cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
oagard
Level 7
Report Inappropriate Content
Message 61 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

I agree with everything the "customer_is_always_right" said

McAfee lately has given immense headaches who have purchased their products.

A person buy McAfee products, which are nothing cheap, and still have all this problems.

I am at three months with this problem "https://community.mcafee.com/thread/64047" and after I sent several logs as they have asked me, I see no solution in sight, unless I move to another enterprise security software.

I am a customer of McAfee to about twenty years, and have never seen McAfee in the state it is currently in, with so many problems in their security software.

It's time for someone to write to management's attention from McAfee and give knowledge of what is happening.

Does not admit that a customer who paid for the software, start to have problems with this software and then waiting months is that the company solve the problem.

I'm also a bit tired of seeing here in the Forum McAfee, always tell clients to uninstall and install the McAfee software several times, as if the client had nothing else to do in life than walking to install and uninstall software.

I certainly hope that McAfee quickly change the market strategy, or will lose huge customers globally.

Greetings,

Rui Porto  -  (PORTUGAL)

Hayton
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 62 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

Another McAfee update today has highlighted the problem with mcshield.exe (RTS). I must say again that I no longer have the symptoms of continual floppy-drive access : something I did at the time that problem first appeared managed to cure it.

No, this is mcshield running wild on the old Pentium P4 XP machine (yes, yes, I know, be patient).

The activity I observe on this machine does not happen on the newer machine running Windows 7, which is now the one I am using for most activities. It is obvious that there is something in the code which does not run well on older hardware and software.

On the XP machine there were no programs running, but mcshield was taking between 50% and 100% of cpu time. I observed this for nearly an hour, and the activity did not subside during all of that time.

Possibly the update requires a reboot, but if that is the case why isn't there a notification to say so?

mcshield hot nothing running.PNG

mcshield running hot.PNG

Re: Latest update causing excessive CPU and Floppy Drive activity

Hayton I will check my XP box after our moderator call.

Customer_is always_ Right There is a fix isn testing it fixed my issue so needs QAing. RE disabling the floppy that was a suggestion to use till the fix comes that or put a floppy in the drive. Yes floppy drives are old tech I have 2 still 1 disconnected the other in a win 7 PC works fine not that I use it.

Out of interest do you use them ?

Osgard yes it has taken ages for your issue maily as there are only a few users with it and Mcafee cannot themselves reproduce the issue. Does it still happen with Firefox 28?

oagard
Level 7
Report Inappropriate Content
Message 64 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

Hello Peacekeeper,

My nick is "oagard" and not "Osgard"

Yes with version 28.0 of Firefox continues all the same on all my computers, slow as snail.

Moreover I have heard that version 29.0 of Firefox comes around with some modifications, which are not be to the liking of many people using Firefox.

I've been seeing some of these changes on the Internet, and I think Firefox will stay with me for the version 28, we'll see.

greetings,

Rui Porto

Hayton
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 65 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

As noted on the call tonight, this mcshield activity (above) has a couple of interesting aspects.

1.  It began right after a McAfee update.

2. It continued for an hour, with no programs/applications running other than Task Manager and Process Explorer.

3. When I closed Process Explorer, the CPU activity level dropped right down.

4. After a reboot (with a chkdsk) I left things to stabilise for 15 minutes then re-opened the mchield process sub-window in Process Explorer. CPU levels for mcshield were barely above zero.

So, a couple of hypotheses :

- maybe the mcshield/RTS hyperactivity had something to do with McAfee requiring a reboot but not saying so. This is quite likely because, as per comments on the call, many companies and individuals dislike having to reboot after an update which means the McAfee programs have to tie themselves in knots to keep everything running, when really registry entries need updating, files need replacing, and who knows what else.

- maybe mcshield is clashing at certain times and in certain circumstances with another program or process. The only way to find out is to close everything down (browser, apps, whatever) one by one and see if the CPU activity suddenly drops. And don't overlook little background programs like ProcExp - perhaps they both need access to the same system resources, or are trying to access the same files. It is, as they say, complicated. You need to experiment, and troubleshoot; and even if you find some apparent correlation it's not necessarily clear what the underlying conflict is all about.

Re: Latest update causing excessive CPU and Floppy Drive activity

Sorry I get peacemaker all the time will put my glasses on.

mjminer
Level 7
Report Inappropriate Content
Message 67 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

FWIW,

In my case, my original problem was two fold:

1. Performance so poor that tapping the Win-E keystroke to start the Windows Explorer, which normally takes under a second, required over 60 seconds to start (timed). Performance so bad that MS Word, Internet Explorer, and Chrome, could not keep up with hunt-and-peck typing.

2. And, Annoying floppy disk chatter.

Disabling the floppy (unplugging the data and power cables) did not change anything, performance wise, though, of course, the noise stopped.

Disk activity, based on the HDD light, was minimal.

CPU usage, based on Task Manager and based on ProcExp was minimal (5 to 10% range).

(I installed ProcExp and ProcMon in an attempt to diagnose the poor performance - they were not even on the machine at the start of the problem.)

