VSE 8.5i HotFix 427887 addresses two Mcshield processes with Patch 6

[twenden]

FYI,

McAfee has an updated knowledgebase article 616344 for a hotfix that fixes the problem with Patch 6 and two Mcshield processes. It seems to say that you must install this hotfix before installing Patch 7 and any other future patches.

https://knowledge.mcafee.com/article/72/616344_f.SAL_Public.html

High CPU usage after installing VirusScan Enterprise 8.5i Patch 6 (issue: two McShield processes running)


Environment

McAfee VirusScan Enterprise 8.5i Patch 6
Microsoft Windows (all supported versions, see 613414)


Problem

50 percent CPU usage reported on computers that have upgraded to VirusScan Enterprise 8.5i Patch 6.
The Windows Task Manager shows two McShield processes running.


Change or Cause

This is an emerging issue with McAfee VirusScan Enterprise 8.5i Patch 6. This KnowledgeBase article will be updated when additional information is available.

Solution

This issue can be addressed with HotFix 427887. This hot fix has been attached to this article as VSE85HF427887.zip.

NOTE: This fix must be implemented before installing Patch 7 to avoid seeing the same issue under Patch 7 or later.

Below are the hotfix release notes:

HotFix Release Notes

HotFix Version:
HF427887

Product:
VirusScan Enterprise 8.5i

Timestamp:
26 September 2008

Files affected:
MCSHIELD.EXE 13.3.2.133

Issue:
When installing a VirusScan Enterprise 8.5i patch, the existing On-Access Scanner service
may fail to unload. This leads to two instances, of the service, with one taking up a high amount of CPU usage.

Resolution:
The On-Access Scanner service had been updated to avoid a runaway thread scenario that caused
the service, being replaced, to not stop.

Notes:
1. This HotFix is designed to prevent future patches from exhibiting this behavior. This HotFix will not correct systems that already exhibit the behavior.
2. An administrator can install this release by executing VSE85HF427887.EXE locally on an individual system, or by adding the package to the ePolicy Orchestrator or ProtectionPilot repository for deployment via an agent update.

[Travler]

I suppose there will eventually be an 8.5i Patch 7, but I'm sure I'll be moving to 8.7i rather than continue to patch 8.5i.

The big question is: does this problem occur when moving from 8.5i to 8.7i?

[gnatwest]

This Hotfix is for 8.5i in general. From what Ive read you should install it even if you go to 8.5i Patch 7. It reads as this hotfix should be installed so that all future Patches will install without issue.


This Hotfix does not work with 8.7i. From installing 8.7i, there is a completely new way they are running the various AV systems, there are more processes running than before. The system seems to be more segmented.

[Travler]

Its good to know that the hotfix is not needed if you do not plan on applying any future patches to 8.5i. Since McAfee recommends not installing hotfixes as a preventative measure, I won't be rolling out this hotfix unless 1) 8.7i turns out to be buggy resulting in my not wanting to upgrade to it anytime soon, and then 2) McAfee releases a 8.5i Patch 7.

[twenden]

I was hoping that Patch 7 would cure all these issues.

It seems stupid that you have to push out a hotfix for ALL future patches. In my test, the hotfix locked up two systems for about 30 seconds. This will be a pain to push out since users will wonder why their systems is non-responsive for 30 seconds while the hotfix installs. Only about 40% of our 1500 users leave their systems on overnight which would be the ideal time to push out the hotfix. I might keep the users on Patch 4 until we can figure out if 8.7i is any better or not.

[gmc_za]

So you need to roll this out before you roll out patch 6 or later. Why can't they just include it in patch 6.2 or 7?

[gnatwest]

Anyone know if there is a report that says if this was installed or not?

[dEcSup]

I am using patch 6.1 and have not encountered this problem. Do I still need to apply this hot fix?

i have deployed patch 6.1 in the past few weeks but no such issue reported. is this issue solved once the PC has been restarted? :confused:

[gnatwest]

I spoke with platinum support earlier.

There is a bug in McShield.exe that will cause a second process to start after a patch is installed, because Access Protection will not allow mcshield.exe to close.

Once the computer is restarted this will resolve the second process issue, but it may return after another patch update. For workstions this isnt a big problem, but servers can be a hassle to arrange a time for a reboot - SQL etc.

Platinum told me that this hotfix will prevent the second process from starting with any future patch installations. Platinum told me it will probably be rolled into Patch 7, however you may get the problem with Patch 7 if you dont have this hotfix installed since it is a patch installation without the hotfix, you would be safe for Patch 8 once you had patch 7 installed.

I will most likely be distributing this Hotfix accross the enterprise. I just need to learn how to report on clients that have successfully installed the hotfix.

[dEcSup]

So I will roll out this hotfix.

For servers, only when the new patch is tested ok for sometime, then i will install to them..
Thanks!