9 Replies Latest reply: Sep 13, 2010 12:31 PM by dlogan RSS

    On Access Scan making things very slow

      We are finding on an increasing number of PCs in our network that having On-Access scan enabled in VirusScan 8.0i seems to make the PC extremely slow. Now I know that the scan will make things slower, that is understandable, but as soon as I disable on access scan on a machine it opens up a network drive in a second, compared to taking over 15 seconds to open it with on access scan enabled. Note that this is before even trying to open any files, this is just browsing a network drive. When actually trying to open a document from the network drive it takes a very long time to even begin responding... again as soon as I disable on access scan it all works perfectly fine. We are using EPO 3.6.1 and I thought that it did not scan network drives when using the default policy?
      Is there any solution to this as I do not really want to have to keep disabling on access scan to make the PCs usable. The PCs themselves are not bad spec, one example is a 2.8 Ghz P4 with 1.5 GB of RAM.

      Any ideas?

        • 1. RE: On Access Scan making things very slow
          1. try VSE 8.7i. P1. It's much faster than 8.0.
          2. try disabling OAS when writing to disk.
          3. open a case with mcafee, i already done that. it's at tier II now, maybe they can speed things up. have got the same specs like you.
          • 2. RE: On Access Scan making things very slow
            Thanks, just trying to track down our current grant number now so that I can try the newer versions of VirusScan :)

            Surely disabling OAS when writing to disk will not affect just browsing a network drive as nothing is getting written to the disk when you do that?

            • 3. RE: On Access Scan making things very slow
              do you have the scan network drives option selected in the VSE policy?
              what patch/engine/DAT and hotfix level of vse 8.0?
              • 4. RE: On Access Scan making things very slow

                When I look at the properties in EPO on all the PCs that have had this problem they all say hotfix version 11 and all have a DAT of 5735, the szServicePack attribute is blank for all of them.
                • 5. RE: On Access Scan making things very slow
                  vse 8.0 is XXXX without minimum patch 15 better to be at patch 18
                  Still then its XXXX compared to vse 8.7 patch 1

                  you really ned to look at updateing

                  VirusScan Enterprise 8.0i will now reach End of Life on 31 March, 2010
                  • 6. RE: On Access Scan making things very slow
                    I am looking at updating but still doing a bit of research on how exactly we go about deploying the latest version of VirusScan and whether or not there are any problems with it. Same for the new version of EPO.
                    See my other thread: http://community.mcafee.com/showthread.php?t=233708

                    • 7. RE: On Access Scan making things very slow

                      I only see patch 16 available for download under our grant number. Downloading now.
                      • 8. RE: On Access Scan making things very slow
                        lol yes sorry typo
                        • 9. Re: On Access Scan making things very slow

                          The default CPU usage limit for McAfee On-Access scans is 30 percent. However, when McAfee scans a network drive the antivirus is forced to use a third-party driver that does not respect the 30 percent limitation.


                          Therefore, if you permit McAfee to scan the network drives, McAfee will use all available CPU time to scan as much of the network as the computer has access to.


                          McAfee on the network servers already scans the network drives in real time. The network drives derive no additional benefit from being scanned by workstations.


                          To disable scanning of network drives by a workstation, follow this procedure from the affected workstation:


                          1. Right-click the McAfee icon in the system tray

                          2. Select VirusScan Console from the popup menu

                          3. Right-click On Access Scanner in the VirusScan Console

                          4. Choose Properties from the popup menu

                          5. Locate a blue CD or DVD icon in the long vertical window on the left side of the On-Access Scan Properties window, and click the CD icon

                          6. On the top right of the On-Access Scan Properties window, click the Scan Items tab

                          7. Clear the checkmark from "On network drives" if it is present. This will prevent this workstation from scanning network places (as in My Network Places in Windows Explorer). However, mapped network drives must be specifically excluded.

                          8. On the top right of the On-Access Scan Properties window, click the Exclusions tab

                          9. Click the Exclusions… button in the What not to scan area

                          10. In the Set Exclusions window, click Add…

                          11. Click Browse…

                          12. Click My Computer in the Browse for Folder window

                          13. Select a mapped network drive. You will need to add each mapped drive to the exclusion list individually. Even though you have cleared the network drives from the Scan Items tab, mapped network drives will still be scanned if you do not specifically exclude them. Overlapping mapped drives will be scanned for each time the drive is mapped.

                          14. Click okay when you have a mapped drive selected. This will return you to the Add Exclusion Item window.

                          15. Check off the Also Exclude Subfolders checkbox. This box must be checked since mapped drives generally have the bulk of the data organized in subfolders.

                          16. Click okay

                          17. Verify that the mapped drive is listed in the Set Exclusions window

                          18. Repeat steps 10 to 17 until all of your mapped network drives are excluded from virus scans

                          19. Click okay on the Set Exclusions window

                          20. Click okay on On-Access Scan Properties

                          21. Close the VirusScan Console



                          Message was edited by: dlogan on 9/13/10 12:31:53 PM CDT