Loading...

Knowledge Center


Event ID 5051, Process will be terminated (Scanner Thread Timeout)
Technical Articles ID:  KB52441
Last Modified:  04/22/2013
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8, 8.7i

 

Problem

You see the following entry in the Application Event Viewer:
Event ID: 5051
Source: McLogEvent
Type: Error
Description:  A thread in process C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe took longer than 90000 ms to complete a request. The process will be terminated. Thread id : 4884 (0x1314) Thread address : 0x7C8285EC Thread message : Build VSCORE.13.3.2.116 / 5200.2160 Object being scanned = \Device\HarddiskVolume2\Dept\Technical Services\HEAVY CLEANING DOCUMENTS\Y2007(CY5)\Year 5\Year 2007 Cat 4_5 Pipe Spreadsheet.xls by System:Remote 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)
 
NOTE: This description is an example of the information that is collected. After each checkpoint, there is a zero (0) value in parentheses, which indicates the elapsed time. This is a true lock where file access is denied.

Cause

Scans are performed based on I/O activity on any file. If the Scanning Engine does not release the file before a second timeout threshold is met, the McShield process terminates itself so that a file lock does not take place. This usually occurs with embedded objects inside archive files. For examples, ZIP, .RAR, or .CAB. This is also based on file size, complexity, usage, location, and availability to the scanner at the time the Engine accesses the file.

Sequence of events
  1. McShield starts scanning.
  2. If the timer reaches the value specified for ScannerThreadTimeout, McShield requests the Engine to discontinue scanning and another timer begins.
  3. McShield waits for the Engine to release the file.
  4. If the scan is successful, McShield releases the file.
  5. If the second timer reaches the value of ScannerThreadTimeoutEx (which is equivalent to ScannerThreadTimeout), McShield terminates and the file is released.
  6. If McShield terminates, the Task Manager service (if started) sends a new start command to McShield.
  7. The McShield process restarts.

Solution

NOTE: This error is not for information only, and it is not safe to ignore. However, if you do not want to see this error, use one of the following workarounds:

Consider the following:
  • If a timeout occurs, it means a file has not been fully scanned. Also, McAfee does not retry to scan these files until after a DAT update (or when the scan cache has been reset).
  • If a timeout occurs frequently on the same file, then determine if the file is safe, If so, exclude it from On-Access scanning.
  • If a timeout occurs frequently on different files, there might be an incompatibility issue between McAfee software and another product that has been installed. You should investigate this further.
  • If a timeout occurs frequently for any reason, or when initiating a particular sequence of events, the safest course of action is to investigate the behavior further until the cause is understood.
  • If a timeout occurs infrequently, you can consider it as a one-off event due your computer system being heavily used, leaving little opportunity for McAfee to complete the scan. In this case, the safe course of action is to ensure files are being scanned by an On-Demand scan task. On Demand scans do not timeout.

Workaround 1

Add a Low-Risk Process exclusion for any processes that generate file timeouts. For more information about how to use Task Manager to identify potential Low-Risk process candidates based on disk I/O, see KB67891. Depending on the processes that generate the file timeouts, you might want to skip scanning the read and/or write disk I/O generated by that process. To do so, add the process to Low-Risk Processes and deselect When Writing to Disk and/or When Reading from Disk. For more information, see the following articles:

  • For High-Risk, Low-Risk, and Default processes configuration and usage, see KB55139.
  • To determine if configuring VirusScan Enterprise exclusions or setting Low Risk Processes is effective, see KB67648

To add a Low-Risk Process exclusion:

  1. Click Start, Programs, McAfee, VirusScan Console.
  2. Double-click On-Access Scanner.
  3. Select Low-Risk Processes (if Low-Risk Processes is not an available option, select All Processes).
  4. On the Processes tab, click Use different settings for high-risk and low-risk processes.
  5. Click Add, then Browse and select the process and click OK.
  6. Click OK and exit the VirusScan Console.
NOTES:
  • Each Default, High-Risk, and Low-Risk process policy is independent and you must configure them individually.
  • Adding a process to Low-Risk potentially affects your security. Use this solution only when strictly necessary.
Example
If you add a file in the Exclusions tab of the Default Processes policy, but do not add it to the Exclusions for the High-Risk policy, the file will still be scanned by the High-Risk processes policy. 

Workaround 2

Create a specific exclusion for the file:

  1. Click Start, Programs, McAfee, VirusScan Console.
  2. Double-click On-Access Scanner and select All Processes.
  3. Click the Detection tab.
  4. Select Exclusions and click Add.
  5. Type the name of the relevant file to be excluded.
  6. Click OK three times to exit the On-Access Scanner.
  7. Exit VirusScan Console.
For more information about using wildcards with exclusions in VirusScan Enterprise 8.x, see KB54812.

Workaround 3

If this issue occurs only when scanning archive files, disable archive file scanning. McAfee considers this to be a very minor security risk because all files inside an archive are scanned when the archive is opened or extracted.

VSE 8.7i:

  1. Click Start, Programs, McAfee, VirusScan Console.
  2. Double-click On-Access Scanner and select All Processes.
  3. Click the Advanced tab.
  4. Deselect Scan inside archives.
  5. Click Apply, OK.
  6. Exit VirusScan Console.

VSE 8.8:
  1. Click Start, Programs, McAfee, VirusScan Console
  2. Double-click On-Access Scanner and select Default Processes.
  3. Click the Scan Items tab.
  4. Under Compress Files, deselect Scan inside archives (e.g. ZIP)
  5. Click Apply, OK.
  6. Exit the VirusScan Console.

Workaround 4

Increase the ScannerThreadTimeout threshold in the VirusScan Console:
  1. Click Start, Programs, McAfee, VirusScan Console.
  2. Double-click On-Access Scanner.
  3. In the General tab, increase the value for Maximum Archive Scan time (seconds).

    The default value is 15 seconds. Increases are in five-second increments.
     
  4. Increase the value for Maximum scanning time for all files (seconds).

    The default value is 45 seconds. Increases are in five-second increments.
     
  5. Click OK and exit the VirusScan Console.

Workaround 5

Disable opportunistic locking in Windows.

For information about configuring opportunistic locking in Windows, see Microsoft KnowledgeBase article 296264 at http://support.microsoft.com/kb/296264.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.
United States - English
© 2003-2013 McAfee, Inc.