Well, I have seen the following scenario:
- 3rd party application (hMail) configured to utilise scan64 to scan objects,every time a mail popped in, this spawned a process
You can cross reference your agent log (agent_machinename.log) with the windows event log to see if there is correlation between start of the scan64 process and a task being run by the McAfee Agent. If not then something else invokes the process (3rd Party most likely).
Thank's for your reply sbenedix
I have take a look at the agent log and the Windows event log. I have found nothing near the process stard time I have found using process explorer. I am preaty sure it is not an agent planned task. Maybe a 3rd party but if so, why would it use /UninstallMAS switch since it is used to remove anti- spyware module?
For me, it still look like someting went wrong with the upgrade to patch1
i'm starting noticing this on some of our machines (win2008r2 servers) the only "way" to "clean up" is reboot. this "issue" tend to be a memory leak problem.