cfp.exe eats 1 core when allowing an application [NBZ]

The bug/issue
1. What you did:
Opened an application D+ did not recognise, was greeted by the normal box asking me to allow or deny.
2. What actually happened or you actually saw:
Upon clicking allow, the application froze and when I opened task manager, I saw cfp.exe was using 25% cpu. It also increased in memory usage, from ~2500k to ~11000k. About 2 minutes(!) later the application continued to run as expected.
EDIT: I forgot to mention that attempting to open the UI has no use at this point, it does not open until cfp stops using the CPU. If the UI is already open it becomes completely unresponsive.
3. What you expected to happen or see:
The application should have instantly been allowed to continue instantly with
4. How you tried to fix it & what happened:
Set D+ to disabled, everything runs smoothly.
5. If its an application compatibility problem have you tried the application fixes here?:
This happens whenever I am asked about an application.
6. Details & exact version of any application (execpt CIS) involved with download link:
http://www.creativelement.com/powertools/
This was the application I was using. I was trying to force a file association with this tool because the one in windows was broken for some reason.
However, this problem happens whenever D+ asks me to make a verdict, REGARDLESS OF THE APPLICATION IN QUESTION.
7. Whether you can make the problem happen again, and if so exact steps to make it happen:
Find an app not on D+'s safe list, set it to Clean PC mode, wait for popup.
8. Any other information (eg your guess regarding the cause, with reasons):
I think it is happening because D+ has to open the entire safe files list every time it wants to add a new rule to it. My safe files list is quite big (I think) and when opening it from the UI it takes more or less a minute to open.


Your set-up

1. CIS version, AV database version & configuration used:
CIS 5.3.176757.1236, Antivirus NOT INSTALLED.
2. a) Have you updated (without uninstall) from CIS 3 or 4: No
b) if so, have you tried a clean reinstall (without losing settings - if not please do)?:
3. a) Have you imported a config from a previous version of CIS: No
b) if so, have U tried a standard config (without losing settings - if not please do)?:
4. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.):
Create rules for safe applications is ticked, Sandbox is disabled, Image execution control is enabled.
5. Defense+, Sandbox, Firewall & AV security levels: D+= , Sandbox= , Firewall = , AV =
D+= Clean PC
Sandbox = Disabled
Firewall = Safe Mode
AV = Not installed
6. OS version, service pack, number of bits, UAC setting, & account type:
Windows 7 Professional, N/A, 64, disabled, Administrator.
7. Other security and utility software installed:
Microsoft Security Essentials
8. Virtual machine used (Please do NOT use Virtual box):
N/A

Windows 7 x64 Professional
Core2Quad Q9550 [at] 3.4GHz
4GB DDR2-1066 RAM
GTX460 1GB.

EDIT: Added config file.

[attachment deleted by admin]

I thank you for taking your time to fill in the bug report.

(This is not a bug but a d+ problem.)

have you tried to add this file in d+ rules?

Regards,
Valentin N

Thank you for your bug report in the required format.

Moved to verified.

Thank you

Dennis

Thanks for the quick reply :slight_smile:
If the application is already on the safe list and CIS doesn’t make its popup then everything is fine. The only time this happens is when I either allow or deny an application through the popup.

I would appreciate if you could make a new thread in d+ sector; I don’t want to make the thread with offtopic comments.

Regards,
Valentin N

Just a quick update, if I uncheck the “remember my answer” option in the popup CIS does not hog the CPU and the application in question runs perfectly, so it must be struggling to create a new rule or something.

When it saves the rule it saves it to the registry, this problem usually only occurs if you have a lot of rules as you are running in CleanPC mode this should not be the case.

Dennis

With the release of SP1 I reformatted my machine today and now things are instant with the popup - no more waiting around for cfp to wake up. If the issue resurfaces I’ll report it again.

Actually, this issue has existed at least since v3. It is because it seems to reload the entire d+ rule set every time you add a rule to it. Once the list reaches sufficient size (more than 50-100 rules; not sure at which end, but I do not have an unreasonable number of programs installed), any update will take anywhere between 10 and 60s depending on the actual size of the d+ rule set. Interestingly, the firewall ruleset does not show this behavior.