8 Replies Latest reply on Dec 18, 2012 7:12 AM by zarma

    udaterui continous I/O read!

      Hello,

      I've seen some old posts about this with no solution. I'm running vista business on a Lenovo T61 and many times I suffer from udaterui.exe churning and killing my hard drive. this is driving me nuts, making me sweat and costing me time, as the computer slows down significantly, and for a long time.

      It usualy happens in the morning, after the machine was on standby for the night.

       

      My questions:

      1. what can be done to have this resolved (long term)

      2. immediate interim solution: is it safe to kill the process? what are the consequences?

       

      I'm listing below all details about the mcafee virus scan I have, but *please* do not assume I know *anything* about this product. So I can't answer questions like what frame/package/what have you , unless you explain how I can get that info.

       

      Virus Scan Enterprise 8.5.0i

      Scan Engine Version: 5400.1158

      DAT version: 5897.0000

      DAT created on: Feb 19 2010

      Number of signatures in extra.dat     None

      Number of threats that extra.dat can detect    None

      Buffer overflow and Access protection DAT version: 354

      Installed Pathces: None

       

      Hope someone can help with this. Thanks!

        • 1. Re: udaterui continous I/O read!
          rmetzger

          ynwebster wrote:

           

          Hello,

          I've seen some old posts about this with no solution. I'm running vista business on a Lenovo T61 and many times I suffer from udaterui.exe churning and killing my hard drive. this is driving me nuts, making me sweat and costing me time, as the computer slows down significantly, and for a long time.

          It usualy happens in the morning, after the machine was on standby for the night.

           

          My questions:

          1. what can be done to have this resolved (long term)

          2. immediate interim solution: is it safe to kill the process? what are the consequences?

           

          I'm listing below all details about the mcafee virus scan I have, but *please* do not assume I know *anything* about this product. So I can't answer questions like what frame/package/what have you , unless you explain how I can get that info.

           

          Virus Scan Enterprise 8.5.0i

          Scan Engine Version: 5400.1158

          DAT version: 5897.0000

          DAT created on: Feb 19 2010

          Number of signatures in extra.dat     None

          Number of threats that extra.dat can detect    None

          Buffer overflow and Access protection DAT version: 354

          Installed Pathces: None

           

          Hope someone can help with this. Thanks!

          You might try patching your system to the latest patch, then report back whether the problem is still present.

           

          Using your Grant Number, download Patch 8 for VirusScan v8.5. You may need to apply the 5400 engine update afterwards (or not).

          Alternatively, upgrade VSE to v8.7 with SP2 and let us know if this solves the problem.

           

          Thanks,

          Ron Metzger

          1 of 1 people found this helpful
          • 2. Re: udaterui continous I/O read!

            Ron,

            First - thanks. I did as you advised, and installed 8.7.0i and for several months things were OK.

            But now, the problem seems to be happening again. From what I notice, it's at its worst when I open my laptop in the morning (after it was in standby overnight).

            I have scheduled McAfee to run at 4am, daily, and NOT to run if missed.

            So it's not the scan. But my hard-drive clicks feverishly and the computer is slow for a long time, even though CPU and RAM utilization are low. I see that UdaterUI.exe is, again, reading the drive like crazy. this only stops after a very long time, or, if I get too frustrated and just kill the process.

             

            I'm using Scan Engine Version 5400.1158, on Windows Vista. (DAT version 6142.0000. I suppose that's not relevant, but just in case).

             

            any advice?

            is there any downside to killing the process?

             

            many thanks,

            yn webster

            • 3. Re: udaterui continous I/O read!
              rmetzger

              ynwebster wrote:

               

              Ron,

              First - thanks. I did as you advised, and installed 8.7.0i and for several months things were OK.

              But now, the problem seems to be happening again. From what I notice, it's at its worst when I open my laptop in the morning (after it was in standby overnight).

              I have scheduled McAfee to run at 4am, daily, and NOT to run if missed.

              So it's not the scan. But my hard-drive clicks feverishly and the computer is slow for a long time, even though CPU and RAM utilization are low. I see that UdaterUI.exe is, again, reading the drive like crazy. this only stops after a very long time, or, if I get too frustrated and just kill the process.

               

              I'm using Scan Engine Version 5400.1158, on Windows Vista. (DAT version 6142.0000. I suppose that's not relevant, but just in case).

               

              any advice?

              is there any downside to killing the process?

               

              many thanks,

              yn webster

              Hi yn,

               

              Does the problem happen after a full reboot or only after resuming from 'standby' mode?

               

              "Is there any downside to killing the process?" Without source code I cannot tell precisely, but I am sure the software engineers would say that this breaks 'things' and is not working as they intended.

               

              I believe (and anyone else please chime in if I am wrong) that UdaterUI.exe is part of the DAT/engine file updater (part of the McAfee Agent) which is probably checking for new updates or checking the version of the DAT and engine files currently installed. I do not know the details. (By killing this this process, you may not get future updates as designed or until you reboot your system.)

