gcasDTServ.exe at 100% CPU time

[mcltech]

Came home after 2 days away, 2k Pro SP6 system on and
logged in all this time. Had 2 daily scan reports on
screen (one for each day away). System SLOW;
gcasDTServ.exe process taking upwards of 100% CPU, even
after closing the Scan notice windows.

Ended the gcasDTServ.exe process, and a second one showed
up taking high CPU (no idea whether 2 existed in the first
place); ended the second process and system now appears
normal.


Microsoft AntiSpyware version 1.0.501
Windows OS: 2000
Windows OS Version Info: 148
Windows OS Major Version: 5
Windows OS Minor Version: 0
Windows OS Build: 2195
Current Path: D:\Program Files\Microsoft AntiSpyware
Install Path: D:\Program Files\Microsoft AntiSpyware\
Session.RunMode: 5
Session.TimeBombDaysRemaining: 161
Session.TimeBombExpirationDate: 7/31/05
Real-time protection running: True
Real-time protection enabled: True
Security Agents Application Enabled: True
Security Agents Internet Enabled: True
Security Agents System Enabled: True
Security Agents Checkpoints: 58
Definitions Update Date: 2/18/05 3:58:03 PM
AutoUpdater Enabled: 1
AutoUpdater AutoApply Enabled:
Definitions Increment Version: 33/33
Definitions ThreatAuditThreatData: 1179425
Definitions ThreatAuditScanData: 2151476
Definitions DeterminationData: 98567
Software Update Check Date: 2/16/05 3:57:35 PM
AutoUpdater Software Enabled:
TotalThreatsDetected: 0
TotalScansRun: 44
LastScanDate: 2/20/05 2:00:12 AM
Is US Locale: True
Locale Language: English (United States):English (0409)
Locale Country: United States:United States (1)
Processor Identifier: x86 Family 6 Model 7 Stepping 3
Processor Name:
IE Version: 6.0.2800.1106
msvbvm60.dll: 6.0.96.90
vbscript.dll: 5.6.0.7426
gcUnCompress.dll: 1.1.0.0
gcmd5query.dll: 1.0.0.1
openports.dll:
SDelete.dll:
gcASSoapLib.dll: 1.0.0.501
gcPorttoProcess.dll:
gcTCPObjLib.dll: 1.0.0.501
gcasDtServ.exe: 1.0.0.501
gcAntiSpywareLibrary.dll: 1.0.0.501
gcIPtoHostQueue.exe: 1.0.0.501
gcasServ.exe: 1.0.0.501
gcasServAlert.exe: 1.0.0.501
gcasServHook.dll:
gcASHashLibrary.dll:
gcASThreatAudit.dll: 1.0.0.501
gcASCleaner.exe: 1.0.0.501
GIANTAntiSpywareUpdater.exe: 1.0.0.501
gcASPrivacyLib.dll: 1.0.0.501
gcASShredCtxShell.dll:
gcasSWUpdater.exe: 1.0.0.501
gcSoftwareUpdateLib.dll: 1.0.0.501
GIANTSpywareScan.exe:
gcasDtServ Status: Loaded
gcasDtServ IsAuthorized: True
gcAntiSpywareLibrary Status: Loaded
gcAntiSpywareLibrary IsAuthorized: True
gcASThreatAudit Status: Loaded
gcASThreatAudit IsAuthorized: True
Now: 2/20/05 4:28:10 PM

Cal

 

[Guest]

Having very similar problem. Soon after I log in the
gcasDTServ.exe process jumps to 100% and stays there until
I kill it.

WinXP SP2
McAfee VirusScan Enterprise v7
in Win2k domain
Athlon 2000+
512mb RAM

Thanks for any suggestions.

 

[Bill Sanderson]

If you don't mind snake oil, my observation when I've seen this is that as I
recall, the UI mentioned something about loading definitions. You might
consider deleting the definition files, as defined here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;892519

This should be harmless--and the definitions should be regenerated--in fact,
it can be interesting to see what level definitions are regenerated.

Aside from that, Microsoft has said they are interested in getting a memory
dump from systems evidencing this issue. There is a KB article giving a
registry change which can enable you to intentionally halt your system via
keystrokes from a ps/2 style keyboard (USB won't work)

A memory dump can be quite large, and you also need to change settings in
properties of My Computer to determine the kind of dump that is done--so
there's a lot involved here, but if you happened to be game to do this it
might be useful to them.