Curious Observation

[Larry]

I run an automatic quick scan daily at 11:00 AM. I usually am not near the
computer at that time, but today I was. I heard the hard disk start, looked
at the clock, saw it was 11:00 AM, noted that it was time for the WD
autoscan, and opened task manager to see how much CPU it was using. The only
process using a significant amount of CPU was McShield.exe, a McAfee
executable, using about 50 - 60 percent. If WD was using any, it wasn't
noticeable on the task manger display. Does this behavior sound normal, or
do I perhaps have some sort of conflict between McAfee and WD? I never get
any obvious McAfee or WD warnings or alerts. Everything seems to be running
normally, I was just surprised by what I saw in task manager. Anybody got
any thoughts?

 

[Bill Sanderson MVP]

A quickscan is pretty light on resources, and can be very quick sometimes
less than 2 minutes. Check the System event log, filter for source
WINDEFEND to see start and end scan records, and how long the scan took.

 

[Larry]

The quick scan started at 11:00:41 and ended at 11:02:35. I don't understand
the significance of that relative to my question? TIA
Larry

 

[Bill Sanderson MVP]

It probably isn't directly relevant--just to observe that the quickscan
doesn't take long, and doesn't spend a lot of time working with files--it
starts with ram content and works out--so it is both quick, and light on
resources. I'd say that sounds like a pretty normal quickscan on an office
workstation, probably. If you want to see CPU load, start a manual full
scan.

So--I don't see anything in what you've posted to indicate that there's
anything wrong, or a conflict of any sort going on.

--

 

[Larry]

Bill, thanks for your time, but I don't feel like you're addressing my
original question. What's the story on the McShield activity?
Larry

 

[Bill Sanderson MVP]

I don't know. If called upon to guess, there's a chaining process whereby
anti-malware vendors "connect" to be able to monitor transactions such as
email attachment opens or saves. This is embodied in MpOAv.dll. Mike Treit
from Microsoft touches on this in this thread:

http://www.pcreview.co.uk/forums/thread-2397331.php

I suspect that McAfee is probably scanning the same objects that Windows
Defender is--you may have observed in the past that a full scan of a system
will bring up antivirus warnings as infected files are touched by the
antispyware scan.

This is probably an example of what happens with multiple real-time scanners
active on a system. I don't think there's anything wrong here, unless you
feel that McAfee is hogging the CPU, which presumably they'd need to
address.

--

 

[Larry]

OK, thanks.
Larry

I don't know. If called upon to guess, there's a chaining process whereby
anti-malware vendors "connect" to be able to monitor transactions such as
email attachment opens or saves. This is embodied in MpOAv.dll. Mike
Treit from Microsoft touches on this in this thread:

http://www.pcreview.co.uk/forums/thread-2397331.php

I suspect that McAfee is probably scanning the same objects that Windows
Defender is--you may have observed in the past that a full scan of a
system will bring up antivirus warnings as infected files are touched by
the antispyware scan.

This is probably an example of what happens with multiple real-time
scanners active on a system. I don't think there's anything wrong here,
unless you feel that McAfee is hogging the CPU, which presumably they'd
need to address.