On-demand scan tasks scheduled locally encounter issues

Technical Articles ID: KB66023
Last Modified: 3/18/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.8.x

For details of VSE 8.8 and ePO supported environments, see KB51111.

Summary

Background Information
Users can create and schedule local tasks if the VirusScan console has not been locked down. In an ePO-managed environment, this configuration can lead to an overlap of on-demand scan (ODS) tasks running, both those tasks created through ePO and ones created by users.

NOTE: It is possible to preserve ePO tasks or local tasks when you upgrade to a later version of VSE. For ePO tasks, the product development team recommends against this scenario. The reason is because ePO-managed tasks should be modified only through the ePO console. If you encounter this scenario, contact Technical Support.

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Problem

The following are observed on a client:

On-demand scan (ODS) tasks run at unexpected times.
Multiple instances of scan32.exe running.
High CPU shows for the VSE scan32.exe process.
In some instances, the CPU utilization can reach100%.

Cause

Systems with locally created ODS tasks run at the appointed time. ePO-created on-demand scan tasks also run at their appointed time. When these times overlap, it can cause high CPU usage from the scan32.exe process because the locally created task defaults to 100% CPU utilization. This situation also applies to ePO-created tasks that were created for an earlier version of VSE that is preserved when you upgrade to a later version of VSE.

Solution

Locally on the client, delete or disable the ODS task through the VirusScan Console.

To delete the ODS task:

Click Programs, McAfee, VirusScan Console.
Locate and right-click the unwanted scheduled On-Demand Scan task.
Click Delete and click Yes.
Close the VirusScan Console.

To disable the ODS task:

Click Programs, McAfee, VirusScan Console.
Locate and double-click the unwanted scheduled On-Demand Scan task.
Select Schedule and deselect Enable.
Click OK, and then OK again.
Close the VirusScan Console.

Solution

Delete or disable specific ODS tasks through the Registry Editor and Windows Explorer:

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
Do not run a REG file that is not confirmed to be a genuine registry import file.

Click Start, Run, type regedit and click OK.
Navigate to the following registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection\Tasks]

Each Task is assigned a unique GUID (globally unique identifier). You require the GUID task that contains the name of your on-demand scan.

The default ODS task has a GUID of {21221C11-A06D-4558-B833-98E8C7F6C4D2}
Make a note of the GUID found.
Close the registry editor.
Start Windows Explorer and, depending on the version of the McAfee Agent (Common Management Agent) installed, navigate to either of the following:

C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Task
C:\Documents and Settings\All Users\Application DataNetwork Associates\Common Framework\Task
Locate and delete the .INI file with the same name as the GUID identified.
Repeat the above for any other ODS tasks found as needed.
Close Windows Explorer.

NOTE: Deleting the relevant .INI file only prevents the task from running as a scheduled task. To remove the task from the local Console, also delete the relevant GUID key or use Solution 1.

Solution

Disable all local ODS tasks through Windows Explorer:

Start Windows Explorer and, depending on the version of the McAfee Agent (Common Management Agent) installed, navigate to either of the following:

C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Task
C:\Documents and Settings\All Users\Application DataNetwork Associates\Common Framework\Task
Remove all .INI files.
Invoke or wait for the next Agent-to-Server communication. This action causes any ePO-created tasks to be re-created and scheduled.

Affected Products

VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

On-demand scan tasks scheduled locally encounter issues

Environment

Summary

Problem

Cause

Solution

Solution

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

On-demand scan tasks scheduled locally encounter issues

Environment

Summary

Problem

Cause

Solution

Solution

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title