McAfee Total Protection, Memory leak in fwpkclnt.sys after update 11.09.2012

[Hayton]

Did anyone try either of the Microsoft HotFixes - for IPSec (http://support.microsoft.com/kb/976658) and WFP Callout Drivers (http://support.microsoft.com/kb/979223)?

Neither of those articles is recent, and Microsoft may well have modified the code in Windows to correct the underlying problems. However, both of those issues look as if they could apply here, so it might be worth asking in the relevant Microsoft forum. WFP callout drivers in particular are a likely candidate -

WFP callout drivers are usually used in third-party antivirus and firewall programs

With HotFixes, of course, you should only apply them if you have the underlying problem that they're meant to fix. That's why asking on a Microsoft forum about this might be a good idea.

[exbrit]

I would suggest an exercise here to check if all Microsoft Updates are installed and working OK.   It's possible that you may think you are up to date but something has corrupted said hotfixes.   If you install Belarc Advisor, which is always a useful tool to have around anyway, and let it run you can check the integrity of all your installed updates and if any are missing.  Scrolling down to the lowest part of it's results you'll see a list of all Windows Updates installed and there will be a flag against any that are broken.  At the very bottom you'll see this (click to magnify):

Any flagged in red should be located in Windows Update > Installed Updates by their KB number and immediately uninstalled.   Reboot if asked to.  Then poll Windows Update for updates and they should come back in.

It's a free download and available HERE

It can't harm your system.

.

Message was edited by: Ex_Brit on 25/09/12 8:37:04 EDT AM

[lotty]

All

I just received a call from the McAfee engineering team related to my posting / issue https://community.mcafee.com/thread/47463?start=60&tstart=0 which I think is the same issue.  He said the engineering team has a fix and this fix will require issuing a new build to the virus scan component. I pressed him for a release date etc but he had not information yet. He said he would call me back as soon as he has more information on the release date.  I will post if and when I get further information.

Regards

[Bobcat]

Hayton, both of those hotfixes are included in Win7 SP1.

[Hayton]

@bobcat,  when I looked at the dates I wondered if that was the case. Oh well, that's not the cause then. Let's hope Lotty's news about a pending fix also applies to this issue.

[lotty]

Following up on Bobcats point that new builds were out .. i installed, tested and confirmed that the new builds do NOT resolve .. see link below for my results

https://community.mcafee.com/message/257626

[csylvain]

I have McAfee Internet Security with Personal Firewall 12.6 (build 12.6.172) and SecurityCenter (build 11.6.434) and VirusScan (build 15.6.226) -- all of these should be the latest up-to-date versions.

I am experiencing exactly the same Nonpaged kernel memory pool inflation indicated with poolmon Tag "Fwpx" which is directly proportional to the rate of network traffic.  I have a Slingbox which has made this issue rather painful.  Nonpaged memory can go from 120MB after a fresh reboot to 1GB.  Once that large, hibernating the system takes forever...  I now keep an eye on it and reboot to clear out the cruft.

I am next going to dump all the IPSec support in Windows 7 in the hopes it make this bad situation better.

[csylvain]

hmm!  I do not seem to be able to easily dump IPSec support in Windows 7, nor can I easily dump the McAfee Firewall for the Windows Firewall without doing some uninstalling.  (I naturally suspect the McAfee firewall since the issue is network related)

Once I decide to start uninstalling, though, I am quite likely to dump McAfee altogether in favor of Microsoft Security Essentials.

[lotty]

From your description my guess as to root cause of you issue is this memory leak rather than firewall or IPSEC. This is a known issue with the McAfee virus component which is rumored to be fixed in a pending new build. The bug seems to be more pronounced on large I/O tasks.

[csylvain]

I'll agree.  The allocation rate goes from about 12/sec for "Fwpx" to 200/sec to 300/sec of 30kbyte allocations when I do over-the-network video streaming.  The inflation rate of the nonpaged pool becomes quite significant at that rate!  Even though it is only a moderate amount of network traffic (roughly 2Mbps).