Here tonight I at last got my computer to work, maybe I was pressing ok for replacing my system files when the prompt was comming. My computer was locking after boot only the mouse was able to run over the screen. In safe mode I uninstall mcafee and now I have installed SP3 and my computer seems to run. I don't thing I try McCrappy again I will not take that chance, but I will still watch this page, I like to see a solution to the problem.
things have improved a lot for me (compare to my post on Sep 12, 2011 4:20 PM).
I am now on newer version SecurityCenter 11.0.586, else unchanged WinXP Pro SP3 with all patches, McAfee AntiVirus Plus 15.0.291, and no other security / malware checking software.
For the last 3 days:
- no more winlogon.exe excessive processor or memory usage, and also number of 'I/O Write Bytes' is now low.
- no more "The protected system file xxx could not be verified as valid because Windows File Protection is terminating" entties in Event Log since 9/14 (note that I completely shutdown my laptop each evening).
- A scheduled scan over 60 GB (97,000 files) ran through in 6 hours. (But I had my large VMware virtual disk and encrypted container files excluded... by excluding one complete drive and one complete folder with all its subdirectories on another drive, not the way I want it to be.)
If now maybe the file/folder exclusion option of Scheduled Scan could be improved, to either allow multi-selection of files, or folder exclusion *without* also excluding all its subfolders, or both!
Add that as an idea in the ideas forum part of the communityMessage was edited by: Peacekeeper on 21/09/11 7:16:58 AM
Where are the Terms and Conditions for McAfee Internet Security? I want to read them.
Not sure, I assume you want a mission statement but their site so far as I see does not have Terms and conditions maybe 1 of the mcafee staff following this can comment.
Not interested in a 'mission statement' - it's obvious McAfee don't have one. I want to read the Terms and Conditions for McAfee Internet Security.
I'm still having the issue. Winlogon.exe and the sfc_os.dll thread within (according to Process Explorer) are still doing their thing on the reboot/start-up following a McAfee software update or DAT update. Not sure if I should be relieved or worried that approaching four months into this, the investigator is finding the same leads I did over three months ago. I did provide detailed descriptions of what was happening and where to look to see what I was seeing. Regardless, hopefully they'll be close to solving it now.
The above screenshot was taken during a scan with MalwareBytes Anti-Malware. As you can see, it's the properties of winlogon.exe using Process Explorer. Notice what's using the CPU? sfc_os.dll. During that eight-minute scan (normally it's only three-minutes when McAfee hasn't been updated the previous boot) and sfc_os.dll activity, 1,778 files (258 mb) were accessed in my dllcache. When this occurs, each file is accessed and replaced with a "<filename>.<extension>.new" version and the "old" one is removed. This likely triggers System Restore to backup each "new" system file in the dllcache since the OS thinks that version is new and updated. Those 1,778 files account for nearly 75% of files in my dllcache. This activity isn't exclusive to when MBAM is running. It occurs on boot following a McAfee update then eases and picks up again if you look at system files or scan something. This occurred even without MBAM present so it's not incompatibility. It's not any combination of McAfee install with or without MBAM present at the time. Only occurs with McAfee Security Center 11.0/VirusScan 15.0.
Enmerkar, it might be better to look at the software license agreement for your McAfee software. If I remember correctly, like most and if not all software licenses, it waives liability for any damages to your system caused by the software. The burden would likely be on us to prove damages occurred anyway. You have to agree to it to install. Standard stuff anyway. Can't do much about it except never install software, you know?Message was edited by: yippeekaiyay on 9/20/11 11:31:18 PM CDT
In the midst of all of this discussion, am wondering if some attempt at a “patch” has been made? Have not had any WFP warnings since 18/9 & (most unusual) have not had to reinstall my Network Adapter for over a week. Since all of this started months ago, I have had to reinstall my Network Adapter 36 times. It is the one file consistently erroneously affected by this ongoing WFP nonsense. I was “astonished” that the McAfee update this morning that required a restart caused no problems. Has something/anything changed of which we have not been informed?
My current versions (all reflecting Last Update2011-09-20) are:
Security Centre 11.0.586
Virus Scan 15.0.291
Is there something we should know? (I’d like to be grateful but only if it is by design & not accident, i.e. no more surprises). Pls & Tx for any info. GB.
The burden would likely be on us to prove damages occurred anyway. You have to agree to it to install. Standard stuff anyway. Can't do much about it except never install software, you know?
True. Also, if one really want to avoid any sort of software problem then don't use Windows itself. It always had and probably always will have issues of its own. For example, IE7,8,9 have many issues. So, don't be surprised to find bugs in McAfee. What's disturbing and not acceptable though is the length of time it takes to resolve some of them.
After seing a few other posters were doing better with the new version of the Security Center, I became daring and did a manual update (which I can do in protected mode).
The reboot after the update resulted in the now well-known start-up screen freeze. However, after rebooting in safe mode, I did an nvidia driver reinstall - and the reboot after that DID NOT FREEZE!!!
It was not a problem, then, to change from VGA mode to high resolution.
IT WORKS!!! (but system is much slower than usual)
Only problem (?) now is a new event message (dating from today and not seen previously with svchost.exe):
event ID 516 from source mfehidk :
Process **\SVCHOST.exe pid (1384) contains a certified but untrustworthy content. The execution of a preferred Operation with a McAfee-Driver, however, was permitted.
Any ideas??? Thanks in advance!
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: