Identification Required for subsequent action, possible malware or McAfee wrongful doing

[pedroxavi]

Hello everyone,

I've been noticing on daily basis that, some reason(by then yet to identify) my computer disk activity was constantly on 100% without the Process Manager/Task Manager could explain why it was doing so.

I used an old program I had a few years back to try and understand who or what was writing on my disk without me knowing.

The program is called DKHardDrive-Light, with it, we can keep track on 1 or all partitions/disks, what is being written every second and which file was written, either by being Changed/Created/Deleted.

I then realized that it was McAfee, specially MPF(McAfee Personal Firewall). I could sent a JPG with the ScreenShot of it, if necessary and if I'm allowed to off course.

But for the time being, I can write here the few lines that it repeats every second for hours, like it is doing at the moment actually.

27/11/2013 18:38:13 - Created - C:\ProgramData\McAfee\MPF\Data\log.edb-journal

27/11/2013 18:38:13 - Changed - C:\ProgramData\McAfee\MPF\Data\log.edb-journal

27/11/2013 18:38:14 - Changed - C:\ProgramData\McAfee\MPF\Data\log.edb

27/11/2013 18:38:14 - Deleted - C:\ProgramData\McAfee\MPF\Data\log.edb

27/11/2013 18:38:15 - Created - C:\ProgramData\McAfee\MPF\Data\log.edb-journal

27/11/2013 18:38:15 - Changed - C:\ProgramData\McAfee\MPF\Data\log.edb-journal

27/11/2013 18:38:16 - Changed - C:\ProgramData\McAfee\MPF\Data\log.edb

27/11/2013 18:38:16 - Deleted - C:\ProgramData\McAfee\MPF\Data\log.edb

These are the 4 activities that happen with each second that passes, they repeat themselves in this order. It creates a file, changes, changes again to a different name and deletes it entirely, restarting the same process in a fraction of 2 seconds.

Can someone tell me about this? Because its stalling my computer, every game or program that I run, needs to access the HardDrive and it being funneled to this bizzar happening..

Best Regard,

Xavi

Portugal

McAfee Total Protection 2014 3PCs - HomeUser

Message was edited by: pedroxavi on 11/27/13 12:54:07 PM CST

[exbrit]

This is more a firewall issue so have moved it there.

That's the firewall logs being constantly created and old ones being deleted.  The actual folder shouldn't be more than a few kb's size and should not be interfering with anything.

If a process is occupying 100% of CPU for any length of time then there is something wrong - either the process is malicious or the programme it is connected with perhaps needs full permission in firewall settings?

Check for malware using Stinger, Malwarebytes Free and maybe also AdwCleaner, all linked in the last link in my signature below to make sure you are OK.

Then run the McAfee Virtual technician to make sure your software is OK:  http://mvt.mcafee.com/

If a problem continues then maybe the game or whatever it is needs more settings changed, but best consult that software's website for advice on that, or contact Technical Support.  

It's free by phone or online chat and linked under Useful Links at the top of this page.

.

Message was edited by: Ex_Brit on 27/11/13 2:53:46 EST PM

[pedroxavi]

Hello X_Brit

Thanks for the quick reply to my post.

You said 100% of the CPU, but the CPU is quiet all the time, doesn't bug him whatsoever, the Disk Activity is the one allways at 99/100%, which makes the read/write permissions for other programs that I choose to run, a little hard to deviate the bandwith to them, McAfee is consuming it all, if we can put it like this.

I notice also that, if I manually stop the McAfee firewall for any time, doesn't matter, the Disk Activity drops instantly from 100 to 0, but as soon as I start it again, it goes 30-60-100% in a matter of 5 seconds. The correlation seams about right in terms of firewall-logs, if I kill the firewall the logging stops, if reinitiated, it obviously restarts the log writting.

The all create-change-delete sequence eventually stops on itself, but it takes long hours doing so, and it stops on itself without any action I might do on the computer at any given time. I can stare at the DKHardDrive constant log and then suprise, McAfee decided to stop. So, I recon it has nothing to do with the user's actions, its simply of process that he decided to start and utherly stop.

You mentioned "malicious process". You're referring with the legitimate McAfee log-writting process or something else interfering with it and causing it abnormaly write logs when he actually didn't have to? Being the malicious process the external factor off course

Best Regards,

Xavi

[Hayton]

How many entries have you got in the McAfee Security Center Security History for the past 24  hours, and which category of entry occurs most often?

[pedroxavi]

Hello Hayton

Checking it now, it says Please Wait, gona wait on it

Replying when I got your answer

Best Regards,

Xavi

[pedroxavi]

Meanwhile, I tried Stinger, nothing, got 0 hits, just tried MalwareBytes and got 12 hits, posting JPG

Message was edited by: pedroxavi on 11/27/13 2:53:02 PM CST

[pedroxavi]

Its taking way to long (I think) to present me the results of the History, its spinning the bars and sayin Please Wait.

How long this usually take?

[Hayton]

Delete everything Malwarebytes found.

http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/pupoptionalconduit/b...

That appears to be a Malwarebytes detection for Search Conduit. If Malwarebytes will not eliminate it you can seek assistance in the Malwarebytes Forum at http://forums.malwarebytes.org/
Or see the following free removal guide from Malwaretips: http://malwaretips.com/blogs/remove-conduit-search-virus/

[Hayton]

This is a reply about Security History -

McAfee Security History always takes a long time to display. This is what I was testing for : the more entries in Security History the longer it takes. I'm wondering why there is all that firewall log activity : is it the case that so many entries are going into the log that it needs to create a new one?

[exbrit]

Hmm, maybe I should have left this in Malware Discussions.  Malwarebytes seems to have found a possible source for your hard drive activity.  However Hayton has everything in hand so I'll leave it to him.