I rarely reboot unless I have to, but I do hibernate at night and when I'm not using the system during the day. When the PC wakes up (Windows 7) it is unusable for 8-10 minutes as mcshield.exe is performing hundreds of thousands of bytes of disk I/O per second. The disk queue gets up to 100 (from perfmon), and it is also putting pressure on memory as the page faults are also up to 100 per second and the hardest hit disk file is pagefile.sys, with mcshield as the user.
This all occurs before I open a window or click an icon.
Mcshield appears to be scanning all the files on the hard drive, again from perfmon.
I went into "excluded files and folders" and excluded all my data files that I could do (documents, pictures, videos, music) and that seems to have shortened the problem to 3-4 minutes.
Why does Mcshield have to scan everything every time the machine wakes up? Is there a way to make it not do that?
I see this all the time, since I use power-saving settings, and the best way to understand it is by knowing what mcshield does and what happens when you hibernate.
Hibernation involves dumping all the contents of memory and copying the contents of the page file to a hibernation file. When you come out of hibernation the system tries to fit everything in the hibernation file back into memory, with the page file taking back some of it. On a Windows 7 machine that hibernation file can be quite large - I see a 3Gb hiberfil.sys on my Win7 machine, and a 4Gb pagefile.sys
mcshield will do real-time scanning of any file on disk when it is accessed for anything. You're potentially accessing several gigabytes-worth of files in the hibernation file as your machine come back to life : mcshield has a lot of work to do.
Having said that, 8 to 10 minutes is far longer than I've seen on Win7. On XP it used to take about 5 minutes to calm down, on Win7 it takes only a minute or two.
I wonder whether percentage of disk in use and disk fragmentation might have something to do with it? A fragmented page file or hibernation file can sometimes cause problems - I use Piriform's Defraggler to check disk usage, but Windows' built-in defragmenter is probably better; on Windows 7 it runs on a schedule but you can also run it on request. If you can't see where to do this just hit F1 and type 'defragment'. (And fwiw I just analysed my C: drive and it says no need to defrag - but I don't have anything like a full disk).
OK, that makes sense and I'm probably memory-constrained so that would make it worse. My hiberfil.sys is 2.2GB, memory is 3GB, pagefil.sys is 3 GB. I defrag regularly, and clean out junk files, and the one and only disk is 218 GB with 62 GB free.
Is there any way to turn this off? It's not possible that the file has changed (been infected) during hibernation, is it?
Turn it off? I wish :-)
No, I don't think so. "Scan every file" is what mcshield does, unless you tell it to ignore some categories of file. It's not programmed to know when the machine is just coming out of hibernation : to mcshield it must look as if the machine's just been switched on, so it leaps into action and does its stuff.
It's annoying, but I can't see a way to stop it happening. You've done about all you can do to minimise the work mcshield has to do.
I thought of one other thing, but it kind of defeats the purpose of hibernation: close all your open windows before you hibernate. But then mcshield will scan them anyway when you open them, just slowing things down a little at a time instead of all at once. I just saw something that says I can get a usb flash drive and use it as additional ram. Maybe that will help. A second hard drive just for pagefil.sys could help, too.
I'd go for the second hard drive for your page file, I read somewhere that it helps generally. Wish I could remember more about that topic, but I do recall that it was recommended. Not sure about the flash-drive-as-RAM idea, but it might be worth a try.
If I can find the article or blog or whatever about the 2nd hard drive tonight I'll give you a link. If I can't find it tonight, then it depends on what I'm doing tomorrow ...
Not the one I wanted but it might do :
And : All About Hibernation or, The Chicken and The Egg
(basically saying, don't try to move the hibernation file)
I do not use hibernation but when it comes out of hibernation does the PC index the files specified as it does on boot. if so Mcshiled will scan all indexed files.Message was edited by: Peacekeeper on 7/06/14 6:51:51 AM
I think so, indexing is one of the tasks that is doing some disk I/O.
Today when I woke it up the first thing I did was turn off realtime scanning. That took two minutes to navigate three screens, but once it was off the system immediately became responsive. It took another two minutes for the disk queue to become empty, mcshield was still the cause of the I/O, but it was up and running.
Now I've turned it back on with no ill effects. I'll try turning it off before hibernating, and see what happens.