in

dotNetFreak

Ramblings & Controls from a .NET Addicted Freak!

Kevin Gearing's Blog

ASP.NET, w3wp.exe, 100% CPU Usage and McAfee VirusScan Enterprise

Recently I've been experiencing a strange problem on one of our development servers that was hosting an ASP.NET application. The server in question was running Windows Server 2003 with IIS6 and VirusScan Enterprise v8.0i.

I was noticing that any ASP.NET page that was being hit would cause the CPU usage to jump to 100% for a period of a few seconds, before returning to it's typical 2-3% - The offending process? w3wp.exe.

I ruled out (as far as possible) the application as the fault, simply because the same application was running on a Windows 2000 Server as well as an identical Windows Server 2003 without any issue.

Running adplus (Windows Debugging Tools) revealed some interesting information, but nothing concrete. Further investigation pointed me to possibly McAfee VirusScan Enterprise, which had recently been upgraded and was a different version to that running on the other servers.

To cut a long story short, McAfee have introduced 'Buffer Overflow Protection' into VirusScan Enterprise v8.0i, which if set to 'Protection Mode' seems to interfere with w3wp.exe and throw the processors to 100% - disable it and no problem.

So, if you're running VS Enterprise v8.0i and start seeing strange 100% CPU usage, check that you have 'Buffer Overflow Protection' disabled, or set to 'Warning Mode', which might also solve the problem - For me, disabling is the route I'm going...

Comments

 

Fred Peters said:

I haven't seen the 100% CPU usage problem yet.

I have been experiencing a random Buffer Overflow error from McAfee VirusScan on the IIS worker process W3WP.exe when debugging ASP.NET applications using Visual Studio 2003 under Windows Server 2003. This error will cripple debugging in Visual Studio and cause IIS to hang. You can sometimes get things working again by shutting down Visual Studio, killing the hung Devenv.exe from the Task Manager, and restarting IIS. Rebooting however is the only sure way to get things going again.


The VirusScan version is 8.0.0, and curiously its date is July 27, 2005, the date I began to have problems. To avoid this problem I tried to disable McAfee’s overflow protection on my machine. It lets you disable it, but our network profiles automatically turns it back on within ten minutes.

A single process can be exempted from the scan by entering the Process, Module, and API names. I suggested that we need our profiles to exempt W3WP.exe until McAfee fixes the problem.

Fred Peters

July 28, 2005 6:18 PM
 

Glenn said:

Hi, i have had some problems with BOP on Mcafee 8.0i, our application was taking 1.5 minutes to process a batch file and as soon as we disable the BOP in our server the process was taking only 20 secs!!! we didn't touch a single line of code!!
November 2, 2005 6:09 PM
 

Bill Hansen said:

We had a problem with IIS 6, on a Windows 2003 server where the w3wp.exe was hanging. It turned out that there were several task that needed the w3wp.exe process and they were running sequncially. The fix was to increase the max number of worker processes under application pools.
January 19, 2006 3:21 PM
 

Ankur Malhotra said:

Known issue: High CPU / memory usage by the w3wp.exe service

Product: ModusMail & ModusGate

Version & Build: 4.2.425



Description of Problem:



After installing the 4.2.425 build, you might experience higher than average memory or CPU consumption by the w3wp.exe service, particularly on a Windows 2003 server.



Solution:



The problem is caused by having the debug logging turned on in Webmail or Web Quarantine. This option will be disabled by default in future releases, but for now we ask that you change the setting manually.



To disable the debug logging, please do the following:



ModusMail: Open the web.config file in your Web\Webmail\Webroot directory

ModusGate: Open the web.config file in your Web\Quarantine\Webroot directory


Look for the following lines:

<compilation
defaultLanguage=""c#""
debug=""true""
/>


Change debug=""true"" to debug=""false""

Stop and restart your Webmail Server Service.
February 9, 2006 8:20 PM
 

ok said:

It is not necessary that w3wp.exe service occur due to anti virus , I have seen many time that it come from other applications as well. IF you restart IIS the issue solve for somewhile
April 14, 2006 10:21 PM
 

John Sonner said:

The fix was to increase the max number of worker processes under application pools. Increase the max number to? I have increased it to 4.
April 25, 2006 5:50 PM
 

QuasarIatros said:

I think you'll find the applivation running in the pool having issues has an executable file that needs to added to the low risk process scanning option. Yhen add the applications directories to the High risk, and default exemption lists. this should do it.
May 26, 2006 2:31 PM
 

randelosreyes said:

That w3wp.exe also has been creating havoc on our servers us so we wrote a simple application to control it.

Details and download here:

http://www.linkhelpers.net/w3wp_fix.asp
February 24, 2007 3:42 AM
 

Eric said:

The problem I am having is deploying micrsoft patches using WSUS. It keeps on hanging or timing out and when I check the task manager, I found out that the w3wp.exe is using more memory than it's suppose to. Can anyone tell me what might be the cause? I do have McAfee installed on the server also.
April 17, 2007 9:39 AM
 

seeker22 said:

Wanting to configure McAfee virusscan to exclude w3wp.exe from buffer overflow protection. Anyone know the API to use for it?
April 25, 2007 6:25 PM
 

Nachiketa Anshu said:

Hi,

I was facing the same problem of w3wp processes taking 100% CPU utilization. I made the number of worker process from 1 to 4. It made the application noticeably fast but some times we observe that the session is not consistent. It keeps loosing some data and suddenly regains the session. Its weired. Can anyone advice on what needs to be done to fix this. Once i change it to 1 again from 4 worker processes, it works fine.

