Links to patches/solutions

General description of the problem:

INOTASK.EXE will consume 100% CPU when adjusting to/from daylight savings time. Scheduled tasks, such as signature download and scheduled scan jobs, no longer execute. This problem may occur when the system time is changed manually or automatically by the operating system.

Restarting the INOTASK.EXE process or rebooting the machine does not correct the problem.

The problem stems from a bug in the C runtime library function mktime() on Microsoft Windows (http://support.microsoft.com/default.aspx?scid=kb;en-us;214661), Linux, and Solaris operating systems. This function fails to calculate the correct time when adjusting to/from daylight savings time. The scheduling code checks the value returned from mktime() to make sure it is greater (in the future) than the previously scheduled time. Since the value returned from mktime() does not correctly account for the time change, the newly calculated time will be less than that of the previous one (in the past). This incorrect time of the next scheduled job causes the scheduler to go into an infinite loop. The problem affects any current job for which the next scheduled job will run between 2:00 am - 3:00 am. We will refer to this hour of time as the "dead zone".

For example: Jobs that are scheduled to run once a week or once a day will not cause the problem to occur unless the execution time for the job falls into the dead zone. If the job runs every day at 4 am there is not a problem.

If the signature download is scheduled to run every hour, then it will hit the dead zone when the time shift occurs. Thus the problem will be encountered.

Note: This issue was introduced as a byproduct of a fix to eTrust Antivirus 6.0 (T2AD038), and was incorporated into the 7.0 release. Please see the Product Versions section below for a list of the affected software.

Current Status:

Please apply the patches below

Product version(s):

eTrust Antivirus 7.0 GA (Build 139 Genlevel 0302)
eTrust Antivirus/InoculateIT 7.0 for Linux (Build 1892 Genlevel 0302)
eTrust Antivirus/InoculateIT 7.0 for Solaris (Build 1892 Genlevel 0302)
eTrust Antivirus/InoculateIT 6.0 Sp1 (Build 101)
eTrust Antivirus/InoculateIT 6.0 Sp2 (Build 102)
eTrust Antivirus/InoculateIT 6.0 GA (Build 96 Genlevel 0108)
+ T2AD038 (or any inotask.exe dated after 04/25/02)
eTrust Antivirus/InoculateIT 6.0 for Linux (Build 636 Genlevel 0108)
eTrust Antivirus/InoculateIT 6.0 for Solaris (Build 636 Genlevel 0108)

OS version(s) where this problem has been reported:

Windows 2000 Server Sp3
Windows 2000 Professional Sp3
Windows NT Sp6a
Windows XP
Windows 9x
Linux
Solaris

Location of Solutions:

Windows 9x:

eTrust InoculateIT 6.0: QO36786

eTrust Antivirus 6.0: QO36763

eTrust Antivirus 7.0: QO36765

Windows NT/2000/XP:

eTrust InoculateIT 6.0: QO36771

eTrust Antivirus 6.0: QO36758

eTrust Antivirus 7.0: QO36795

Solaris:

eTrust Antivirus 6.0: QO36915

eTrust Antivirus 7.0: QO36817

Linux:

eTrust Antivirus 6.0: QO36811

eTrust Antivirus 7.0: QO36813

How to prevent this issue from occurring before daylight savings time goes into effect:

• Please apply the appropriate patch listed above.
  
  -OR-



• Ensure the next scheduled scan job or signature update is not scheduled between 2:00 am - 3:00 am including 3:00 am. For example, an hourly scan job which is currently set to run at 1:00 am will run at 2:00 am for the next scan job, which lies in the dead zone. As an option you may schedule the job to run in 3 hour intervals, so the next scan job will run at 4:00 am.

How to resolve the problem if encountered after daylight savings time goes into effect:

• Please apply the appropriate patch listed above.
  
  -OR-



1. Recycle the inotask.exe process. This can be done by any one of these steps:
   
   
   1. Open the eTrust Antivirus application. In the menu select "Scanner", then select "Services Manager".
   
   
   
   2. Open the Services applet from the Control Panel or Component Services from Administrative Tools.
   
   
   
   3. Use these commands at the command prompt:
      
      net stop inotask
      net start inotask



2. Then reapply the policy, if it exists, or reschedule the job/task.
   
   NOTE: The stopping of inotask will terminate the start time, scheduled during the dead zone. It will then pick up the new time after the reapplication of the policy, post dead zone time.

How to apply / implement the solution:

See fix instructions.

Pre-requisite and/or co-requisites for this solution:

See fix instructions.

How to confirm that the solution addresses the identified problem:

Inotask should no longer consume high CPU up to 100%.
Scheduled jobs should now run normally.
Signature Downloads should now proceed normally.