6 Replies Latest reply on Mar 22, 2010 11:11 AM by jwilker

    VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007

      I have VSE 8.7i P2 with Scan Engine 5400 installed on my WinXP SP3 PC. Everytime VSE performs a DAT update, I noticed my CPU spikes to 100% usage and it is between McShield.exe and EngineServer.exe. When DAT update completes, CPU drops back down. During the DAT Update, some applications become unresponsive, such as Firefox and Outlook. Is this something others are experiencing as well?

      Also during the DAT update, while my Outlook 2007 client goes unresponsive, after the update completes, Outlook still remains unresponsive and I end up having to terminate the Outlook process. If I turn off On-Delivery E-mail Scan, then Outlook only seems sluggish during the DAT update but doesn't completely lock up. Again, anyone else having the same problem?

      Thanks!
        • 1. RE: VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007
          rmetzger
          Well this problem has been discussed at great length. I posted here: "On-access scanner Scan processes on enable" which might help in your case.

          I might not recommend turning off the 'On-Delivery E-mail Scan' feature as this may expose the client to many issues.

          Let us know if this helps.
          Ron Metzger
          • 2. RE: VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007


            Hi Ron,

            That thread was one of the first I viewed. happy I don't have the Scan Processes on Enable option enabled on my PC and in my ePO settings. I see others reported seeing the performance bog down even with the setting disabled.

            I agree that On-Delivery E-mail Scan should not be disabled because it has saved me on many occasions. Unfortunately after a DAT update completes, my Outlook 2007 client is no longer responsive and I end up having to terminate the process in order to get it working again. With the On-Delivery disabled, my Outlook freezes up during the DAT update, but is usable after DAT update completes. I'm going to try this on a couple more test PCs to see if this is a one off or an issue that affects our other PCs.

            If I rolled this upgrade out to our client PCs as is, I am sure I'll have an angry mob in front of my office. wink
            • 3. Re: RE: VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007
              jwilker

              The link above didn't work for me.  We are having the same issue but with all of our Database Servers causing the agents to be unable to connect to them.  I've opened up a ticket with support.

              • 4. Re: RE: VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007
                rmetzger

                jwilker wrote:

                 

                The link above didn't work for me.  We are having the same issue but with all of our Database Servers causing the agents to be unable to connect to them.  I've opened up a ticket with support.

                Hi,

                 

                Try: https://kc.mcafee.com/corporate/index?page=content&id=kb60651

                 

                And: https://kc.mcafee.com/corporate/index?page=content&id=KB53690&pmv=print

                 

                 

                Quoted below are some work-arounds for several performance issues and settings. Many of the settings were originally for VSE v8.5i and older McAfee Agents, but still apply in v8.7i and newer Agents.

                REGEDIT4

                ;; see https://knowledge.mcafee.com/article/474/615293_f.SAL_Public.html
                ;;
                ;; W3WP.Exe shows high CPU usage after installing VirusScan Enterprise 8.5i
                ;;
                ;;
                ;;  Environment
                ;;
                ;; McAfee VirusScan Enterprise 8.5i
                ;;
                ;;  Problem
                ;;
                ;; W3WP.exe shows high CPU usage after VirusScan Enterprise 8.5i is installed.
                ;;
                ;;  Change or Cause
                ;;
                ;; VirusScan Enterprise 8.5i introduced a change in the way processes are
                ;; scanned in memory.
                ;;
                ;; W3WP.exe spawns multiple child processes. Each child process is scanned
                ;; prior to execution, potentially introducing a performance issue.
                ;;
                ;;
                ;;  Solution
                ;;
                ;; IMPORTANT: This article contains information about modifying the registry.
                ;; Before you modify the registry, make sure to back it up and make sure that
                ;; you understand how to restore the registry if a problem occurs. For
                ;; information about how to back up, restore, and edit the registry, see the
                ;; following Microsoft Knowledge Base article:
                ;;    http://support.microsoft.com/kb/256986.
                ;;
                ;;   1. Click Start, Programs, McAfee, VirusScan Console.
                ;;   2. Double-click Access Protection, deselect Enable Access Protection,
                ;;      then click OK.
                ;;   3. Click Start, Run, type regedit and click OK.
                ;;   4. Navigate to the following registry key:
                ;;      [HKEY_LOCAL_MACHINE\Software\McAfee\VSCore\On Access Scanner\McShield\Configuration]
                ;;   5. In the right pane, right-click an empty space and select New,
                ;;      DWORD Value.
                ;;   6. Name the new value ScanMemoryOfNewProcesses and press ENTER.
                ;;   7. Double-click ScanMemoryOfNewProcesses and set the Value data to 0
                ;;      (zero).
                ;;   8. Click OK and exit the registry editor.
                ;;   9. Click Start, Programs, McAfee, VirusScan Console.
                ;;  10. Double-click Access Protection, select Enable Access Protection., then
                ;;      click OK.
                ;;  11. Restart the system.

