Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Event ID 7000 appears in the System Event log and the Real-time scan is not working

    • Updated:
    • 17 Oct 2016
    • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • Platform:
    • Windows 2003 Compute Cluster Server
    • Windows 2003 Datacenter Server
    • Windows 2003 Datacenter Server Edition 64-bit
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard Server Edition
    • Windows 2003 Standard Server Edition 64-bit
    • Windows 2003 Storage Server
    • Windows 2003 Web Server Edition
    • Windows 2008 Datacenter Server
    • Windows 2008 Datacenter Server Edition 64-bit
    • Windows 2008 Enterprise Server
    • Windows 2008 Enterprise Server Edition 64-bit
    • Windows 2008 Standard Server Edition
    • Windows 2008 Standard Server Edition 64-bit
    • Windows 2008 Storage Server
    • Windows 2008 Web Server Edition
    • Windows 2008 Web Server Edition 64-bit
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

The OfficeScan agent icon in the system tray started to appear red instead of blue. When you hover on the icon, it indicates that the Real-time Scan has stopped.

Manually starting the OfficeScan NT Real-Time Scan service fails and the System Event log records the following error:

Event Type:        Error
Event Source:      Service Control Manager
Event Category:    None
Event ID:          7000
Date:              10/05/2010
Time:              12:09:34 PM
User:              N/A
Computer:          MACHINE NAME
Description:
The OfficeScan NT Real-Time Scan service failed to start due to the following error:
Insufficient system resources exist to complete the requested service.

Uninstalling and reinstalling OfficeScan does not resolve the issue.

Details
Public

This is caused by a memory issue. To resolve this, administrator needs to extend the "PagedPoolMemory" key by doing the following:

  1. Open the Registry Editor.
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  2. Change the registry key with the following values:

    key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
    Value: PagedPoolSize
    Data: 0xFFFFFFFF

  3. Close the Registry Editor.
  4. Reboot the machine.

For more information about PagedPoolSize, visit the Microsoft article about PagedPoolSize.

If the issue persists, collect the CDT logs using the following procedure:

  1. Download and run the CDT tool and enable the Basic debug logs only.
  2. Collect and send the CDT logs in a ZIP file format to Trend Micro Technical Support.
Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1056972
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.