Can't delete large file due to McAfee

Question

I have this file I need to download, and when I try to delete it normally I get the error "Cannot delete FILENAME: It is being used by another person or program." etc..

Looking at the application event viewer, I see McLogEvents corresponding to the times I was trying to delete the file. Here are the two errors:

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5051
Date: 6/25/2010
Time: 11:18:49 AM
User: NT AUTHORITY\SYSTEM
Computer: XXXX-XXXXXX
Description:
A thread in process C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe took longer than 90000 ms to complete a request.
The process will be terminated. Thread id : 2144 (0x860)
Thread address : 0x12213303
Thread message :

Build VSCORE.13.3.2.133 / 5400.1158
Object being scanned = \Device\HarddiskVolume2\Virtual Machine\qmvm-gpdimg.zip
by C:\PROGRA~1\WINZIP\winzip32.exe
4(0)(0)
4(0)(0)
7200(0)(0)
7595(0)(0)
7005(0)(0)
7004(0)(0)
5006(0)(0)
5004(0)(0)

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 1008
Date: 6/25/2010
Time: 11:18:49 AM
User: N/A
Computer: xxxx-xxxx
Description:
The McShield service terminated unexpectedly.
Please review event 5019 or 5051 for details. The McShield service will be restarted in 20 seconds;

I've disabled McAfee and was able to delete the file fine. It is around 8gigs and has to be deleted permanently (too big for the recycle bin), and I'm assuming the file size is tripping up the McAfee scanner but not sure. Anyone have any ideas on how to delete this file without disabling McAfee?

(Windows XP SP3, Dell D630, A17 Bios)

Answer 1

McAfee is indeed timing out while trying to scan the large file that you have. This is what is mentioned in the event logs; see ERROR: Event ID 5051, Scanner Thread Time Out event for more information.

Are you trying to delete the file from within Explorer? If so, it looks like WinZip is jumping in and requesting a scan of the contents of the file, the second you click on it. Even Explorer reading the attributes of a file, for displaying file sizes, etc, can trigger a scan of the file.

You can test this theory by having Task Manager open and watching it when you open the folder and click on the file to highlight it, or try to delete it. CPU and memory usage for McAfee processes should jump up.

My suggestion is to try to delete the file from the command prompt instead. This should bypass Explorer triggering the antivirus scan with McAfee, which is effectively locking the file and preventing you from deleting it.

Alternatively, you may also have luck disabling "Scan inside archives" within WinZip, if you deal with large Zip files on a regular basis. Another scary option appears to be configuring opportunistic locking in Windows. As you have to perform these changes on multiple computers, probably not ideal solutions.