Stateful Virus scanning-excessive scanning causing application degradation

The bug/issue

  1. What you did:

Run NikonScan using LS9000 scanner.

  1. What actually happened or you actually saw:

Scanning medium format film at 4000 dpi 16bit with digital ICE turned on causes the stateful virus scan to start re-scanning all of the dll, exe, and helper programs that wind up getting paged out during the initial film scan (approx 580MB image data yes more than half a gigabyte). It also starts scanning the pagefile. Once the stateful virus scan gets going (cmdagent) it causes the second part of the scan (DigitalICE) to stop start stop start constantly. Sometimes causing the a process that should take approximately 4 minutes to take as long as 10-15 minutes.

I should add that I also had Opera running with many tabs, using close to 400 MB of RAM, so 32 bit address space was pretty full.

I know which files were getting scanned by looking at Windows resource monitor. I could see cmdagent reading many of the DLLs used for digital ICE and eventually the pagefile itself.

What seems to be happening is that for 32bit programs Win7 64bit will allocate a certain amount of memory that all 32 bit programs then share, causing paging before all memory in the system is actually used. It also seems to silo them to using a single core because from what I could tell the most CPU usage NikonScan and cmdagent combined used was 25%. I have a four core AMD Phenom II CPU. You could see cmdagent using more and more CPU as the film scan went on. Nikon scan by itself can easily use a full core to its max. I think the problem was cmdagent would rescan the Nikonscan digital ice dlls everytime it would call them to do that processing. In other words NikonScan reads some data, dlls get paged out, it then needs them to do the Digital Ice processing, cmdagent scans them. Repeat and cmdagent winds up getting in the way re-scanning them over and over again.

FYI Digital Ice is a dust removal process that uses infrared light to detect where the dust is and remove it from the scanned image.

  1. What you expected to happen or see:

For the film scanner to scan smoothly ie not start stop start stop start stop start.

  1. How you tried to fix it & what happened:

I disable the stateful virus scan, and the film scanning process goes smoothly without the constant stopping and starting.

  1. If its an application compatibility problem have you tried the application fixes here?:

The film scan actually completes and there are no issues running NikonScan as it was intended to run. The stateful virus scanning just causes horrible degradation in the film scanning speed.

  1. Details & exact version of any application (execpt CIS) involved with download link:

Unless you have a Nikon scanner it isn’t going to do you much good but here it is in case you want to look at the contents of the installer If you actually want to install it under a 64bit Windows you need to use the inf located here Getting a Nikon Scanner to Run on 64-bit Vista - Photo Tips @ Earthbound Light

Yes, a bit of hacking needs to be done to use NikonScan on 64bit Windows but it works fine, and only stateful AV scanning causes degradation when trying to do a memory intensive film scan.

  1. Whether you can make the problem happen again, and if so exact steps to make it happen:

It happens every single time, no matter what. I’m sure if the only thing running was NikonScan and nothing else it would happen less or not at all due to lack of paging.

  1. Any other information (eg your guess regarding the cause, with reasons):

See above.

Files appended. (Please zip unless screenshots).

  1. Screenshots illustrating the bug:


  1. Screenshots of related CIS event logs and the Defense+ Active Processes List:

N/A since it is the stateful AV scanning causing the issue.

  1. A CIS config report or file.

Config is attached

  1. Crash or freeze dump file:


  1. Screenshot of More~About page. Can be used instead of typed product and AV database version.

Your set-up

  1. CIS version, AV database version & configuration used:

5.5.195786.1383 AV db 10424

  1. a) Have you updated (without uninstall) from CIS 3 or 4:
    b) if so, have you tried a clean reinstall (without losing settings - if not please do)?:

No this is a new computer as of February 2011.

  1. a) Have you imported a config from a previous version of CIS:
    b) if so, have U tried a standard config (without losing settings - if not please do)?:

No see 2.

  1. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.):


  1. Defense+, Sandbox, Firewall & AV security levels: D+= , Sandbox= , Firewall = , AV =

AV=stateful, none of the other matter because once I disable AV I have no issues.

  1. OS version, service pack, number of bits, UAC setting, & account type:

Windows 7 64bit, UAC on, administrator account.

  1. Other security and utility software installed:


  1. Virtual machine used (Please do NOT use Virtual box):


[attachment deleted by admin]