A. THE BUG/ISSUE (Varies from issue to issue) Can U reproduce the problem & if so how reliably?:
Every time. Once per 24 hours (update intervall) If U can, exact steps to reproduce. If not, exactly what U did & what happened:
1:DISABLE EVERYTHING related to scan when idle. This includes disabling cloud lookup, scheduled scans, the cache builder, and the option to “Enable scanning optimizations”.
2:Set updates to 1 update per 24 hours, to ensure that no new cavwp.exe gets spawned with a new cpu time meter.
3:Let the computer idle
4: Once per update interval the HDD and CPU will suddenly be running high for cavwp.exe for about 8 minutes.
5. This activity stops as soon as the mouse is moved, or anything else which stops the computer form idling. One or two sentences explaining what actually happened:
EACH day 8 minutes cpu time/+long hdd usage without instruction. When computer is idle. It even detected a false positive while that. One or two sentences explaining what you expected to happen:
That it follows the settings If a software compatibility problem have you tried the conflict FAQ?:
None Any software except CIS/OS involved? If so - name, & exact version:
None Any other information, eg your guess at the cause, how U tried to fix it etc:
Did all settings to have only a guard (+optimize the guard, WITHOUT cache building).
For more information please see the topic here: https://forums.comodo.com/antivirus-help-cis/antivirus-consumes-cpu-time-on-idle-t105368.0.html
B. YOUR SETUP Exact CIS version & configuration:
CIS 7.0.317799.4142
Current CIS, proactive, all high, av set as guard, no sb, no cloud, no lookup Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
Proactive, high, AS off, fw high, av guard Have U made any other changes to the default config? (egs here.):
Sure Have U updated (without uninstall) from CIS 5 or CIS6?:
No if so, have U tried a a a clean reinstall - if not please do?:
- Have U imported a config from a previous version of CIS:
No if so, have U tried a standard config - if not please do:
NA OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 7 64 bit Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=None b=None
Thank you for adding the format to the first post. That is very helpful. I made some changes. Please make sure everything is correct.
Also, I had a few questions/clarifications. First, please specify all settings which you disabled for step 1. I want to make sure that no settings are missed when this is forwarded to the devs.
Also, when you say that we can see the CPU and HDD being used unnecessarily, does this always occur at the same time? If so, do you mean that it always happens for the 8 minutes previous to an AV update?
In addition, please note the CPU levels you are seeing at these times. This information will be very helpful.
Also, I do not understand how it is the same issue if you see high levels when an application is being detected. Shouldn’t we expect high CPU levels when it is actively scanning/quarantining a program?
Finally, please fill out the previous security software which used to be on your computer, but are now removed. If the answer is none please write none.
Please let me know if you have any questions as well.
It only happens when computer is idle.
NOT at a specific time.
NOT every idle.
Only once per update intervall.
Sometimes it happens early, thats when i saw the ghostly hdd activity. It imediately stops when moving the mouse (the cpu usage is getting interupted then… lets say 2 minutes as an example)
But chances are very high that you can see the 8 minutes (try with a full HDD of more than 320gb) happening once between EACH update per 24 hours. (As the process gets new, you need to check BEFORE the new update).
Once a false positive got detected while that activity. In a random BIG folder with some games in it.
I disabled
lookup, cloud, timely scans, profiles, cache.
The ghost scan for this day havent happened in the idles today allready. (Sometimes it allready would have).
So i left the computer running for a bit. And not long after i have seen the hdd working when checking the machine.
The cavwp.exe action stopped imediately when moving the mouse.
Taskmanager showed close to 8 minutes.
Thank you. I have again updated the first post. Please look it over and let me know if everything looks correct.
There are still a few more things I would like to know. Unless I have missed it, please let me know how high the CPU cycles are running for these 8 minutes.
Also, when you say you saw the same behavior when a false positive was detected, do you mean that it detected the false positive while idle, and you then saw the same HDD and CPU behavior for 8 minutes following that detection?
In addition, please create and attach a diagnostics report and KillSwitch Process List to your first post.
How should i know how high the cpu cycles are if comodo acts like a malware that starts to act if a person is not using the computer? Not on the same time. Not calculatable? Hidden? Suspicious? Useless?
Comodo just detected a false positive one day while i wasnt at the computer.
In a game folder of a game that didnt run for days.
I will not send diagnostics, and stuff.
Your bug report procedure feels stupid.
Instead of just trying it yourself you ask for more and more things.
Just try it yourself.
How about that?
I am speaking about this for 2 months now. I dont want to know what happens if you have set updates to 6 hours. And your HDD gets tortured several times a day. And you dont even know about that because cavwp gets sneaky renewed after each update. So it looks as if cavwp.exe would use as less cpu time as other antivirus. While its a system hog.
I allways found it suspicious that cavwp gets renewed after an update… Now we know the reason.
I’m sorry that you are experiencing this, but only after fully fleshing it out can the devs have a chance of finding out what is causing this. Also, if you don’t know how high the CPU usage is then how do you know that the CPU is being raised by cavwp.exe? Also, you can use a program such as Compact Tray Meter (which I use) to track the CPU usage and HDD usage. Please try that to make sure that both are actually being raised during that time.
Perhaps this means that it was scanning the folder. I’m not entirely sure how it works. Sorry, but perhaps it’s best to focus on the incidents which happen without detections.
I’m sorry you feel that way. I am trying to flesh this out so that I can forward this to the devs. However, we first need to identify, as best as possible, what may be causing this.
I’m sorry, but in general I do not have time to check every bug and wish. In fact, currently my schedule is so busy I am stretching myself thin just to keep up with the bug and wish boards, let alone check them. Please do remember that I am a volunteer Moderator.
This may be true. I think that installing a program to monitor the HDD and CPU usage should be able to shed some light on this. Please do so and let’s see if we can narrow down what is causing this.
By the way, what do you mean when you say that cavwp gets renewed? Also, what have you seen that makes you so certain that it is cavwp which causes this increase in usage?
Look,
in process explorer you can see the cpu time of a process.
It is on 8 minutes once each day.
If i interupt the hidden comodo action by moving my mouse, its LESS than 8 minutes, but higher than normal usage.
So i KNOW its cavwp exe and its waste of scanning.
The hidden action takes AT LEAST 10 minutes realtime.
So to name it:
Comodo wastes +10 minutesx364=3640=like 3 days AT LEAST per year for nothing. I guess its rather a week AT LEAST, IF you have set updates to ONCE a day… … maybe even 4 times the amount if you set it to update more often
You dont have to do anything sepcific to see it yourself.
Just look in process explorer BEFORE THE NEXT UPDATE.
Okay, so in that case I understand that it’s doing something for 8 minutes which is not explained in the Help File. I’m not sure what that is, but it certainly seems looking into.
So i KNOW its cavwp exe and its waste of scanning.
The hidden action takes AT LEAST 10 minutes realtime.
Okay.
Let me ask the Mods and see if anyone has any thoughts for what this may be.
I’ll ask about why the process would be replaced/refreshed as well.
Please respond to the topic you created here. I have alerted Captainsticks to this question, and he is trying to figure out why this is happening, and whether it is intentional or not. Your other topic seems very closely related.
For the time being I will move this topic to Resolved. clockwork, if it becomes clear that this is caused by a bug, and not confusing behavior of the process, please respond to this topic.