"cmdagent" is vexing awful

[Guest]

[RealOldNick]

I understand the vexation of those suffering this, as I have had it myself. But about now, can we start posting OpSyses etc to see if there is a triggering factor. As I say I had this exact trouble, but not for quite some time, so I am wondering if there is a set of circumstances that set it off.

I realise that this could be VERY tough to ID, but maybe it's worth a try to work together: I would hate for people to dump a fine suite for the lack of study by all concerned. 

The thing was that my problem only (well 98%+) occurred when I opened a particular folder on the desktop that had various programme in it. They were "Utility" type programmes that would probably need deep access to the system....uninstallers, registry fixers etc.  I do not see it any more and I may have "trusted" them or something.....

Just mu $200,000.00 worth in these inflated timez. 

[mouse1]

A project for the weekend, I think, or even for the Christmas holiday.

I do wonder if it would not be wiser, once I have uninstalled CIS, to change to Avast AV and another firewall. The continuing problems with cmdagent are getting a bit much, and I long for an uninterrupted period of trouble free operation. I can always try CIS again in another six months or so, to see if anything has changed.

Anyway, I'll keep you informed of future events. Thanks for the help, Mouse.

John

Entirely up to you. You could try just importing the low cpu file in the post with or without rebooting, see if that works

Note that running more than one security program often causes problems, as do security program remains. You may be lucky, or you may tread the same path in another forum....

To do the whole lot, and efficient sequence would be:
1) Make restore pt. Run CIS uninstaller, and other AV unistallers reboot
2) Run forced CIS uninstaller and other AV forced uninstallers reboot
3) Optionally run forced CIS unistaller again then reinstall CIS, reboot
4) Import low cpu config file, reboot

I'd say about 1 hour with four reboots.

[mouse1]

I understand the vexation of those suffering this, as I have had it myself. But about now, can we start posting OpSyses etc to see if there is a triggering factor. As I say I had this exact trouble, but not for quite some time, so I am wondering if there is a set of circumstances that set it off.

I realise that this could be VERY tough to ID, but maybe it's worth a try to work together: I would hate for people to dump a fine suite for the lack of study by all concerned. 

The thing was that my problem only (well 98%+) occurred when I opened a particular folder on the desktop that had various programme in it. They were "Utility" type programmes that would probably need deep access to the system....uninstallers, registry fixers etc.  I do not see it any more and I may have "trusted" them or something.....

Just mu $200,000.00 worth in these inflated timez. 

This is a good idea. Obviously the FAQ addresses some specific problems but there is much to learn. Happy to retrofit into the FAQ anything discovered.

The specific problem you mention I do know about, though it seems improved in 5.8. I think it related to the fact that icon files are being examined by CIS as they were loaded for display in explorer. I used to work around by increasing XP icon caching, but I could not get that to stick. Probably if you excluded all icon files from AV that would work too, but not sure regarding the risks. It would need a generic trust *.ico or some such.

[Needlejockey]

I've been thinking along the same lines. The basic problem may be the tendency of cmdagent to check for updates to the AV db whenever it scans a file - which is very often indeed. No wonder I have time for a pint and a walk with the dog after starting up Photoshop.
Would it not be much simpler to let cmdagent check for updates every hour, two hours or whatever, instead of each and every time it scans a file? My usual haunts (Photoshop, Access, Filemaker, Word, Firefox etc) open lots of files when starting up, and a db re-check for each file seems very wasteful to me. All right if you're using a multi core processor, but not on my ancient AMD Turion laptop.

John

[mouse1]

I've been thinking along the same lines. The basic problem may be the tendency of cmdagent to check for updates to the AV db whenever it scans a file - which is very often indeed. No wonder I have time for a pint and a walk with the dog after starting up Photoshop.
Would it not be much simpler to let cmdagent check for updates every hour, two hours or whatever, instead of each and every time it scans a file? My usual haunts (Photoshop, Access, Filemaker, Word, Firefox etc) open lots of files when starting up, and a db re-check for each file seems very wasteful to me. All right if you're using a multi core processor, but not on my ancient AMD Turion laptop.

John

The low cpu config file already allows you to control av updates. There's a fake scan 'scan to control AV updates'. Just set the schedule for this.

