Mcafee Enterprise 8i High CPU Utilisation
Results 1 to 9 of 9

Thread: Mcafee Enterprise 8i High CPU Utilisation

  1. #1
    Member
    Join Date
    Oct 2003
    Posts
    62

    Mcafee Enterprise 8i High CPU Utilisation

    Hi Guys. Need some expert opinion here. Mcafee as per above is running high cpu utilisation on Win2k Machines. Run all adware applications I could think of, but to now avail, the Services.exe runs at 100% and so does the Mcshield after the Services.exe stops. It does this continuously for minutes to hours on end. it does not affect all my network win2k machines and none of My XP Boxen. When I unplug Hosts, the problem abaits. When I reconnect its ok for a couple of mins and then, its back. Dropped ethereal on the boxen, picks up nothing from host that could be deemed anomylous. Used Filemon 7.3 and only get UPdate UI.exe (procees of Mcafee) running all the time, even though my policy is only set to eforce policy every hour (Epo). The Services.exe writes to an event log in application events. Any help? Googled and Googled now am the end of my tether! oh and here, http://forums.mcafeehelp.com/viewtopic.php?t=44560 in case anyone wonders if mcafee could help. someone else had exact same problem and has recieved no response. This fits my problem exactly btw.

    Win2k
    sp4 plus all hotfixes, running SUS and migrating to WSUS
    256 MB Ram
    2.6 Ghz Processors
    40 GB HDD
    Flat, network No A.D.

    For Funaki's sake Help!!!!
    HO$H Pagamisa. Pro Amour Ludi....

  2. #2
    ********** |ceWriterguy
    Join Date
    Aug 2004
    Posts
    1,608
    Tried HJT yet?

    Check MSConfig and make sure you don't have any naughty little progs in startup - check registry (hkey local machine software windows startup run) as well. Sometimes there's junk that even AdAware and SB miss.

    Do a full-on cleanup - Temp Internet Files, temp files, the works. Defrag. Might help a bit to free up some more resources.

    Only other thing I can think of is possibly a stick of your ram is dying?

    Luck to ya!
    Even a broken watch is correct twice a day.

    Which coder said that nobody could outcode Microsoft in their own OS? Write a bit and make a fortune!

  3. #3
    Member
    Join Date
    Oct 2003
    Posts
    62
    thank you so much for reply. these steps excluding the de-frag has been done. plenty of space on the drives left, more than 30 GB. I have issue that it seems to only affect my win2k systems. then only not all of them. this is so weird. thanks ..... i even set page file size to 880 min ans 1024 max, and dnsclient to manual in services in case the mcafee was locking the HOSTS file. but to no avail. am going bald from the inability to solve this one. yes i have uninstalled the mcafee, no problems, except the obvious security ones, or the fact that whatever process is being malicious, can now go ahead "unabated" I am also using a march edition verion of the mvps,org HOSTS file. and have used the updated HOSTS file on some other affected clients, still same results.

    "what is HJT?"
    HO$H Pagamisa. Pro Amour Ludi....

  4. #4
    Senior Member
    Join Date
    May 2003
    Posts
    1,199
    HJT is hijackthis; a very powerful registry editor used mainly for malware removal.


    Have you tried reinstalling the program? I have had it running an many 2k machines (it is the program the school I used to work for gave to all students/staff/faculty) nd it worked fine. Generally problems like this mean its conflicting with something and fighting ofer a resource or file its trying to scan, so when it gets to that file it uses all available resources to win the fight, meanwhile the other program is doing the same, so no matter how much ram/virtual em you give it, it will eat it all. next time it happens, open the counsole and see what file/directory it is scanning and try and get it to skip it for now, see if the problem stops, if it does stop you know where your problem is, and we can work from there. Let it hang a few times just to see if its happening in the same place though.
    Everyone is going to die, I am just as good of a reason as any.

    http://think-smarter.blogspot.com

  5. #5
    Member
    Join Date
    Oct 2003
    Posts
    62
    i did re-install. it seems that on 1 computer, my "test" computer, whenever it gets to anything that the spybot quarantined, it uses the services.exe to write the scan data. i do not know if this is actually causing the hang, as the service.exe "exits" and mcshield continues (this is with the tasklist open). i can only see the result, the application events log being updated. i am going to delete the quarantine an uninstall the spy-bot product. then see if symptoms re-manifest?! thanks for the advice.
    HO$H Pagamisa. Pro Amour Ludi....

  6. #6
    Senior Member IKnowNot's Avatar
    Join Date
    Jan 2003
    Posts
    792
    Was that services.exe or service.exe

    You said both, but are very different.
    " And maddest of all, to see life as it is and not as it should be" --Miguel Cervantes

  7. #7
    Senior Member
    Join Date
    May 2003
    Posts
    1,199
    Ive seen this type of hang when people have more than one type of "scan on access" type of service running (like 8i and spybots active scanning) because they each trigger eachother. for instance. Mcafee will scan a file, see its bad, so it has been accesses...spybot now sees it was accesses and scans it...macfee sees spybot access it and scans it and it will go back and forth. It can happen.
    Everyone is going to die, I am just as good of a reason as any.

    http://think-smarter.blogspot.com

  8. #8
    Member
    Join Date
    Oct 2003
    Posts
    62
    If Any of You Guys are McAfee Users, Please be aware of the fact that Patch 11, issue 11 fixes this problem. I would love to post what exactly it does, but am prevented in doing so because of their disclaimer which states that I will be held liable for posting information of their updates onto a public internet site without written permission from them.

    The Patch is part of the application update cycle and is not a DAT file. thanks for the Help. No I was not directly responsible for the anti-Virus, but was asked to assist, hence the request for information here. I had to teach myself this application in as short a time period as possible to fix the problem. i wish to thank everyone on this site for assisting. the HOSTS file is locked by a terminate and stay resident part of the application concerned. hence the machines hang. a work-around is to make the dns client in the control panel/administrative tools/services manual. thus allowing multiple instances of the HOSTS file to be opened incase a process locks it. applying the patch to the mcafee product resolves the memory leak and free's up the HOSTS file and other processor time for other instances. this is general i hope

    i havent been here in ages, btw where is pooh-tsun-tzu?
    HO$H Pagamisa. Pro Amour Ludi....

  9. #9
    They call me the Hunted foxyloxley's Avatar
    Join Date
    Nov 2003
    Location
    3rd Rock from Sun
    Posts
    2,528
    btw where is pooh-tsun-tzu?
    Left ........... self banned.
    Came back, left again, not seen since, missed ...............
    55 - I'm fiftyfeckinfive and STILL no wiser,
    OLDER yes
    Beware of Geeks bearing GIF's
    come and waste the day :P at The Taz Zone

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides