Video Screencast Help
Search Video Help Close Back
to help
Not able to make it to Vision this year? Get a sampling in the Best of Vision on Demand group.

SEP - Experiences moving from McAfee VirusScan Enterprise

Updated: 23 May 2010 | 2 comments
Anwar's picture
0 0 Votes
Login to vote

Hi All,

 

I'm contemplating a move from McAfee VirusScan Enterprise to SEP.  I'm sure both offer decent anti-virus protection, but in our case VirusScan Enterprise causes gradual and consistent slowdown of the client, eats up memory and consumes too much CPU time.

 

Currently we use Windows Defender and McAfee VirusScan Enterprise.  On my PC, (HP DC7700  running XP SP2 and VirusScan Enterprise 7.0), according to Task Manager, the software costs;

 

McShield.exe: 107Mb

FrameworkService: 7.2Mb

 

Windows Defender costs

MSASCui.exe: 7.5Mb

MSMPENG.exe: 26Mb

 

It also hogs CPU time when it needs to update.  

 

I no longer need Windows Defender because SEP includes this capability.   SEP costs

SmcGUI: 3.7Mb

ccApp.exe: 0.5Mb

Rtvscan.exe: 3.7Mb

ccSvcHst.exe: 2.8Mb

SNAC.EXE: 2.3Mb

Smc.exe: 5.1Mb

 

A grand total of  18.1Mb - a little over *half*of Windows Defender *alone*.

 

I've got one outstanding issue with administrators being able to disable services (later versions of McAfee prohibit this), but I'm encouraged!

 

HOWEVER, I'd welcome any feedback from others who've followed a similar path - what worked, what didn't worked, what was a disaster, and so on.

 

Please reply via the forum (preferred, so everyone benefits!) or privately.

 

Kind regards,

 

Anwar

 

Comments

reza akhlaghy's picture
04
Feb
2009
0 Votes 0
Login to vote

Hi Anwar,

 

There are some good tools in CD2 of SEP which will help you remove McAfee just before installing SEP. Although you can remove McAfee from EPolicy console as well but in that case you put your clients in risk of being infected.

 

By the way if you choose first method you have to take care of McAfee annoying Framework service also, there are some batch files (which you can find by searching google) that will help removing framework service.

Auusie's picture
04
Feb
2009
0 Votes 0
Login to vote

First of all, i am not against your decision or anything but .. you need to compare apple with apple.

install the latest Virus scan if i remember it was 8.5 with antispyware with latest patches and then try compare with SEP with latest patches.

 

i know antivirus companies will always struggle to fix virus problem and Symantec n Mcafee are both alike.. they are always run behind the virus creaters....

 

i have used McAfee in my previous company and now using SEP in new company and i would say...... mcafee solution is still wayy too ahead of SEP management solution, and for the annoying little framework service .. i would say its wayy too better then SEP all together.. (i know its a another debate)  but at least if you want to uninstall Mcafee from your system you just need to tell the agent to uninstall all the softwares and unisntall your self from the management console ONLY...

 

and for the service part you can either apply Group Policy or use the new version to disable that no one can stop the service... and for the best practice of security NO one is supposed to be admin of their machines..

again i am not offending anyone... but still there is so many things symantec needed to do and they are doing it but they are bit too late.. like Novell adopted TCPIP but too late even though they had good things under thier seleaves :)

Message Edited by Auusie on 02-05-2009 09:57 AM