2 Replies Latest reply on Aug 13, 2010 7:42 AM by 0123

    VirusScan and Web Apps

      *sigh*

      I'm thinking that I'm not the only AV admin out there whose number is on speed dial with web app developers/users.

      Here's an exerpt from an actual email I received:

       

      I’m  getting reports from our user base that they are seeing issues with  their Java based web application performing really slowly… i.e. page  response of 4-5 seconds taking 3-5 times longer…

       

      When I checked, it appears that McAfee on-access scanner is taking anywhere from 35-95% cpu for each web page call…

       

      I've  created a separate policy for Developers and added the exceptions based  on a couple threads I've read here. Disabled scriptscan, .JAR files,  .EAR files, *.class.  But it doesn't seem to help at all.  I had the  group run ProcMon while accessing their webapp which I'm still trying to  sort through.  It's only a minute, but for about 8-10 seconds McShield  makes a TON queries and ReadFile to the following, over and overa and  over again.

       

      Mcshield.exeRegQueryValueHKLM\SOFTWARE\McAfee\VSCore\NVP\...

      McShield.exe ReadFile C:\Program Files\Common Files\McAfee\Engine\mferuntime.dat

       

      Is that normal?  Like I said, I'm still trying to sort through the ProcMon log, but I wasn't sure what others are doing or if you can offer any advice for this user group.

        • 1. Re: VirusScan and Web Apps
          jmcleish

          not at work- so can't check exact settings- but uncheck the box to scan compressed /or zip files in on-access scanner. Java files are seen as compressed so if you uncheck this then it should improve performance for java apps.

           

          Normal compressed files such as cabs etc should scan once expanded so you don't lose any functionality.

           

          here's the KB id:

           

          Corporate KnowledgeBase
          Slow performance with Java-based applications

          Corporate KnowledgeBase ID:    KB58727

           

          Jane

           

           

          Message was edited by: jmcleish on 06/08/10 06:48:37 CDT
          • 2. Re: VirusScan and Web Apps

            it actually just ended up being scriptscan.  once I disabled that it was all good.

             

            Thanks!