ASP.NET, w3wp.exe, 100% CPU Usage and McAfee VirusScan Enterprise

dotNetFreak — Tue, 15 Feb 2005 17:15:00 GMT

Recently I've been experiencing a strange problem on one of our development servers that was hosting an ASP.NET application. The server in question was running Windows Server 2003 with IIS6 and VirusScan Enterprise v8.0i.

I was noticing that any ASP.NET page that was being hit would cause the CPU usage to jump to 100% for a period of a few seconds, before returning to it's typical 2-3% - The offending process? w3wp.exe.

I ruled out (as far as possible) the application as the fault, simply because the same application was running on a Windows 2000 Server as well as an identical Windows Server 2003 without any issue.

Running adplus (Windows Debugging Tools) revealed some interesting information, but nothing concrete. Further investigation pointed me to possibly McAfee VirusScan Enterprise, which had recently been upgraded and was a different version to that running on the other servers.

To cut a long story short, McAfee have introduced 'Buffer Overflow Protection' into VirusScan Enterprise v8.0i, which if set to 'Protection Mode' seems to interfere with w3wp.exe and throw the processors to 100% - disable it and no problem.

So, if you're running VS Enterprise v8.0i and start seeing strange 100% CPU usage, check that you have 'Buffer Overflow Protection' disabled, or set to 'Warning Mode', which might also solve the problem - For me, disabling is the route I'm going...

Kevin Gearing's Blog : ASP.NET, McAfee

ASP.NET, w3wp.exe, 100% CPU Usage and McAfee VirusScan Enterprise