Mcshield.exe excessive virtual memory usage

[FrancksSix]

On my office computer since 2 weeks my computer went slow down and crash at least each 1 to 2 days. After inveestigation on EventViewer I spot that is McShield causing crash. On the performance monitor I can see mcshield.exe using about (57 500 000Ko) virtual memory.

[jess_arman]

@FrancksSix In order to make an appropriate recommendation in regards to your issue, we need more context to the versions of software installed on your system. Also, without detailed data, it is difficult to make an assumption about the exact cause of your apparent memory leak issue.

However, there have been various memory leak issues corrected in the latest versions of ENS. As such, if you are on an older build, I would advise that you look to test with ENS 10.6.1 or 10.5.5 to confirm if it resolves this behavior. You can learn more about the versions and obtain links to Release Notes and Product Guides via KB82761.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[FrancksSix]

Informations système
Nom de l'ordinateur: POSTE255

McAfee Agent
Numéro de version : 5.5.1.342
Etat: Managé
SuperAgent: Homologue à homologue
Dernière vérification de mise à jour de sécurité: 2018-10-15 07:00:16
Dernière communication agent-serveur: 2018-10-15 08:08:06
Intervalle de communication agent-serveur toutes les (min): 10 minutes
Intervalle de mise en oeuvre des stratégies toutes les (min): 15 minutes
ID de l'agent: {38e46548-ce2c-11e8-10e1-1c1b0da85457}
Gestionnaire d'agents/Serveur ePO
Nom DNS: vVenom.mydom.qc.ca
Adresse IP: 255.255.255.0
Numéro de port: 443

McAfee VirusScan Enterprise + AntiSpyware Enterprise
Numéro de version : 8.8.0 (8.8.0.1982)
Date de compilation : 2018-03-17

Type de licence de l'antivirus : licensed

Version du moteur d'analyse (32 bits) : 5900.7806

Version du moteur d'analyse (64 bits) : 5900.7806

Version du fichier DAT : 9041.0000
Fichier DAT créé le : 10/9/2018

Nombre de signatures dans extra.dat : 0
Nom des menaces détectables par extra.dat : Aucun
Version du fichier DAT de protection d'accès et contre le Buffer Overflow : 762

Patchs installés : 11

Modules installés :

[chealey]

Hi @FrancksSix

Thank you for sharing your version details. We don't have any known memory issues with this version so we would need to troubleshoot this with further data to make any sort of analysis.

From experience, some memory issues are caused by excessive event creation. Check if the machine is generating a lot of events and if so, maybe turn off some of the reporting ones. Another frequent cause is the lack of reboot after an installation. If this is a new installation, you may want to reboot and monitor.

If none of these options help, please gather the data mentioned in this KB along with a MER from the system and provide it to support for further analysis: https://kc.mcafee.com/corporate/index?page=content&id=KB74951

[jess_arman]

@FrancksSix High memory consumption or leaks are not a common occurrence with the version of VSE that you are running; it is likely a side effect of a need to do some tuning and configuration adjustments. As such, beginning with some of chealey's suggestions or contacting support for investigation by trace logging would be suggested.

I also would advise that you go back and edit your previous post to remove your domain and IP address information for your protection. While nobody monitoring these forums to provide assistance would misuse that information, please keep in mind that this forum is still public and can by searched by anyone online.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[FrancksSix]

Well I received from my technical team a new machine freshly installed. I thought I had put this problem aside ... no this morning even finding 60 GB of virtual memory used by McShield. Back to square one.

As a solution track I believe that OneDrive could be the key to the puzzle. I have two OneDrive accounts (professional and personal) my personal account is 1TB and is 60% loaded. Since I do not want to recover all these files locally, I use the OneDrive option "Free space".

My company runs a full scan every night. My doubt is that the scan fails in its attempt to access these files that are not actually local. And I really have a lot.

[FrancksSix · Accepted solution]

I confirm this is an issue with OneDrive I disconnected my drive for few days and the problem was gone. Unfortunately its only a workaround because I need link with my OneDrive's files.

It seem to occurs each time the complete scan lauched. In my buisiness they fixed a scan at each days at 21H00. And each morning my computer was down because mcshield use over 60Gb on virtual memory.
I will disconnect my drive each night until a fix will be release. Its boring but it work...