                    [HKEY_LOCAL_MACHINE\Software\McAfee\VSCore\On Access Scanner\McShield\Configuration]
                    "ScanMemoryOfNewProcesses"=dword:00000000
                ;;  "ScanMemoryOfNewProcesses"=-
                ;; 
                ;; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                ;; see http://forums.mcafeehelp.com/showthread.php?t=221578
                ;;  'McScript.exe eating CPU cycles for several mins'
                ;;  1. Restart the system to activate.
                ;; Solution 1 - Create a registry key LowerWorkingThreadPriority as a
                ;; DWORD and set the value to 1.
                ;;  'CPU usage spikes during policy enforcement and a DAT update'
                ;; Solution:
                ;;   A noticeable performance improvement is found when using McAfee Agent 4.0
                ;;   and ePolicy Orchestrator 4.0 server because ePO 4.0 compiles the policy
                ;;   before sending it to the agent.
                ;;
                ;; Workaround:
                ;; Solution 1 - "LowerWorkingThreadPriority"
                ;; 1. Click Start, Run, type regedit, then click OK.
                ;; 2. Navigate to and select the following registry key:
                ;;    [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
                ;; 3. In the right-hand pane, right-click a blank space and select New, DWORD
                ;;    Value.
                ;; 4. For the name, type LowerWorkingThreadPriority and press ENTER.
                ;; 5. Right-click LowerWorkingThreadPriority and and select Modify.
                ;; 6. In the Value data field type 1, then click OK.
                ;; 7. Click Registry, Exit.
                ;; 8. Restart the McAfee Framework Service.
                ;;
                ;;  Only implement Solution 2 if the previous solution is not sufficient to
                ;;  reduce the CPU usage sufficiently during a policy enforcement and update.
                ;;  Solution 2 - Disable the NoUpdateUI via the registry to reduce the CPU
                ;;  usage:
                ;; 1. Click Start, Run, type regedit, then click OK.
                ;; 2. Navigate to the following registry location:
                ;;    [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]
                ;; 3. Right-click on NoUpdaterUI and select Modify.
                ;; 4. In the Value Data field change the value to 1, then click OK.
                ;; 5. Click Registry, Exit.
                ;; 6. Restart your computer.
                ;;
                ;; see https://kc.mcafee.com/corporate/index?page=content&id=KB53690&pmv=print
                ;; Policy Enforcement Interferes with Real-Time Application
                ;;
                ;; Corporate KnowledgeBase ID:            KB66971
                ;; Published:            October 15, 2009
                ;;
                ;; Environment
                ;; Summary
                ;; CPU spikes that occur during a policy enforcement may interfere with the
                ;; performance of real-time applications. When no other applications are
                ;; being utilized on the client, McAfee Agent 4.5 utilizes the available CPU
                ;; to complete its activity, in this case policy enforcement. This is normal
                ;; and expected. If other applications are being utilized during the policy
                ;; enforcment, or if they start during a policy enforcement, McAfee Agent 4.5
                ;; will yield the CPU to the higher priority process. However, there can be
                ;; momentary spikes in CPU during this time.
                ;;
                ;; Policy enforcement is a CPU intensive function, as is running most real-
                ;; time applications. McAfee Agent 4.5 has improved performance during
                ;; policy enforcement, and in many cases interference with other applications
                ;; is not noticed at the end point. While performance has improved, some
                ;; degradation may be noticed depending on the nature of the application.
                ;; Because of this, voice degradation might be noticed when using products
                ;; such as Voice over IP software. In situations where interference does
                ;; occur, the default policy interval of five minutes might not be ideal.
                ;;
                ;; Solution
                ;; McAfee is investigating this issue. As a temporary measure, implement the
                ;; workaround shown below.
                ;;
                ;; Workaround
                ;; CAUTION: This article contains information about opening or modifying the
                ;; registry.
                ;;
                ;;    * The following information is intended for System Administrators.
                ;;      Registry modifications are irreversible and could cause system failure
                ;;      if done incorrectly.
                ;;    * Before proceeding, McAfee strongly recommends backing up your registry
                ;;      and understanding the restore process. For more information,
                ;;      see: http://support.microsoft.com/kb/256986
                ;;    * Do not run a .REG file that is not confirmed to be a genuine registry
                ;;      import file.
                ;;
                ;;    1. Increase the length of the policy enforcement interval. The default
                ;;       is five minutes. Increasing the length of time might make
                ;;       noticeable interference less frequent.
                ;;    2. Implement a lower thread and lower process priority for McAfee Agent
                ;;       functions on clients:
                ;;       [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
                ;;    3. Under the Framework registry key, do the following:
                ;;           * Change the SetProcessPriority DWord value to 1.
                ;;             This lowers the process priority.
                ;;           * Change the LowerWorkingThreadPriority DWord value to 1.
                ;;             This lowers the worker thread priority to below normal.

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
                    "LowerWorkingThreadPriority"=dword:00000001
                ;;  "LowerWorkingThreadPriority"=-
                    "SetProcessPriority"=dword:00000001
                ;;  "SetProcessPriority"=-

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]
                ;;  "NoUpdaterUI"=dword:00000001
                    "NoUpdaterUI"=-

                ;; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                ;;  see https://kc.mcafee.com/corporate/index?page=content&id=kb60651
                ;;
                ;;  ScanProcessesOnEnable;
                ;;  Should be Off under normal conditions. Having it on can cause
                ;;  additional stress to the system, causing McShield.exe to what appears
                ;;  to be random high use of the CPU. It should be On only for PCs where
                ;;  Security is paramount and performance is not even considered.
                ;; 
                    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
                    "ScanProcessesOnEnable"=dword:00000000
                    "ScanMemoryOfNewProcesses"=dword:00000000

                Hopefully this helps. Let us know how you are doing.

                 

                Thanks,

                Ron Metzger

                • 5. Re: RE: VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007

                  Patch 3 is out already.

                   

                  I suggest you to install that and check if it helps in your quest to check the High CPU usage.

                   

                  Thank you

                   

                  Sameer

                  • 6. Re: RE: VSE 8.7 DAT Update Causes High CPU and Locks Up Outlook 2007
                    jwilker

                    Thanks for the post.  I installed Patch 3 and our problem went away.  I did notice in the release notes that the patch fixed an issue with 64 bit systems not handling wildcards correctly.  For others having issues with high CPU, do a google search for safe McAfee exclusions, and McAfee's site for wildcards.

                    --Joseph Wilker

                    Technology Support Specialist III