Problem

On January 14th 2008 Norman released an On-access scanner update that fixes several issues: 

• Support for Windows XP without Filter Manager 
• Reintroduced support for scanning of network drives 
• SpySweeper compatibility issue 
• System Hidden attribute support for scanning on read 
• Dynamic disk support 
• File operations in service context were wrongfully interpreted like local user I/O

Norman has received reports about backup problems and freezing servers after this update. Some of these problems may be a result of scanning files on network drives in environment where this is not recommended. Please refer to this article for details.

The issue

This release of the On-Access scanner ran into a Microsoft bug regarding mount manager. Our product (as well as other I/O intensive systems) experiences this bug when accessing mount manager to query mount points. When backup systems temporarily create a device for backup purposes it is not necessarily associated with a drive letter. The On-Access scanner then did a query repeatedly on the actual device and this bug in Microsoft mount manager occured. When queried repeatedly mount manger leaks some paged pool memory and might crash and make the whole server with a freeze/hang situation. Although Microsoft has published a fix Microsoft does not recommend to install this fix in general but rather to wait for the next service pack from Microsoft. The bug reference with microsoft is Event ID 2020 333. More information from Microsoft's Help and support pages (the link opens separate browser window). 

Solution

A new version of the On-Access scanner was published as a Norman Internet Update 27 February 2008. This is the same version that was available as a patch installer downloadable from this web page, and which fixed the problems according to several customer reports. This On-Access scanner solves the following issues:

• it includes a workaround for the Microsoft mount manager bug to avoid the memory leak and thus the crash-issues
• It solves a performance issue with the Volume Shadow Copy service used by backup applications

Norman recommends that you run Norman Internet Update to get the latest version of all program modules.