Microsoft Knowledge Base Article
This article contents is Microsoft Copyrighted material.
©2005-©2007 Microsoft Corporation. All rights reserved.
Terms
of Use |
Trademarks
Article ID: 891605 - Last Review: January 17, 2007 - Revision: 2.1
Event 21426 is logged on an agent computer, and you receive an error message in the Microsoft Operations Manager (MOM) 2005 Operator Console
Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect the computer.
When McAfee VirusScan Enterprise 8.0i is installed on an agent computer, you experience the following symptoms:
- Event 21426 is logged in the Application event log of the agent computer.
- You receive the following error message in the Microsoft Operations Manager (MOM) 2005 Operator Console:
Name:
The MOM Host process was consuming too much memory and will be terminated
Description:
The host process for the script responses (
nnnn) will be restarted because it is using
nnnnnn more bytes than its limit of 104857600. To adjust this limit, edit the
Software\Mission Critical Software\OnePoint\MaxScriptHostPrivateBytes
registry key.
Management Group:
group name
This problem occurs because McAfee VirusScan replaces the Windows Script Host component with the ScriptScan proxy component (ScriptProxy.dll). The ScriptScan proxy component scans JavaScript scripts and Visual Basic Scripting Edition (VBScript) scripts. When a script runs and passes through the scan as clean, the script is passed to the appropriate Windows Script Host. The ScriptScan proxy component parses scripts before they are run by the associated Windows Script Host.
When the ScriptScan feature is turned on, the MOMHost.exe component slowly leaks memory. However, turning off the ScriptScan feature in the McAfee VirusScan properties does not correct the problem.
Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
To work around this problem, you must unregister the ScriptScan proxy component. To do this, follow these steps.
Important When you unregister the ScriptScan proxy component, McAfee VirusScan does not check scripts for viruses.
- Log on to the agent computer by using an account that has domain administrator permissions.
-
Click
Start
, click
Run
, type
cmd, and then click
OK.
- At the command prompt, locate the %ProgramFiles%\Network Associates\VirusScan folder.
-
At the command prompt, type the following:
regsvr32 /u scriptproxy.dll
-
You must restart the MOM service to apply the changes. To do this, follow these steps:
-
Click
Start, point to
Administrative Tools, and then click
Services.
-
In the Services snap-in, right-click
MOM, and then click
Restart.
- Exit the Services snap-in.
For information about your hardware manufacturer, visit the following Web site:
For more information about this problem, visit the McAfee support Web site:
Note On the McAfee support Web site, search for the following Solution ID references: kb40067, kb47302, kb40049, and kb46223. The symptoms discussed in this Microsoft Knowledge Base article directly relates to the McAfee Solution ID kb40067. Although McAfee VirusScan Enterprise 8.0i does not fix the memory leak, a hotfix is available from McAfee to unregister the ScriptProxy.dll. Contact McAfee support to obtain this hotfix.
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
APPLIES TO
- Microsoft Operations Manager (MOM) 2005
| kbopmanperfmon kbopmaninterop kbopmanalerts kbtshoot kberrmsg kbperformance kbinterop KB891605 |
Community Feedback System
Very often, it takes hours to solve a problem. Very often, you've looked high
and low, and have tried a lot of solutions. When you finally found it, chances
are, it was because someone else helped you. Here's your chance to give back.
Use our community feedback tool to let others know what worked for you and what
didn't.
Please also understand that the community feedback system is not warranted to be
correct, it's simply a system that we've built to let people try and help each
other. If something in a feedback response doesn't make sense to you, or you're
not comfortable making changes that the feedback talks about (like registry
edits), please consult a professional.
Thank you for using kbAlertz.com Feedback System.
-- Scott Cate