Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 2791 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos pounds the heck out of aspnet_wp.exe

Crankypapa

I have a problem with Sophos constantly attacking the ASP.NET process aspnet_wp.exe.  This process is the process started by IIS when a ASP.NET website is accessed on the localhost.  It is part of the ASP.NET framework.  I use localhost to debug certain websites before deploying them.  When I try acccessing the web pages Sophos ties everything up for 5 - 10 minutes.  It has become quite the burdon and I need some help here.

I have added the aspnet_wp.exe in the list of files to ignore.  I have added the full hard drive path to this file as well.  I have added the path of the local website files to the exception list.

When I uninstall Sophos, it takes less then 2 seconds to display the pages on localhost.  When I install Sophos it takes 5 - 10 minutes. I have found that the user aspnet_wp.exe runs under is "ASPNET".  I don't know if that makes any difference or not.

When watching the task manager, I have found that aspnet_wp.exe gets 1/10 the CPU time SavServ.exe gets when trying to access the website. 

I am at a complete loss here and need some suggestions to get Sophos to stop picking on my local install of IIS and ASP.NET framework.

Thanks in advance.

:16975


This thread was automatically locked due to age.
Parents
  • 0

    I encounter this exact issue with MSSQL Reporting Services on a SQL 2008 R2 instance, where the first load of the day will result in a 5-10 minute delay.

    Reading up online, it looks like there could be some relevance to a particular behaviour of antivirus applications, otherwise it could be related to memory contention or missing exclusions:

    http://support.microsoft.com/?kbid=821438

    I have found numerous references to McAfee antivirus script scanning also attempting to scan URLs as they are accessed by ASP.net; which could be related. The best method to diagnose if this is actually the issue would be looking into the CPU activity of the savservice.exe process, which will see a spike in CPU load when you try to access a web page.

    In my case, I have identified that Sophos is indeed the cause of the issue - as disabling Sophos results in zero delay and near-instant response of the SQL Reporting services pages (versus many seconds/minutes); despite having all the relevant file and folder exclusions in place.

    Hopefully this helps!

    :38141
Reply
  • 0

    I encounter this exact issue with MSSQL Reporting Services on a SQL 2008 R2 instance, where the first load of the day will result in a 5-10 minute delay.

    Reading up online, it looks like there could be some relevance to a particular behaviour of antivirus applications, otherwise it could be related to memory contention or missing exclusions:

    http://support.microsoft.com/?kbid=821438

    I have found numerous references to McAfee antivirus script scanning also attempting to scan URLs as they are accessed by ASP.net; which could be related. The best method to diagnose if this is actually the issue would be looking into the CPU activity of the savservice.exe process, which will see a spike in CPU load when you try to access a web page.

    In my case, I have identified that Sophos is indeed the cause of the issue - as disabling Sophos results in zero delay and near-instant response of the SQL Reporting services pages (versus many seconds/minutes); despite having all the relevant file and folder exclusions in place.

    Hopefully this helps!

    :38141
Children
No Data