Failing to diagnose the problem, I finally started with a brand new clean install - i.e., format disk, install Win XP, apply hours of updates.

McAfee was the first product I installed after completing the Windows Updates.

The problem began with the first reboot after installing McAfee - both the diskette chatter and the miserable performance returned.

Now knowing that McAfee was the problem, it was easy to find this discussion (first hit in Google).

Use Add/Remove programs to uninstall McAfee. Reboot. Problems (poor performance, diskette chatter) left also.

Which, to me, confirms McAfee is the problem.

I don't know whether the problems are related, but the reality is that the machine is unusable with McAfee installed, from a performance point of view. I can disable the floppy in the Bios, or unplug it, or just ignore it. It doesn't concern me. I have a workaround, if I care to use it.

But, the performance problem makes the machine unusable. I don't know how to be any more direct than that.

And the sense that I get from reading the above is that, no matter how often the performance issue is raised, the discussion/solution seems to keep coming back to the floppy. No one even admits to using the things. It's a distraction from the real problem - poor performance. Focus, People.

Win XP + McAfee => Paperweight (or door stop).

Re: Latest update causing excessive CPU and Floppy Drive activity

I sincerely appreciate your contribution, but please allow me to highlight that by my previous message I was considering and reporting the use of Process Monitor, and not of Process Explorer: I understand and also I used it, in getting useful information, but such additional Microsoft  tool, is not highlighting enough what I found wild, insane and exaggerated, even considering the possibility of Viruscan acting for a reasonable polling of all HD roots (C:\, D:\, etc.) as also for floppy disk (A:\), becouse by Process Monitor I confirmed something like not less than 10 times per second (10 Hz as a minimum), performed for each root drive, in performing the command "drive:\$Extend\Reparse:$R:$INDEX_ALLOCATION", that no one explained yet to me (what it will do, and why doing it so often), and this phenomenon will be further boosted up to 4 or 5 times (this would translate into 50 Hz for instance), or more, depending from the number of your PC drivers.

If you will have a look to Process Monitor, you will see such phenomenon as very clear and easy to be noted.

I can confirm that after such "huge" activity I also performed several reboots but nothing have been changed as the phenomenon is still here.

Let me also to add, that the floppy drive here is not the true problem here, as such wild and exaggerated polling action will be performed the same on the other drives (e.g. your hard disks), and the sole differences will be the fact that HD will not croak looking for floppy, so you may not it less, but still this will burden your CPU activity, a load, as also all the rest, as confirmed by you too.

Now my hypotesis as an end user, as in my opinion, we (end users) should be the sole authorized to make hypotesis....

Floppy activity is neiher the cause, or the end result here, as more really, it should be considered as a "true flag" of what is happening on your PC by such "latest updgrade" made available from McAfee. By such hypotesis, it should be also be considered the understandable temptation that will fire me, in considering, for instance, that when I renewed the latest Total Protection Suite product from McAfee, it was clearly quoted as XP compatible (and we are here all talking about XP), and no one quoted on the product box that it will require me to accept such a "significative"  XP performance downgrade, not depending from the presence or not of any old, obsolete croaking floppy disk drive.  The thread here should in fact be changed into "....excessive CPU activity and  ALL drives activity..."

I wish also to point out that some floppy disk drive is still good to me/us, for instance for limited information, still being competive with CD or USB pen memory, as also, we still need to migrate some software from floppy to other more recent memory support, but as explained, I trust like I demonstrated that floppy is not longer an end effect here. So I'm still free to use floppy if i wish, as it should......

As explained, the floppy drive cannot be longer the finger behind which being hide....we are talking about something different now.....

The next interesting argument here in fact is to talk about why the McAfee antivirus need to poll with such higer frequency all drives, or at least so more often in respect to the past algorithm, as such abnormal activity is performed after the "latest insane" upgrade. Previous than such upgrade, floppy disk was not being polled by Viruscan (or mcshield.exe if you wish).....

I would be pleased, as also very curios to know why such command ("drive:\$Extend\Reparse:$R:$INDEX_ALLOCATION") shall be performed with such wild rate over all drives, at least with such increased rate in respect to the past (I'm almost sure of it, as soon as if I will have some free time, I will check with Process Monitor a laptop PC not yet upgraded with the insane one, to see and confirm such expected polling rate difference).

The sole true fact here, is that XP has dramatically be crippled here, and it may be a coincidence, or may be not, it have been just behind the Microsoft assistance abandon of XP operating system suport.  This is something on which all of us have to think here.   Personally I've been very happy with XP, as also I'm still OK with it, but as well know, someone else think that is better to forget it, even if I paid for it too and I'm very happy with it, on the basis of my day by day activities.

Yes, is very easy to procure difficulties to the oldest platform just improving some process execution rate (that will not be noted on other platforms, more recent, more powerful, not equipped with foppy disks). But why it will be required such improved rate: do it will be indeed necessary, considering the time to elaborate and make executive any possible "bad software" menace. And then, why it should be on each drive, when it was not required earlier (the evidence of this, is my old and loved floppy drive that warned me croaking very strong, only after the upgrade).

