Have a problem with a process kicking off at approximately the same time every day with a dozen or so PC's. Each PC is assigned to a different area of the company and there really isn't any similarities between them. There are three processes that tag the CPU: McShield, VsTskMgr, and svchost. Svchost is the largest user of CPU with 107,000K in mem usage. All clients are pushed out through ProtectionPilot and neither in ProtectionPilot nor in McAfee is there anything set to run at these times. In fact the only thing scheduled to run is the Updater at 5:00 P.M. In addition there are no other jobs set to run in the afternoon. We do all our updates in the early evening and they are pushed out instead of pulled from the client. On-Demand isn't doing any scheduled scans of these machines and when the issue occurs I have manually manipulated the amount of CPU Virus Scan can use to but to no avail. Have installed service pack 6 to no avail. Process itself lasts about 15 to 20 minutes although some users have complained about it taking an hour. Can understand if there is a missed "scheduled" service that runs causing McAfee to kick in however it's the same machines daily, late in the day, and it's only happening on a dozen out of 200 +/- workstations, 10 of which run 24X7.
Head over to the sysinternals site and load filemon and/or process mon. Very helpful in determining what McAfee is doing while its taking 100% CPU. Once you determine what files it is accessing/opening/scanning then you can see if there is an application associated with them. For me my issues have been around application where I had to tweak the on-access scan to either exclude or only scan on write or read/write. My organizations home grown apps always create a challenge.