"cmdagent.exe" Uses Unusual Amounts of Memory [NBZ]

The bug/issue

  1. What you did: Nothing.
  2. What actually happened or you actually saw: I saw (and still see) the high memory usage of cmdagent. Process Explorer shows that cmdagent.exe is currently using “275,180 K” in the Virtual Memory - Private Bytes section. According to Wolfram|Alpha, this is 275.2 MB.
  3. What you expected to happen or see: If I recall correctly, cmdagent usually used about 15 MB.
  4. How you tried to fix it & what happened: I’ve tried nothing.
  5. If its an application compatibility problem have you tried the application fixes here?: I haven’t tried to fixe any compatibility problems.
  6. Details & exact version of any application (except CIS) involved with download link: N/A.
  7. Whether you can make the problem happen again, and if so exact steps to make it happen: The problem is continuely happening.
  8. Any other information (eg your guess regarding the cause, with reasons): mahg confirmed that it is a problem with the virus signatures:

Files appended (Please zip unless screenshots)

  1. Screenshots illustrating the bug: Screenshot from Process Explorer.
  2. Screenshots of related CIS event logs and the Defense+ Active Processes List: D+ Active Processes List attached.
  3. A CIS config report or file: Attached (although I’m not sure it will be useful).
  4. Crash or freeze dump file: N/A.

Your set-up

  1. CIS version, AV database version & configuration used: Product version: 5.3.181415.1237. AV database version: 8027. I used a customized Internet Security configuration (more like proactive).
  2. a) Have you updated (without uninstall) from CIS 3 or 4: I think I did I clean install from CIS 3…but I have let CIS do the minor updates itself.
    b) if so, have you tried a clean reinstall (without losing settings - if not please do)?:
  3. a) Have you imported a config from a previous version of CIS: No.
    b) if so, have U tried a standard config (without losing settings - if not please do)?:
  4. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.): I have checked all Defense+ monitoring settings. Block all unknown requests and Adaptive mode are both disabled.
  5. Defense+, Sandbox, Firewall & AV security levels: D+= paranoid, Sandbox= disabled, Firewall = custom policy, AV = disabled.
  6. OS version, service pack, number of bits, UAC setting, & account type: Windows 7 Ultimate, SP1, 32bit, UAC off, admin account.
  7. Other security and utility software installed: None running in real time, besides some browser plugins. MBAM, Hitman Pro, and Wuzzup installed for on-demand scanning.
  8. Virtual machine used (Please do NOT use Virtual box): None.

Other

There are other threads which also report memory issues:
Peak memory usage and low mem PC’s
cmdagent.exe too big
Memory usage increase
RAM after updating

[attachment deleted by admin]

Oops, I feel a bit bad. That is the virtual memory I was talking about… :-\ The physical working set was just about 4 MB.

However, I just enabled the real time scanner, and now cmdagent is at 100 MB (physical working set) and climbing (edit: it is also jumping around all over the place).

The other links, however, also are legitimate.

I forgot to follow the format’s reports and, as I can see, LaserWraith is experiencing the same issue so I’ll contribute this post with some additional information.
I’ve experienced in 4 different computers the same issue. Virtual memory of cmdagent increases up to 300 MB. Computers tested were 1 Windows 7 x32, 1 Windows 7 x64 and 2 Windows XP SP3 so it’s a real bug.
It happens since 1 or 2 days ago and it seems to be related to the virus signature. If I unistall and install CIS again everything works fine until I update the virus signature.
Even more, in Windows 7 x64 it freezes CEVPN when trying to send a message and then the whole system freezes.
I’ve actually have unistalled CIS waiting a solution.

Nice work LazerWraith.

To put this in perspective, the commit charge of a XP computer was around 200MB with all drivers and software installed. After the latest Commodo plus CAV and updates, it shot up to 600-700MB, even higher during scans and updates!

We are talking about 10-20MB physical mem normal use, 60-300MB scans and updates, 120-300MB VM use. The last two seem very large. In comparision, Avast uses 20-70MB physical and 30MB VM. Sometimes a bit more with the web shield, but nowhere near CAV levels.

Plus it is quite heavy on the CPU, quite a bit more than Avast, but that’s not a bug just an observation. I know you guys are woking hard to improve CAV and other anti-virus solutions have had a big head start - you’ve done a good job the last few years to get where you have. It will be nice to see it refined for resource and CPU usage going forward too, but recognize that may be a long task before real improvements surface.

