1 2 Previous Next 18 Replies Latest reply on May 28, 2013 1:39 PM by ron.sokol

    VIRUSSCAN 8.8---mcshield.exe eats up CPU

      Hey folks,

      have you noticed that for the new Virusscan 8.8 ,mcshield.exe(on-access scanner) spikes up CPU usage.what might be the cause?

        • 1. VIRUSSCAN 8.8---mcshield.exe eats up CPU
          wwarren

          It's a change in design from prior versions, and reduces our memory footprint.

           

          You'll notice this "McShield eats up CPU" behavior when an on-demand scan is running.

          Where possible, we utilizing the existing DAT/Engine that's already loaded in our McShield process (the on access scanner). So, when you say "Go On Demand Scan!" you're actually going to see work being done by our on access scanner .

           

          It's not something to be alarmed over, unless you can't account for the reasons why it might be busy - then it should be investigated, because our scanner processes only use CPU when there's clearly something to do; e.g. an ODS, some file activity from another process that needs scanning...

          • 2. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
            alexander_h

            You should create extensions for all your friquently used software .

            • 3. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
              wwarren

              alexander_h wrote:

               

              You should create extensions for all your friquently used software .


              If you mean "exclusions for all your frequently used software" that's a bad idea. A really bad idea.

              Frequently used software does not equate to "safe software and will never be infected".

               

              Any exclusion that is implemented should be viewed with an eye of scrutiny, and always with the guiding thought of "How can I make this exclusion more specific?" so that you're not punching gaping holes in your AV coverage.

              • 4. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
                alexander_h

                Sorry, yes exclusions.

                You are absolutly right, for example:

                You have BackUp Exec , Exchange on the same server in order their functionality to be as it should be we have to create exclusions.

                if we don't create sych an exclusions then the operability of the software is interupted.

                How should we proceed in such situation???

                if you call customer support the first thing they will ask you is for the created exclusions.

                • 5. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU

                  It will spike the CPU if you install it on an EPO server.

                  You need to exclude **\DB\Events\" and all subdirectories or it will bring your EPO server to a crawl.

                  • 6. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
                    wwarren

                    alexander_h wrote:

                     

                    ...

                    if we don't create sych an exclusions then the operability of the software is interupted.

                    How should we proceed in such situation???

                    if you call customer support the first thing they will ask you is for the created exclusions.


                    Exclusions can be necessary, absolutely. The advice here is, if you have to create an exclusion make it as specific as you possibly can.

                    Adhere to the guiding thought "How can I make this exclusion more specific?" so that you're not punching gaping holes in your AV coverage.

                     

                    For example -

                    Backup Exec and Exchange on the same server, exclusions are required so their functionality is unhindered.

                    That's fine.

                    But does the exclusion have to apply to every process that's running on the system, or just to Backup Exec's process, or to a specific Exchange process?

                    This is a perfect scenario for taking advantage of the scanning profiles we make available in the product.

                    Create the exclusion(s) but only apply them to the processes that need that exclusion. That way, if any other process tries to write malware into those excluded folders they will still be scanned. And the work being done by Backup Exec or Exchange will not be scanned.

                     

                    The Hi/Low/Default scanning profiles are a product feature that is often unused, perhaps for simplicity sake, but it's wise to take a little time to understand this feature and how it can work for you, so that you can ensure your AV coverage is optimal.

                    • 7. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
                      alexander_h

                      i think that we are talking about same thing but with different words, i agree with you.

                      • 8. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
                        metalhead

                        Hi wwaren,

                         

                        could you please describe me how the ODS CPU priority (set in the task settings) works on the already loaded and used mcshield.exe process ?

                         

                        E.g. the already loaded McShield.exe process runs with "Normal" WIndows priority. If this process is used by scan32/64.exe it makes the process priority setting within the ODS task useless ... or not ?

                         

                        Thanks Tom

                        • 9. Re: VIRUSSCAN 8.8---mcshield.exe eats up CPU
                          wwarren

                          metalhead wrote:

                           

                          Hi wwaren,

                           

                          could you please describe me how the ODS CPU priority (set in the task settings) works on the already loaded and used mcshield.exe process ?

                           

                          E.g. the already loaded McShield.exe process runs with "Normal" WIndows priority. If this process is used by scan32/64.exe it makes the process priority setting within the ODS task useless ... or not ?

                           

                          Thanks Tom

                          McShield threads have a "normal" base thread priority, that's true. But there's nothing stopping it from setting the priority of a scan thread (created for serving ODS scan requests) to be a lower priority.

                          1 2 Previous Next