one of our customers has the issue, that copying/downloading of archive files brings mcshield.exe to nearly to 100% cpu usage and the client does not respond after some time.
Edit: Especially, when archive-scanning is enabled ... but also it consumes a lot of ressources without.
We use ePO 5.3.3, Agent 5.5, VSE 8.8 P11.
- Uninstall of Agent and VSE, restart, new installation of agent and VSE
- Different client-machines
- Disabling archive-scan (which made it better)
If an Office-Installation folder (no iso, just files) is copied from a server-share to a local directory,
McShield starts going crazy. Same with larger .zip archives (2-5GB) and same with downloads
of large .zip-files (internet). The copy-process then "hangs" forever.
If scanning of archives is disabled on the client-side (while copying or before), everything is better,
but really good. CPU usage is still high.
Server(s) and clients are no "potatoe-machines".
- Maximum scan time is not enforced
- Artemis is "very low"
- Scan on network drives is disabled
- Read/Write scan is enabled
For the moment, we disabled archive scanning and decoding of MIME encoded files, which
is a small workaround but no sollution, because that's just one part of the issue.
Edit2: Same issue with VSE 8.8 P11 and Agent 5.0.6 (another customer). Just copied some smaller
ZIP-Archives (McAfee VSE Installation Archives) from a server to another. Archive-Scan disabled.
McShield has also afterwards for a couple of time nearly 50% CPU usage.
Does anyone have the same issues and/or some good hints?
I never saw this in such an extreme form in the past. Most of our customers run VSE 8.8 P10 and
Win7/10 (1709) with Agent 5.0.6 and do not have this kind of issues...
Hints and suggestions very welcome!