cancel
Showing results for 
Search instead for 
Did you mean: 

Virus Scan Performance Issues

Has anyone had any performance issues with VSE 8.7i where EngineServer.exe takes up all of the CPU.  I have had this issue on some but not all machines and makes the PC grind to a hault.  I have had this issue with 8.7i RTM and both the service packs, we are currently running SP2.

Any help would be appreciated.

25 Replies
McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 2 of 26

Re: Virus Scan Performance Issues

Be sure you are running the 5400 engine.

EngineServer.exe is responsible for providing scanning services for ScriptScan, and Outlook Scan - scanners that in prior versions loaded the Scan Engine and DATs into the running process; EngineServer provides an out-of-process scanning mechanism, one benefit being if the scanner has issues it can fail and not bring down the application.  This process also handles the scanning for the add-on product "VirusScan Enterprise for Storage".

If you notice the process using high CPU, it is likely that scanning activity is underway, or loading of the engine and DAT signatures.

If an update has just occurred, then it is likely reloading the DATs and engine.

This process runs at normal priority, so any activity from it could be noticeable to the user...

An issue that might lead to an undue amount of activity following an update, is if EngineServer is initializing an instance of the Engine/DATs and it fails to utilize the RunTimeDat for memory management, in which case it reverts to using an older memory management scheme (using WFV*.tmp DATs) that is not as efficient.

The older memory management scheme is used until the next time the service starts, or an update occurs, where it will again attempt to create the RunTimeDAT.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee
Highlighted
SeaCat
Level 7
Report Inappropriate Content
Message 3 of 26

Re: Virus Scan Performance Issues

I don't see how telling our clients that Yes it's normal for your machine to grind to a halt for 5-10 minutes every day because a dat update is occuring or it might be scanning during the update.  Why does the problem exist in 8.7 and not 8.5?  We are on the verge of upgrading to 8.7 but reading posts like this make me even more leary of attempting that.  It's absolutely unacceptable for a clients machine to be completely frozen for 5-10 minutes because of a McAfee update.  Why doesn't McAfee fix this?

McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 4 of 26

Re: Virus Scan Performance Issues

>Why does the problem exist in 8.7 and not 8.5?  We are on the verge of upgrading to 8.7 but reading posts like this make me even more leary of attempting that.  It's absolutely unacceptable for a clients machine to be completely frozen for 5-10 minutes because of a McAfee update.  Why doesn't McAfee fix this?

Agreed. It needs investigation to make sure there is no product issue, and even if not, to see if there's a way to improve the user experience.

It has been posted before that there are tweaks to lessen the burden of what happens during an update.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee

Re: Virus Scan Performance Issues

Hello

We open a case with support Level 3 said that apply service pack 3 to see what happed , other level 2 said that this service pack it not focus to resolve performance problems issue.

Re: Virus Scan Performance Issues

We have the same Problems - with old Systems with 1GB RAM or less and a Single Core CPU , VSE 8.7 P1/P2, MA4.5 / MA 3.6 P3

Additional we have Problems during the OnDemandScan with the same Systems. The hole System is very slow and not realy usable !

Does anyone know improvements, Tricks,... ?

Does the MA4.5 P1 or the VSE 8.7 Patch 4 improve here something ?

What Performance Keys are possible ?  I know the following :

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
"LowerWorkingThreadPriority"=dword:00000001
"SetProcessPriority"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
"ScanProcessesOnEnable"=dword:00000000

We have wished to get a "VirusScan Lite" like years before - to get older "LowSpec Systems" protected without Performance Problems.

We have many Production Machines which contains very old Hardware and which runs for Years - and needs a Protection too !

Reliable Contributor rmetzger
Reliable Contributor
Report Inappropriate Content
Message 7 of 26

Re: Virus Scan Performance Issues

finkemch wrote:

We have the same Problems - with old Systems with 1GB RAM or less and a Single Core CPU , VSE 8.7 P1/P2, MA4.5 / MA 3.6 P3

Additional we have Problems during the OnDemandScan with the same Systems. The hole System is very slow and not realy usable !

Does anyone know improvements, Tricks,... ?

Does the MA4.5 P1 or the VSE 8.7 Patch 4 improve here something ?

What Performance Keys are possible ?  I know the following :

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
"LowerWorkingThreadPriority"=dword:00000001
"SetProcessPriority"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
"ScanProcessesOnEnable"=dword:00000000

We have wished to get a "VirusScan Lite" like years before - to get older "LowSpec Systems" protected without Performance Problems.

We have many Production Machines which contains very old Hardware and which runs for Years - and needs a Protection too !