It would be nice short term to get the VM usage back down to lower values and try to limit peak based on how much free mem is available, but the way you handle updates and archives/large files may be limiting how mem is used.

What I like though, is stateful scan speed is really fast during normal use, which is one of the most important aspects of an Antivirus.

Is anybody working on this?
Several users have reported the same problem.
Will this memory usage the normal behaviour from now on?

Usually, when a new release comes out, I install it on a separate system for testing. This release is no different. Typically, I don’t use the AV and this installation is no different, but over the last several hours I’ve seen little difference in resource utilisation between 176757 and 181415.

I’ll do another install with the AV later.

The problem would appear to be the AV component. I performed a fresh install on a clean system. This time the AV was installed, along with D+ and the firewall.

I immediately noticed the system was considerably slower booting, taking at least twice as long to reach the desktop than the previous installation without the AV.

Investigation of the resource utilisation shows cmdagent using approximately twice as much physical and virtual memory than without the AV installed:

Without AV:
Physical Memory ~ 33Mb
Virtual Memory ~ 160Mb

With AV:
Physical Memory ~ 266Mb
Virtual Memory ~ 440Mb

Once a scan is initiated the resource utilisation increases, with peak values reaching:
Physical Memory ~340Mb
Virtual Memory ~ 680Mb

The system overall feels more ‘sluggish’ with the AV installed.

The test system is using Windows 7 Ultimate SP1 x86
No additional software installed

if I get time, I’ll take a look at the performance on an x64 system.

Thank you for your bug report in the required format.

Moved to verified.

Thank you

Dennis

You’re welcome…I saw a few reports not in it, and decided to make the effort. :stuck_out_tongue:

BTW, what is “WBZ” (added to the title)?

Hi Mods,

Any solution on the horizon?

Reading the AV update page, it appears this is by design:

https://forums.comodo.com/news-announcements-feedback-cis/comodo-av-database-update-page-t34216.0.html;msg503545#new

It looks like Comodo puts the entire sig file in virtual memory, and has to balloon to this size during updates and loading (high peak mem use), sometimes during scanning.

I think the sig is getting a little too big for virtual mem dumping! :stuck_out_tongue:

I don’t think it’s by design. Virus signature can’t doble its size from one day to another. There must be a reason.
Furthermore I posted that, since this occurs, CEVPN doesn’t work in Windows 7 x64, so I guess there is another explanation.

VM is back to normal size!!!
I realized this morning that cmdagent takes only 129MB!!!
It seems that everything is back to normal.
Virus definition is 8068.

Someone can give us an explanation?

Tested on XP SP3 -129MB- and W7 x64 -150MB-

I confirm this : cmdagent.exe is back to normal size 129M

Thanks guys

Yep, back to normal levels so it was a bug! Thanks for the quick fix.

Comparing Comodo to the two leading free alternatives, Avira and Avast, CAV is MUCH better on resources than Avira 10 (whgich also seems to create some strange extra processes in task manager) but a little behind Avast on Scans and updates.

Still, a full security suite that only uses 10-20MB of physical mem during normal use is pretty darn impressive.

129 MB, even virtual memory, seems like a lot. Does virtual memory impact system performance much?

It is nice that the physical memory is staying around 14 MB, now. :stuck_out_tongue:

I agree LaserWraith, it seems like a lot but I tried Avira free and it used much more resources! I think Microsoft Security Essentials uses a lot too, even Windows Defender grabs a good chunk, so it’s not unusual.

130MB VM isn’t an issue on an old PIII 700 laptop with 384MB RAM, so I’d say it has little impact on performance as long as it doesn’t continue to grow due to a memory leak. 300MB was pushing it however as it was using a big chuck for one program, especially on a 32bit system, and that did need addressing.

The biggest performance hit comes from high physical mem use while running normally, and as you said Comodo is awesome in that area. It does peak out a little high on updates and scans, but so do all other virus checkers from what I can tell. Also in the same scenario (updates, scans) it can get a little CPU heavy, especially on single core systems.

Ignoring detection rates and just from a software engineering point of view, Avast still has the best engine in my opinion by quite a margin. Low resource usage (including very low VM, speedy efficient updates and good CPU use) and is the only one that caches to speed up repeat scans. I’d place Comodo next in line equal with a few others even with its raised VM, which doesn’t really affect anything.