McShield.exe increase in CPU

[Majidkhan]

Hi ,

We have seen an increase in CPU usage with Mcshield.exe process whenever the on-demand scan is triggered, wanted to check the reason.

As per my understanding scan32.exe should increase the usage, but why mcshield is increasing.

McShield is meant for on-access scanning but not an on-demand scanning process

We are running with VSE patch 12.

Please advise.

[vivs]

Hello,

Thanks for your post.

I would like to request you to please refer the below link for On Demand Best Practices:

On demand Best Practices 

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[Majidkhan]

Hi ,

Thanks for your quick response.

But what i want to understand is why there is an increase in CPU % with mcshield.exe (on-access scan process) when on-demand scan is triggered. Basically we should see an increase in scan32.exe (on-demand scan process) during this time.

Please advise.

[vivs]

Hello,

Thanks for your response.

McShield.exe is the process of ODS in all the latest patches.

Scan32.exe is legacy terms.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[chealey · Accepted solution]

@Majidkhan mcschield.exe is the process that does the actual scanning. scan32/64 are as my colleague suggested legacy processes but they are still used within VSE to load and run the ODS task itself.

So yes, we would expect to see high CPU from mcshield. 

[Thussain · Accepted solution]

On-Demand Scanning has been improved by moving from single-threaded scanning to multi-threaded scanning. This move allows VSE 8.8 to complete scan tasks in a much shorter time. The file system is walked and file names are added to a scanning pool, from which an available scanning thread is retrieved and acted on. If a file is modified or written to disk after the scan had progressed past that part of the file system, it will not be scanned until next time the ODS is run. Multi-threaded scanning applies to the file system only. Available scanning threads might come from the McShield.exe process; so, you see McShield.exe as active when ODS runs instead of the expected Scan32 or Scan64 process. But, the configured settings for the ODS are still in effect for those threads. To force ODS to scan files rather than rely on McShield, the McShield service must first be stopped before you start the ODS.

Please refer to the below mentioned KBA
https://kc.mcafee.com/corporate/index?page=content&id=KB74927

If would you like to know which process is consuming high CPU on the machine, the best way would be to run process monitor on the machine while the issue is reproduced, you may log a SR with McAfee Technical support for analysis of the procmon logs