-activated the agents, the problem returned.

The posted fix appears to work on our agent machines, but our enterprise server still has problems. Any suggestions?

Is there a thread where the actual problem has been discussed and the fix will be announced? It looks to me like Vipre itself is going into an endless loop and then erroring on each file. That eats a LOT of cpu. I have a clean install that has never had other malware or virus software installed and not much in the way of applications. I honestly don't think it's a conflict with other monitoring software. Right now, what works for me is to do two things: turn off active protection (or it kills the cpu on any machine) and turn off scheduled scans (which don't complete before the next scan is due). I'm told I still have limited protection in which memory is scanned periodically. When I look at the VIPRE logs, I seeing thousands of program errors. Honestly, I believe all we can do is pretty much turn Vipre off until they get it fixed. In the meantime, however, I'd like to be "tuned into" whatever thread will eventually announce the fix.

I have the same problem, but after the 5019 update. Most clients are fine, but Win2000 server is not: 99-100% CPU use. The fix doesn't fix it.

One way you can stop the service is to disable the service in the registry and reboot. Edit the registry in HKLM\System\CurrentControlSet\Services\SBAMSvc - either change the path to the executable so it can't find it (I add 'disabled' to the front of the filename) and/or change the Start key to value 4 (disabled)

I've read through this and several other posts like this, even from several months ago. I also have the Thunderbird problem. My impression is that Vipre is a good idea, and the company means well, but somewhere bugs are being introduced and testing isn't extensive enough. So like a previous poster, I've lost lots of time and I may be done with vipre. Given past performance, I suspect it will happen again, and I don't want my users to go through that.

All-

If you're having any troubles after running the fix, please contact us via e-mail- support@sunbeltsoftware.com. In your e-mail, please indicate what version of Vipre that you are using, if it's Enterprise or for Home and contact information so that we can work with you to resolve any lingering problems.

Thanks!

-Nick

__________

Nick Shorts
Tier 2 Enterprise Support Technician

Sunbelt Software
Support E-mail: Support@SunbeltSoftware.com
Voice: 877.673.1153 x500
Fax: 727.562.5199
Web: www.Sunbelt-Software.com
33 N Garden Ave - Suite 1200
Clearwater, Fl 33755 - USA

-------------------------------------------------------------------------------
If you do not want further emails from us, please forward
this message to listmanager@sunbeltsoftware.com with
the word 'unsubscribe' in the subject of you email
--------------------------------------------------------------------------------

So if any of my computers do not have the defs. 5019 I dont have to run the fix on those? or are they going to eventually download 5019. I also see there is a couple with 5020 def list, is that one safe to use?

Correct, If you don't have 5019 on the computer you should not run into the issue, we have already released 5020, which incorporates the parts of 5019 that didn't cause the issue.

Awesome thanks for the quick reply!

I have a very similar problem. SBAMSvc.exe is constantly "pulsing" every few seconds chewing up most/all of my memory. I am running Avanquest Sys Suite 9 (fully updated) protection (that incorporates the Sunbelt Vipre) and Windows XP (fully updated) on an old Celeron 1300MHZ with 256 RAM. Will the above fixes work on my machine or will I run afoul with Avanquest interfaces? I have run with the Avanquest protection for several years with no problem until now. Thanks for your time.... Ed

Hi Ed,

Thanks for posting your question. Either reinstalling or simply updating to the latest definitions should work, but you may want double check with Avanquest, they may have come up with their own solution.

We just switched to vipre ent this weekend. We have both xp and w2k clients that are hanging up. We are more concerned with the XP case since the 2k machines will be upgraded at some point.

We must disable active protection to allow users to have a functioning client where the SBAMSvc.exe isn't using up the resources.

We did reinstall the agent - and no change occurred.
Also, when we had active protection running we did TURN OFF the option to scan all files on open/close.

If there are other suggestions for either xp or w2k we'd appreciate the advice!

Hi Jen,

Thank you for your post. Please verify that your agents are running v3.1.2744. In addition, please set your agent logging level to "Error" if it not already on this setting. You can find this setting in each policy under the "Agent Settings" tab and locating the "Logging Level" field.

Please let us know if this helps to correct the situation.

Best regards,
Jason C.
Tier III Enterprise Support Technician
Sunbelt Software

Yes - our agents are on v 3.1.2744. Logging level is "ERROR"

Are there other policy specifications you have found help this issue?

It is specific to some clients. We don't want Active Protection to be disabled but the machines are too slow when it is enabled.

jen

Thank you for the update, Jen. I'd like to have one of our support technicians work with you directly to determine what's causing this situation. Please contact us at +1.877.673.1153 or via email at support@sunbeltsoftware.com to have a support ticket created. If contacting us via email, please be sure to include your name, company you represent, and telephone number.

We look forward to hearing from you soon.

Best regards,
Jason

I am having the problem with IE only. All works great until I open IE then SBAM goes to 100%. I am running 3.1.2744 and def version 5142. Tried uninstalling and reinstalling Vipre with no luck. Upgraded to Ie 8.0 with no luck. Kill SBAM in task manager and all works great but no protection. Need help.

Craig,

Do you have any other security software installed on the system?

What Add-ons do you have running with IE? If you disable all unnecessary add-ons do you still see this issue?

No other security software and no addons to IE. It is a laptop and very little is installed on it.

Craig,

It would be best if you contact us directly by emailing support@sunbeltsoftware.com so we can gather a VIPRE diagnostics from you. This isn't a common issue so there must be something specific to your software environment causing the high CPU usage when using IE.

Ok, it was working great until about 2 or 3 weeks ago and then this started. I have had Vipre installed for about 6 months.

!00% CPU utilization is cauing my VIPRE clients and I headaches galore. Is there a solution that works without compromising systems?

They had me change my logging level to error only and a couple of other things and it now seems to be working great again.

Hello,

This forum is no longer being monitored by our support staff.

Please post your question on http://supportforums.sunbeltsoftware.... for further support.

Thanks,
Peter