TIA,
Nachie
June 28, 2007 6:10 AM
 

Dustin Stejskal said:

Nachie -

I am guessing that your Session State Mode is set to "InProc". The problem is that each instances of the worker process that is brought up has its own in process state storage. Meaning if you are storing something in Session and you then get redirected to another page and on to another worker thread you will not have access to that session information. Using an out of process state storage mechanism (SQL or State Server) will allow you to store session state in a common place that all worker processes will have access to.. Please also remember that anything stored in an out of process manor will have to be marked as Serializable .

Dustin

July 18, 2007 6:04 PM
 

ritesh kharadi said:

thank you

August 1, 2007 2:15 PM
 

Atti the caprio said:

nice information....

buit can anybody please write more details about state servers and sql mechanism for common place for worker ....?

any comment?

....thanks in advance

August 28, 2007 7:46 AM
 

Asheesh Barua said:

Hi

You can keep the session variable out of .net worker process,

State server ;- keep the session dat over the out of worker process you can specify the location where you want to keep the session information, Just make  a small change in to web config , change the session state to state server.

In this mode your session variable should be seralize

SQl server : you can keep the session varaible over the SQl  server data base. for this ypu needto run the Micro soft provided script for sql server mode

and make the session mode to sql server in web config

Thanks

September 27, 2007 3:54 PM
 

Holger said:

Hi there,

turning off McAfee BOP did the trick!!!

I was facing extremely poor performance on an ASP.NET web application. Using trace logs, task manager  and windows performance manger I figured out that even though I had a low activity on CPU and moderate RAM usage that .NET Framework was struggling hard on PerfMon. The traces revealed that I lost 10 seconds just by calling a method within my form's code. After I turned off the BufferOverflowProtection in McAfee 8.0 my web application  was working perfectly.

Thanks again!

May 19, 2008 3:38 PM
 

Bahmani said:

The best solution to solve this problem is to move yr project folder to wwwroot folder

June 14, 2008 11:39 AM
 

Rouhollah Bahmani said:

I had cpu usage 100% with DouranPortal project which have been sold to more than 2000 companies(like http://www.kish.ir).

DouranPortal Project(dotNet 1.1) doesn't have any problem with McAfee 8.5i but dotnet 2.0 version

makes cpu usage to 100% i mean w3wp.exe process goes to 100%.I downloaded and Installed KenticoCMS, McAfee doesn't have any problem with that

i mean it works normaly. I noticed the location of projects, both DouranPortal and KenticoCMS,

DouranPortal is in d drive but KenticoCMS is in WWWROOT folder, So I transfer DouranPortal to

WWWROOT and it works properly, and I didn't change the setting of McAfee!! Unbeliveble!!

I check process with Filemon.exe and I found that McAfee makes w3wp.exe to load the all permutaion of paths an files

to that is not really exixts.for example the file setupapi.dll is in C:\WINDOWS\system32 folder

and my bin project folder is in D:\DouranPortal_v20\bin. McAfee makes w3wp.exe to load

file like D:\DouranPortal_v20\bin\setupapi.dll which is not exists and it takes lots of time to find.

and this happens for Symantec endPoint antivirus too.

I didn't give it up the problem, I try to copy the setting of wwwroot folder to D:\DouranPortal_v20 folder

but it didn't work, maybe it has some setting in windows registery, so do you know what is the diffrence?

So the only solution is to move project to wwwroot folder!!

and customer was content.

bahmani00@yahoo.com

June 14, 2008 11:44 AM
 

Cliff said:

mysupport.mcafee.com/.../templatepage.aspx

Click Start, Programs, McAfee, VirusScan Console.

Double-click Access Protection, deselect Enable Access Protection, then click OK.

Click Start, Run, type regedit and click OK.

Navigate to the following registry key:

[HKEY_LOCAL_MACHINE\Software\McAfee\VSCore\On Access Scanner\McShield\Configuration]

In the right pane, right-click an empty space and select New, DWORD Value.

Name the new value ScanMemoryOfNewProcesses and press ENTER.

Double-click ScanMemoryOfNewProcesses and set the Value data to 0 (zero).

Click OK and exit the registry editor.

Click Start, Programs, McAfee, VirusScan Console.

Double-click Access Protection, select Enable Access Protection., then click OK.

Restart the system.

August 20, 2008 4:41 PM
 

Windows IIS w3wp.exe high CPU - Kayako - Community Forums said:

Pingback from  Windows IIS w3wp.exe high CPU - Kayako - Community Forums

January 26, 2009 10:07 PM
 

Kevin Gearing's Blog said:

Following on from my post back in 2005 ( ASP.NET, w3wp.exe, 100% CPU Usage and McAfee VirusScan Enterprise

February 10, 2009 12:23 PM
 

TIm said:

Nachiketa Anshu  Thanks Changing the Worker Proccess it fixed everything THANKS!!!!!!!!

April 20, 2009 7:26 PM
 

Krunal Chaklasia (KC) said:

Thanks you. This helped me to resolved issue on one of our UI server on slow response time.

November 5, 2012 10:51 PM
 

Quidejoher said:

I was facing w3wp.exe high cpu utilization error from long and was searching for resolution. I had increase number of worker process and same is under observation now.

November 20, 2014 5:21 AM
 

Arun said:

Cliff - Thanks for your fix in Mcafee. It works for me.

May 24, 2017 5:53 PM

Leave a Comment

(required)  
(optional)
(required)  

Protected by FormShield
Refresh
Listen
Please enter the characters shown on the image


Code:


Add
Copyright ©2004-2007 Kevin Gearing. All Rights Reserved.
Powered by Community Server (Non-Commercial Edition), by Telligent Systems