How violating KISS can end up in 100% CPU usage by your antivirus

Hi all,

I have been using an antivirus/firewall product on 4 of my computers, 2 desktops and 2 laptops, for more than a year without any troubles and was more than happy for the money I paid for it.

However at some moment I noticed that the my IBM ThinkPad X41 was extremely slow. Process Explorer would show CPU utilization being constantly at 100% and the culprit was the executable of the antivirus software.

If I disabled the antivirus real-time protection then CPU went down to normal. When I reenabled it then back to 100%.

To start with I left the laptop open for a couple of days so maybe the antivirus would get done with something it was doing but of course that was a silly thought without results. Then I tried to uninstall and reinstall it but this was just another silly thought and of course the problem remained.

So I decided to use the artillery. I opened up Process Monitor by SysInternals just to take a look at what the antivirus was doing.

Suprise!

It was scanning over and over a 9MB html file!

The location of this file?
C:\Program Files\ThinkPad\ConnectUtilities and the name of it AddConnAdvanced.html

So I added this file to the exclusion list and my laptop became normal again.

I thought maybe my laptop downloaded some software update that screwed things up, so I decided to look at what could a 9MB html file possibly hold...

Surprise (again)!

It was the IBM diagmostics utility debug log...

Then I remembered... I had a problem with the wifi on the laptop about two months ago. So I turned on the debug diagnostics and of course forgot it on even after I solved the problem.

It seems that the IBM developers wanted to appear slick I guess, so a .TXT file was not good enough for them but instead they output an HTML file which eventually gets huge, it is an HTML file so it gets scanned by adivirus software because it might be malicious, ending up in a frustrated user >:( .
Bravo! Way to go!

I do device driver development for a living and as a result I have a "lean and mean" mentality, some also call it KISS (Keep It Simple Stupid). I just hate it when people use HTML/XML for something that could be done with a plain txt, or use .NET for a config utility because they want to add a silly jpg on the dialog and don't know how to do this in plain Win32.

Things are simple: When you do more than you absolutely have to, then you increase your application's "problem surface". More and more things can go wrong and you DON'T want things to go wrong with low level stuff like debug logs and config utilities.

To understand the extent of this problem, that is doing more than you have to just because it is cool, be amused to know that some PhD guys that obviously hadn't do much programming in their lives, designed a camera specification called Genicam, and designed a feature by which the camera could send to the application a file that describes in a standard format all of its settings. This "standard" format of course was XML and everybody was so happy and cool. Of course the time came to write a device driver for such a camera and guess what? How on earth do you fit an XML parser in kernel mode code? Only if you want to play cowboy and device driver developers usually don't have much free time to play cowboy. Using XML, which is user mode crap, for some simple text information that NEVER changes is against KISS.

Dude, do I hear someone saying "but what about schema validation etc"??? We are not talking about a file that got created by a user. We are talking about a file that gets stored inside a camera by the manufacturer. IT BETTER BE IN THE CORRECT FORMAT.

Anyway, although the antivirus is not to blame for my troublesome situation, but it would help if they provided some statistics screen/report with the most scanned files so we can solve such problems in an easier way, without using super natural powers.

Tip: If a similar thing happens to your PC and it is so slow that it is almost unusable because a process is taking 100% CPU and you don't want to kill the process (so that you can study what is going on) then try lowering the process priority of the offending process. This will permit you to use your computer again so that you can solve the problem.

Have fun,
Dimitris Staikos

Comments

[refurbished computers]

i have read all the content that you have mentioned above it is very useful and informative, couple of weeks ago i was also having same issue might be the reason was same.