Consider adding this as well:

Added Reg Entries:


;; REGEDIT4
;;
;;  RunAtNormalPriority
;;
;;  see http://community.mcafee.com/message/121528#121528
;;  Author: William Warren http://community.mcafee.com/people/wwarren
;;          Mar 26, 2010 1:50 PM
;;
;;  Patch 4 will include resolutions to 2 issues that are relevant to
;;  this thread:-
;;  1. EngineServer memory usage climbing to excessive levels.
;;     A proof-of-concept build has been proven to solve one aspect
;;     of the issue, specific to use of EmailScan. We still haven't
;;     tracked down lingering reports of high memory usage in
;;     EngineServer once our POC code is in place; whatever the
;;     condition, it is rare, and it does not appear related to
;;     EmailScan.
;;
;;  2. A fix for an issue with creating the mferuntime.dat file.
;;
;;  This symptom is the key contributor of why some systems are seen
;;  to take 10+ minutes to complete an update.
;;
;;  Post update, the Engine tries to create a memory mapped file to
;;  help reduce memory footprint and improve performance, this file
;;  is mferuntime.dat (See article KB65459).
;;  https://kc.mcafee.com/corporate/index?page=content&id=KB65459
;;
;;  What we have found to occur is the creation of the file sometimes
;;  encounters sharing violations (one or more of the scanners hasn't
;;  released it) and the product enters a loop of retrying to create
;;  this file. This file is created based on information from our DAT
;;  signatures, and so this data is reread each time the loop repeats.
;;  It can be very noticeable to users by way of sluggishness of the
;;  system.
;;
;;  Here's what I know will help alleviate the stress of updates,
;;  until these issues are resolved:-
;;
;;  1. Tweak the Agent thread priority as described in KB53690.
;;  https://kc.mcafee.com/corporate/index?page=content&id=KB53690&pmv=print
;;     see LowerWorkingThreadPriority above.
;;
;;  2. Disable scanning of Processes on Enable - this is only intended
;;     for environments who abide by the "Maximum Security" setting of
;;     the product.
;;     https://kc.mcafee.com/corporate/index?page=content&id=kb60651
;;     see ScanProcessesOnEnable above.
;;
;;  3. Utilize the Low Risk On-Access Scanner profile, placing McAfee
;;     processes into it (mcscript_inuse.exe, naprdmgr.exe,
;;     frameworkservice.exe), with scanning disabled (understand this
;;     is a temporary measure)
;;
;;  4. Perhaps the most significant change for relief, lower the
;;     priority of our On-Access Scanner from its default "High"
;;     to "Normal"
;;
;;     This is done by creating/setting a DWORD registry flag named
;;     "RunAtNormalPriority" to 1, under
;;  [HKLM\Software\McAfee\VSCore\On Access Scanner\McShield\Configuration]
;;     and restart the service. (Or Reboot.)
;;
;;     This change is normally done only under direction by McAfee
;;     Support. It does not reduce your security in any way, but
;;     it's plausible you could see an increase in scanner timeouts
;;     because McShield will be getting equal CPU time as your
;;     other Normal thread priority processes instead of a lion's
;;     share. And this means if experiencing the mferuntime.dat
;;     loop, your system will still be pretty responsive during


;;     that time.
;;
    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
;;
    "RunAtNormalPriority"=dword:00000001
;;  "RunAtNormalPriority"=-


Solution four (4) above may help with useability.

Good luck,

Ron Metzger

Thanks,
Ron Metzger

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Virus Scan Performance Issues

Thank You Ron

for the Answer,

Does the "RunAtNormalPriority" Key produce Problems in a Case of an Infection ? Does the Scan Process now delay the Removal of the Viruses ?

In a Case of a Problem e.g. a "LowSpec" Production System it would be the Priority to run without Problems and Interrupts. Here this Settings could help.

We will test it.

Regards

               Michael

Reliable Contributor rmetzger
Reliable Contributor
Report Inappropriate Content
Message 9 of 26

Re: Virus Scan Performance Issues

finkemch wrote:

Does the "RunAtNormalPriority" Key produce Problems in a Case of an Infection ?

;;     This change is normally done only under direction by McAfee
;;   
Support. It does not reduce your security in any way, but
;;    
it's plausible you could see an increase in scanner timeouts
;;    
because McShield will be getting equal CPU time as your
;;     other
Normal thread priority processes instead of a lion's
;;     share.

And this means if experiencing the mferuntime.dat
;;     loop, your
system will still be pretty responsive during
;;     that time.

finkemch wrote:

Does the Scan Process now delay the Removal of the Viruses ?

Do you mean Scan Process On Enable?

Ron Metzger

Thanks,
Ron Metzger

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Virus Scan Performance Issues

Hello Ron,

rmetzger wrote : Do you mean Scan Process On Enable?

                              finkemch wrote: Does the Scan Process now delay the Removal of the Viruses ?

my Question was regarding the "RunAtNormalPriority" key

-> I am thinking about using this key for production/measurement systems to prevent any problems of the production application.

We start the Production Application with high Priority and now only the Production Process has now this Priority. It sounds nice.

Thank you for the Key - we will try it 😉

regards Michael

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator