Mcafee Enterprise 8i High CPU Utilisation

Hi Guys. Need some expert opinion here. Mcafee as per above is running high cpu utilisation on Win2k Machines. Run all adware applications I could think of, but to now avail, the Services.exe runs at 100% and so does the Mcshield after the Services.exe stops. It does this continuously for minutes to hours on end. it does not affect all my network win2k machines and none of My XP Boxen. When I unplug Hosts, the problem abaits. When I reconnect its ok for a couple of mins and then, its back. Dropped ethereal on the boxen, picks up nothing from host that could be deemed anomylous. Used Filemon 7.3 and only get UPdate UI.exe (procees of Mcafee) running all the time, even though my policy is only set to eforce policy every hour (Epo). The Services.exe writes to an event log in application events. Any help? Googled and Googled now am the end of my tether! oh and here, http://forums.mcafeehelp.com/viewtopic.php?t=44560 in case anyone wonders if mcafee could help. someone else had exact same problem and has recieved no response. This fits my problem exactly btw.

Win2k
sp4 plus all hotfixes, running SUS and migrating to WSUS
256 MB Ram
2.6 Ghz Processors
40 GB HDD
Flat, network No A.D.

For Funaki's sake Help!!!!

Tried HJT yet?

Check MSConfig and make sure you don't have any naughty little progs in startup - check registry (hkey local machine software windows startup run) as well. Sometimes there's junk that even AdAware and SB miss.

Do a full-on cleanup - Temp Internet Files, temp files, the works. Defrag. Might help a bit to free up some more resources.

Only other thing I can think of is possibly a stick of your ram is dying?

Luck to ya!

thank you so much for reply. these steps excluding the de-frag has been done. plenty of space on the drives left, more than 30 GB. I have issue that it seems to only affect my win2k systems. then only not all of them. this is so weird. thanks ..... i even set page file size to 880 min ans 1024 max, and dnsclient to manual in services in case the mcafee was locking the HOSTS file. but to no avail. am going bald from the inability to solve this one. yes i have uninstalled the mcafee, no problems, except the obvious security ones, or the fact that whatever process is being malicious, can now go ahead "unabated" I am also using a march edition verion of the mvps,org HOSTS file. and have used the updated HOSTS file on some other affected clients, still same results.

"what is HJT?"

HJT is hijackthis; a very powerful registry editor used mainly for malware removal.


Have you tried reinstalling the program? I have had it running an many 2k machines (it is the program the school I used to work for gave to all students/staff/faculty) nd it worked fine. Generally problems like this mean its conflicting with something and fighting ofer a resource or file its trying to scan, so when it gets to that file it uses all available resources to win the fight, meanwhile the other program is doing the same, so no matter how much ram/virtual em you give it, it will eat it all. next time it happens, open the counsole and see what file/directory it is scanning and try and get it to skip it for now, see if the problem stops, if it does stop you know where your problem is, and we can work from there. Let it hang a few times just to see if its happening in the same place though.

i did re-install. it seems that on 1 computer, my "test" computer, whenever it gets to anything that the spybot quarantined, it uses the services.exe to write the scan data. i do not know if this is actually causing the hang, as the service.exe "exits" and mcshield continues (this is with the tasklist open). i can only see the result, the application events log being updated. i am going to delete the quarantine an uninstall the spy-bot product. then see if symptoms re-manifest?! thanks for the advice.

Was that “ services.exe “ or “ service.exe “

You said both, but are very different.

Ive seen this type of hang when people have more than one type of "scan on access" type of service running (like 8i and spybots active scanning) because they each trigger eachother. for instance. Mcafee will scan a file, see its bad, so it has been accesses...spybot now sees it was accesses and scans it...macfee sees spybot access it and scans it and it will go back and forth. It can happen.

If Any of You Guys are McAfee Users, Please be aware of the fact that Patch 11, issue 11 fixes this problem. I would love to post what exactly it does, but am prevented in doing so because of their disclaimer which states that I will be held liable for posting information of their updates onto a public internet site without written permission from them.

The Patch is part of the application update cycle and is not a DAT file. thanks for the Help. No I was not directly responsible for the anti-Virus, but was asked to assist, hence the request for information here. I had to teach myself this application in as short a time period as possible to fix the problem. i wish to thank everyone on this site for assisting. the HOSTS file is locked by a terminate and stay resident part of the application concerned. hence the machines hang. a work-around is to make the dns client in the control panel/administrative tools/services manual. thus allowing multiple instances of the HOSTS file to be opened incase a process locks it. applying the patch to the mcafee product resolves the memory leak and free's up the HOSTS file and other processor time for other instances. this is general i hope :D

i havent been here in ages, btw where is pooh-tsun-tzu?

Quote:

---

btw where is pooh-tsun-tzu?

---

Left ........... self banned.
Came back, left again, not seen since, missed ...............