1 Reply Latest reply on Sep 13, 2012 7:56 AM by Pmaquoi

    firesvc.exe and mfefirek.sys CPU load issues with HIPS 8 Patch 2

    JeffGerard

      I am wondering if anyone else is having issues with P2 for HIPS8?

       

      I have tried it on 4 different Dell laptops:

      1 x E6520 with custom Win7 x64 install

      2 x E6520 made from same image based on original Dell Win7 x64 install

      1 x E6500 running custom Win7 x64 installation

       

      Basically what happens is the patch installs fine, and machine will reboot and operate fine as long as you remain on a wired network.

      Once you switch to a wireless network these issues start.

      Based on my testing, there seems to be some collaboration between auto-disabling wireless upon wired connect, band preference, and system standby.

       

      I still have yet to come up with any absolute way to reproduce the issue but I can almost always make it happen when switching enough times from wired to wireless to wired to wireless etc.

       

      When the issue occurs, usually firesvc.exe begins to hog CPU. On my quad-core i7, it averages 12-13% cpu and the machine begins to run hot. On my older E6500 with dual-core, it hogs at 50%. Sometimes, the System process shows 12-13% CPU and if you open it up in Process Explorer, you'll see that the offending process is mfefirek.sys. Again, the machine will get hot. Sometimes it's just firesvc.exe and others it's just mfefirek.sys, and others it's both (at which cpu usage doubles)  In all cases, when this happens, I can still ping and run certain network services, but web browsing stops working along with https and possibly other services.

       

      The only way to reover at this point is to reboot. If I am at home and rebooting back to a wired network, I noticed that I could only get things to work if I disabled the physical wireless swtich *and* turned off band preference (ie, 5GHz vs 2.4GHz) in the nic settings.

       

      I plan to open a case with McAfee but don't have the time to do any troubleshooting at this point in time. I'm more just curious if any others are experiencing same or similar.

       

      Cheers

       

      /Jeff