AdamM Posted June 8, 2017 ID:1134084 Share Posted June 8, 2017 Recently we've been getting frequent calls in our organization regarding abnormally slow pc's -- at least a couple per week I'd say. In all of the these cases, the SCComm.exe process is the culprit where it's pegging the cpu at 100% for long periods. Uninstalling all MBAM products and re-installing from the managed agent seems to resolves the issue. What does this process actually do that it would peg the cpu? What can I do to try and diagnose this behavior? Thanks, Adam Link to post Share on other sites More sharing options...
djacobson Posted June 8, 2017 ID:1134099 Share Posted June 8, 2017 Hi @AdamM, sccomm.exe is the process for the MEEClientService, it runs the client's communication to the server. We will need to look into what is possibly interfering with it, it is not typical at all for it to swamp resources. Frst Log Please follow the steps below to run frst. 1.) Please download frst and frst64 from the link below and save it to your desktop: FRST 32-bit version: https://downloads.malwarebytes.com/file/FRST FRST 64-bit version: https://downloads.malwarebytes.com/file/FRST64 Note: You need to download the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your computer; that will be the right version. Some traditional Anti-Viruses may false positive the download or running frst, I can assure you it is safe. If this happens, please temporarily disable the AV. 2.) Double-click the purple frst or frst64 icon to run the program. Click Yes when the disclaimer appears. 3.) Click the Scan button 4.) When the scan has finished, it will make 2 log files in the same directory the tool is located, frst.txt and Addition.txt. Please attach frst.txt and Addition.txt in your reply. Link to post Share on other sites More sharing options...
AdamM Posted June 9, 2017 Author ID:1134318 Share Posted June 9, 2017 I have attached the requested FRST log files from a machine exhibiting this behavior this morning. Machine was mostly unresponsive with SCComm utilizing 100%. In order to even run FRST, I had to lower the priority on the SCComm process to 'below normal' Thanks, Adam Addition.txt FRST.txt Link to post Share on other sites More sharing options...
djacobson Posted June 9, 2017 ID:1134339 Share Posted June 9, 2017 Add the following services and drivers to be ignored by your McAfee Host Intrusion Prevention. C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Malwarebytes' Managed Client\SCComm.exe C:\Program Files\Malwarebytes Anti-Exploit\mbae.sys C:\Windows\system32\drivers\mbam.sys Link to post Share on other sites More sharing options...
AdamM Posted June 9, 2017 Author ID:1134422 Share Posted June 9, 2017 Thanks. I will give that a try. Adam Link to post Share on other sites More sharing options...
djacobson Posted August 30, 2017 ID:1158805 Share Posted August 30, 2017 locking due to inactivity Link to post Share on other sites More sharing options...
Recommended Posts