               

              If this is so, I would suggest checking the update job in the console. I could be convinced that the scheduled update job was missed and is now checking for updates, presumably right away upon resuming from hibernation. Much like the change you made to the On-Demand Scanner jobs which do "NOT run if missed," you should change the Daily Update job as well.

               

              I like the fact that you upgraded to VSE v8.7i. My concern is that I do not know what Patch you have installed. My suggestion would be to install Patch 3 or even Patch 4 if you can. (Patch 4 mentions fixes for Windows 7 systems returning from hibernation, but I am not sure this applies to your system running Windows Vista. However, Patch 4 has certain exclusions (16 character limit) which are not working fully according to some here in the forums. Though, this may not impact you in any way.)

               

              Hope this helps,

              Ron Metzger

              • 4. Re: udaterui continous I/O read!

                I have this exact issue, on multiple clients in my enterprise.

                VSE 8.7.0i

                Engine: 5400.1158, x32 and x64

                Dat: 6749.0000 (today's dat)

                Installed Patches: 1 (it doesn't say which)

                Windows 7 x64 SP1

                 

                Right after boot, the UdaterUI.exe begins reading the hard drive, non-stop, every second, forever.  Killing the process destabilizes the product, so that is not an option.  This is causing serious wear on my systems unnecessarily, which scales badly on 10,000's of systems.

                 

                A solution would be greatly appreciated.

                 

                Edit: Just updated to patch 4 (didn't realize I was so far behind).  No change, still doing it.

                 

                Message was edited by: macallen on 6/21/12 11:58:40 AM CDT
                • 5. Re: udaterui continous I/O read!
                  rmetzger

                  Hi macallen,

                   

                  Welcome to the forums.

                   

                  Wow, this thread was started over 2 years ago!

                   

                  Anyway, I am glad that you updated to at least patch 4 of VSE8.7i.

                   

                  You might try VSE8.8 P1. With 10,000 PCs I am assuming that you have ePO set up in your environment. You (or your network/security administrator) should consider the upgrade, testing in a limited environment and broadening the distribution in stages.

                   

                  It sounds like the McAfee Agent is trying to gather info on the system and get updates from it's defined server. If the agent is not up to date, it could be causing these problems. Though without more info, this is just speculation. What version of ePO are you using? Is this happening on all of your systems or just yours, or in a specific location??? How are the VSE updates configured? When did this start happening?

                   

                  You may want to update the Agent as well and see if that helps. Of course this will require matching the version(s) of ePO you are using.

                   

                  You may want to contact your McAfee Service Rep. for help with this, especially if you are experiencing issues with your system.

                   

                  Good luck,

                  Ron Metzger

                  • 6. Re: udaterui continous I/O read!

                    Hi,

                    We are facing same issue. Facing system performance issue while On demand scan is going on. CPU & RAM utilization is normal but I/Os are very high. We escalate the same with McAfee but not luck.

                     

                    Agent : 4.6.0.1694

                    McAfee Virus Scan + Anti Spyware ent. 8.8.0

                     

                    A solution would be greatly appreciated.

                     

                    Jatin Purohit

                    • 7. Re: udaterui continous I/O read!
                      rmetzger

                      Hi Jatin,

                       

                      Welcome to the forums.

                       

                      Well, I am not sure what is going on based on your description. With limited info, I would not know what to say, Yet.

                       

                      Is this high I/O new, or has this issue existed for a long while?

                       

                      If the high I/O is new, what do you believe has changed that may (or may not) have caused this change?

                       

                      You state the I/O is high, yet RAM and CPU is normal. What do you consider High I/O, and what is getting scanned when you see this high I/O?

                       

                      What is the settings that are Not the default settings?

                       

                      Using Task Manager, or better still, Process Explorer, which modules are showing as the cause of this High I/O?

                       

                      What is the schedule of Updates taking place, and when are the On Demand Scans scheduled to take place?

                       

                      If UdaterUI.exe is not the cause of this high i/o, maybe it would be a good idea to post this to a new / original post for more clear responses, as this original post started over 2 years ago. (Pretty much everything has changed in the interim.)

                       

                      Have you implemented the Best Practices Guidelines?

                      Here is a link to many helpful documents ( https://kc.mcafee.com/corporate/index?page=content&id=KB65944 ) Hot Topics.

                       

                      Thanks,

                      Ron Metzger

                      • 8. Re: udaterui continous I/O read!

                        Hello,

                        Maybe you could check your running services because on my laptop  when "SQL Server (SQLEXPRESS)"  service is running the UdaterUI.exe is using one cpu core to 100%.when it is not running it is quiet.

                        So maybe you have one service (maybe not SQL server) that makes Udaterui going wild.

                        I think the  SQL Server comes with a Microsoft "visual studio" installation.

                         

                        In my case

                        start -> control pannel -> Administrative tools -> Services > SQL Server (SQLEXPRESS) -> stop

                         

                        I am running virusscan enterprise 8.7i

                         

                         

                        I hope it helps

                         

                        Message was edited by: zarma on 12/18/12 7:12:04 AM CST