Versions

Anti-Malware Core.1.1.3.164.x64	55.88%
Anti-Malware Core.1.1.3.136.x64	1.47%
Anti-Malware Core.1.1.2.123.x64	19.12%
Anti-Malware Core.1.1.2.118.x64	1.47%
Anti-Malware Core.1.1.1.244.x86	1.47%
Anti-Malware Core.1.1.1.244.x64	1.47%
Anti-Malware Core.1.0.1.118.x64	16.18%
Anti-Malware Core.1.0.0.1921.x86	1.47%
Anti-Malware Core.1.0.0.1921.x64	1.47%

mcshield.exe has 9 known versions, the most recent one is Anti-Malware Core.1.1.3.164.x64. It is started as a Windows Service called 'McAfee Anti-Malware Core' with the name 'mfecore' and described as “McAfee OnAccess Scanner”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 909.42 KB. It is an authenticode code-signed executable issued to McAfee by the certification authority VeriSign. Some variations of the file have been seen to be installed with the program Lenovo Patch Utility 64 bit from Lenovo. This is a .NET Common Language Runtime (CLR) assembly. During the process's lifecycle, the typical CPU resource utilization is about 0.0031% including both foreground and background operations, the average private memory consumption is about 277.29 MB. Addionally, typically read and write I/O disk operations is about 65.17 MB per minute for reads and 415.85 KB per minute for writes.

McAfee On-Access Scanner service features true blocking On Access Scanning. It scans every file being accessed from or written to the machine and blocks infections if any. On Access Scanner can be configured to scan on Read Only, Write only or both. It can also be configured to scan files on network volumes.