Please be professional here, as we paid money. We are not using McAfee tools under any GNU or free of charge licence agreeement.

We paid good money, and we should be not be told: "try to remove it with bios.....", try to disable it by Control Panel....", "try to reboot", "try to unintall and then re-install"  etc.  We have no time to be wasted. We trust like we entrusted professionals to protect our PC (even when old), and not paid for a shamanic or alchemical solution approach.

A lot of not longer acceptable  "may be" or "try here" or "try this" have been indeed......

I do not longer want to try anything longer, or to wait for a positive Jupiter astal conjunction.....

No one will pay me for such wasted time, and my PC's were all just fine prior than such upgrade.

I want just to place a question here, the right question that will definitelly allow us to understand what have been indeed by the latest overnight upgrade from McAfeee......

Tell us instead why such "extra" activity have been introduced. Please explain us technical reasons (or alleged safety needs) behind such repeated command ("drive:\$Extend\Reparse:$R:$INDEX_ALLOCATION"): I would be more than only happy to learn and understand why it have been introduced.

Being almost sure that such explanation will not be provided, I wish to point out that if this will be the case, indeed I will not longer renew anything with McAfee...

This one, is not the sole one trouble experienced with McAfee products, but I've not enough time to report all of these, as I've to work on my earning activity and not to provide free trials...

I believe like I've full rights to ask for such clarification, as I don't see any true benefit from such extra activity, but cripple older XP platform, or should we think this was the final aim?.

With all the best from Italy

Greetings

Steve

Hayton
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 69 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

@customer_is_always_right :

By using Process Monitor you have indeed found something relevant, but all of it is low-level code and I'm not really qualified to say much about it.

What I have done is to find references to some of these things in Microsoft's documentation, and I will leave it for someone who is technically more proficient than I am to explain what might be going on.

1. "Reparse:$R:$INDEX_ALLOCATION"

See

"NTFS Streams" - http://msdn.microsoft.com/en-us/library/dn393272.aspx

All files on an NTFS volume consist of at least one stream - the main stream – this is the normal, viewable file in which data is stored. The full name of a stream is of the form below.

<filename>:<stream name>:<stream type>

In the case of directories, there is no default data stream, but there is a default directory stream. Directories are the stream type $INDEX_ALLOCATION. The default stream name for the type $INDEX_ALLOCATION (a directory stream) is $I30. (This contrasts with the default stream name for a $DATA stream, which has an empty stream name.)

"FileReparsepointInformation" - http://msdn.microsoft.com/en-us/library/ff469336.aspx

OutputBuffer is an array of one or more FILE_REPARSE_POINT_INFORMATION structures as specified in [MS-FSCC] section 2.4.35.

This Information class can only be sent to a specific directory that maintains a list of all Reparse Points on Open.File.Volume. The name of this directory is: "\$Extend\$Reparse:$R:$INDEX_ALLOCATION".

2.  Reparse Points.


From http://msdn.microsoft.com/en-us/library/07f3a42b-3466-41ab-8f60-e706e50d897a#reparse_point

reparse point: A collection of user-defined data associated with a file or directory. The format of this data is understood by the application or the file system that stores the data, and the file system filter that interprets the data and processes the file. Reparse points can contain data that instructs the file system or the operating system to take special actions. For more information, see [MS-FSCC].

3. "IRP_MJ_CREATE"

See

http://msdn.microsoft.com/en-us/library/windows/hardware/ff548630(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/hardware/ff550729(v=vs.85).aspx


The I/O Manager sends the IRP_MJ_CREATE request when a new file or directory is being created, or when an existing file, device, directory, or volume is being opened.

So McAfee is repeatedly - many times a second - opening "a specific directory that maintains a list of all Reparse Points".

Perhaps the code that manages this operation has changed; I do not know. Perhaps - if a compiler has been used - the output code has been optimised in such a way that it runs less efficiently on XP machines. I do not know.

What I do know is that McAfee is not the only antivirus vendor to have produced these symptoms. A few years ago some ESET users were enquiring about exactly this topic.

http://www.nsaneforums.com/topic/100537-eset-5093-av-huge-disappointment/page-3

http://www.wilderssecurity.com/threads/ess-4-2-71-2-keeps-scanning-c-extend-reparse-r-index_allocati...

Message was edited by: Hayton on 08/04/14 03:40:14 IST
psfales
Level 7
Report Inappropriate Content
Message 70 of 151

Re: Latest update causing excessive CPU and Floppy Drive activity

Well, I'm glad I found this thread, but I'm also *very* annoyed.   We actually bought a new computer and went through the pain of moving all our applications and data to the new machine because we couldn't figure out how to get rid of the "virus" that had infected this machine.    The new machine worked fine until we got around to re-installing McAfee yesterday.  Today the "virus" was back.   Thanks to finding this thread, the system was restored to normal by uninstalling McAfee.      We've been customers for a long time, but that's unlikely to continue.

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community