[Needlejockey]

Yes, Mouse, thanks. I'd already read about that. But it seems an unnecessarily complicated way of doing things. Much better to have an option "check for updates every xx hours", and everyone can fill in what he of she considers suitable, including "0" for real time checks. Just a thought for the next update...

Best regards,

John

[mouse1]

Yes, Mouse, thanks. I'd already read about that. But it seems an unnecessarily complicated way of doing things. Much better to have an option "check for updates every xx hours", and everyone can fill in what he of she considers suitable, including "0" for real time checks. Just a thought for the next update...

Best regards,

John

Agreed, add it to the wishlist, but it may take some time...... unfortunately making CIS run on slower computers is unlikely to be high priority.

[Needlejockey]

As an afterthought, here is a low speed Task manager tracing of CPU activity while I'm just watching the screen and doing nothing. Every 4'20" cmdagent goes mad for 60".

Only background activity: uTorrent. No Java, Apple or any other updaters other than SuperAntispyware active, and that one has been set for eight hour intervals. Mailwasher server check is every 10'.

No idea what's going on here.

Separately, there is of course the heavy cmdagent activity when opening a file, and most proggies open quite a lot of them when starting up.

John

[RealOldNick]

This is a good idea. Obviously the FAQ addresses some specific problems but there is much to learn. Happy to retrofit into the FAQ anything discovered.

The specific problem you mention I do know about, though it seems improved in 5.8. I think it related to the fact that icon files are being examined by CIS as they were loaded for display in explorer. I used to work around by increasing XP icon caching, but I could not get that to stick. Probably if you excluded all icon files from AV that would work too, but not sure regarding the risks. It would need a generic trust *.ico or some such.

That would certainly be a reason. It was just funny that it was only one folder that caused it and then not always.

Having made my bright idea, I can't really contribute, as I do not have the problem any more. IU am not aware of what happened to stop it. It just went away  If anything happens I will jump in.

[mouse1]

That would certainly be a reason. It was just funny that it was only one folder that caused it and then not always.

Having made my bright idea, I can't really contribute, as I do not have the problem any more. IU am not aware of what happened to stop it. It just went away  If anything happens I will jump in.

Well I'm guessing that this might depend on the variety of icons in a folder. When you have the same icon, you have a pointer to the icon file. Under stateful this would only be scanned once per boot session. However that's not quite how the behavior seems, so maybe there's more involved.

[RealOldNick]

You are correct. For me, it would happen more than once in a boot, but not predictably, except it was always that folder. It would not allow the icons to show until it was finished, or that was what appeared. It may simply have made the PC so busy it was not bothering with screenery.

[mouse1]

As an afterthought, here is a low speed Task manager tracing of CPU activity while I'm just watching the screen and doing nothing. Every 4'20" cmdagent goes mad for 60".

Only background activity: uTorrent. No Java, Apple or any other updaters other than SuperAntispyware active, and that one has been set for eight hour intervals. Mailwasher server check is every 10'.

No idea what's going on here.

Separately, there is of course the heavy cmdagent activity when opening a file, and most proggies open quite a lot of them when starting up.

John

It's possible these are AV updates, as they have increased frequecy, but this seems a bit frequest. To check switch them off on the AV ~ real time tab.

A technique I did not refer to in the FAQ, but which is worth a try is to add the cpu history and i/o history column to a process explorer (see below) display, stretch out these columns and watch for cmdagent peaks. Look for an I/O or cpu peak in an executable just before or at the same time as the cmdagent peak. Any reasonably strong correlation is a suspect.

If you find a suspect you can look at the graphs in more details by looking at them in the properties of cmdagent and the suspect file

Using this I found that the fact that a router monitoring program (routerstats) was writing huge image files (graphs) to the disk. Excluded this directory [edit: under AV exclusions], and all was well.

[Edit] Process explorer is now a microsoft program, download from: here.

[Needlejockey]

Good idea, Mouse, will do. Another weekend job, I think.

Will keep you posted.

John

[mouse1]

 

Once you identify the program you can work out exactly what cmdagent is doing using sysinternals (ie microsoft) procmon.exe. But that's more difficult - procmon is a very deep and powerful program.

[Needlejockey]

The problem solved itself as I [finally] changed to a new Win 7 64 bit computer.
again, not without CIS problems: see the new "Tray icon disappears"  thread.

John

[Tags:]