I ran a full scan. After 150K objects in 2 hours (with pauses in the middle when I needed the CPU/disk) the system started being non-responsive, also after I paused the scan. Turns out the cmdagent.exe VM size was 900MB (according to Taskmgr).
I stopped/closed the scan, answered “yes” to confirm, but the scan popup stayed. I tried stopping/closing again, again “yes” in the confirmation dialog, without result. The VM size continued climbing to about 1.3GB until I ended the task from Taskmgr.
Setup:
XP SP2 32-bit
Sandbox/Defence/AV set to “disabled”
Log window open (so that I could see what’s going on during the scan)
Maybe the problem is specific to what it scans in this partition.
After a system restart and starting to scan from the partition it reached last time, I reached similar problems after 15 minutes and 20K objects, including inability to fully stop scan and rapidly climbing VM size when trying to do so.
Did you change the setting to skip files bigger than 20 MB? If so to what size did you set it?
Also tell us what file was causing CIS to hang. Follow How to determine which file is causing a manual AV scan to hang for reference.
Max file size to scan is the default 20MB. (Heuristics low, archive scanning off).
It doesn’t get stuck per se. It continues scanning even after pause/stop, although the filename status line doesn’t update. In one test it did settle eventually, maybe after a few more tens of files, but not to the point of closing or releasing memory, just no more new files scanned.
The specific directory it’s having trouble with (assuming it’s a specific one) holds about 3800 files, mostly DLLs. The largest is 8MB, most are far less. The final file handle it held in the one test where it settled eventually didn’t do any problems when scanned by itself.
Another observation: it happens also on context-menu initiated scan, in which case the memory increase is in cavscan.exe.