Knowledge Center

FAQs about McShield.exe and high CPU utilization when running on-demand scans
Technical Articles ID:   KB85299
Last Modified:  9/27/2019


McAfee VirusScan Enterprise (VSE) 8.8 Patch 5 and Later

For details about the VSE 8.8 supported environments, see KB51111.


Customers who upgraded from VSE 8.8 patch 4 to patch 5 might report higher CPU utilization when running on-demand scans (ODS). This issue is not necessarily a sign of incorrect function.

Why was this higher CPU usage not happening in patch 4?
This issue was most likely because patch 4 contained a known issue where it used only one scanning thread was used during ODS. This issue is resolved in patch 5, resulting in higher CPU utilization during ODS.

What changes were made in patch 5 for this specific behavior?
Engineering resolved the thread count issue from patch 4, and now multiple threads are used to finish the scan faster. This resolution is documented in the VSE 8.8 patch 5 Release Notes (PD25913).

Is there a safeguard in place to prevent CPU use from exceeding a certain percentage for the process?
No. This feature does not currently exist.
If you require a change to product functionality, submit a new product idea at:


The Ideas forum is accessible only to McAfee business and enterprise customers. Click Sign In and enter your McAfee ServicePortal (https://support.mcafee.com) User ID and password. If you do not yet have a McAfee ServicePortal or McAfee Community account, click Register to register for a new account on either website.

For more information about product ideas, see KB60021.

NOTE: The Ideas forum replaces the previous Product Enhancement Request system.

Are you recommending that I stay on patch 4 to prevent this issue?
No. Although patch 5 ODS uses higher CPU, scans finish faster. The product development team recommends that you upgrade to patch 5, when it is approved for your environment, because it contains useful security updates.

Why would ODS use 95% CPU utilization when VSE was set to use low resource?
This issue relates to how the Windows Set priority Control API works. The VSE uses this API for system resource utilization and, in turn, allows the operating system to decide on the resource utilization and assignment function. You can find more details in Knowledge Base article KB55145.

If settings on the performance tab do not change this behavior, why is that option available?
Setting the system utilization on the performance tab to Low provides improved performance for other running applications. The Low setting is useful for systems with high user activity. Conversely, by setting the system utilization to normal, the scan completes faster. The normal setting is useful for systems that have large volumes and little user activity. For more details, see the "Configuring Performance Improvements" section of the VirusScan Enterprise 8.8 Best Practices Guide (PD22940).

You can also make the following adjustments to ODS settings to improve performance, as needed:
  • Enable scan cache.
  • Set up daily, targeted ODS for risky locations.
  • Set up complete ODS to run once a week.
  • Set up exclusions in ODS wherever needed, such as on an Exchange server.
  • See KB74059 for Best Practice for on-demand scans in VSE 8.8.

Rate this document

Glossary of Technical Terms

 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.