FYI,
McAfee has an updated knowledgebase article 616344 for a hotfix that fixes the problem with Patch 6 and two Mcshield processes. It seems to say that you must install this hotfix before installing Patch 7 and any other future patches.
https://knowledge.mcafee.com/article/72/616344_f.SAL_Public.htmlHigh CPU usage after installing VirusScan Enterprise 8.5i Patch 6 (issue: two McShield processes running)
Environment
McAfee VirusScan Enterprise 8.5i Patch 6
Microsoft Windows (all supported versions, see 613414)
Problem
50 percent CPU usage reported on computers that have upgraded to VirusScan Enterprise 8.5i Patch 6.
The Windows Task Manager shows two McShield processes running.
Change or Cause
This is an emerging issue with McAfee VirusScan Enterprise 8.5i Patch 6. This KnowledgeBase article will be updated when additional information is available.
Solution
This issue can be addressed with HotFix 427887. This hot fix has been attached to this article as VSE85HF427887.zip.
NOTE: This fix must be implemented before installing Patch 7 to avoid seeing the same issue under Patch 7 or later.
Below are the hotfix release notes:
HotFix Release Notes
HotFix Version:
HF427887
Product:
VirusScan Enterprise 8.5i
Timestamp:
26 September 2008
Files affected:
MCSHIELD.EXE 13.3.2.133
Issue:
When installing a VirusScan Enterprise 8.5i patch, the existing On-Access Scanner service
may fail to unload. This leads to two instances, of the service, with one taking up a high amount of CPU usage.
Resolution:
The On-Access Scanner service had been updated to avoid a runaway thread scenario that caused
the service, being replaced, to not stop.
Notes:
1. This HotFix is designed to prevent future patches from exhibiting this behavior. This HotFix will not correct systems that already exhibit the behavior.
2. An administrator can install this release by executing VSE85HF427887.EXE locally on an individual system, or by adding the package to the ePolicy Orchestrator or ProtectionPilot repository for deployment via an agent update.