Anti-Virus blocking execution of Cicode functions

Hello all,

We are running CitectSCADA 2016 on a server that is running Cortex XDR anti-virus. We have found that this Anti-Virus software "stalls" the execution of some applications for 30 to 50 seconds before allowing the application to run. For example, when we start the compiler, there is a 40 second delay before the compiling window with the progress bar is displayed. Same thing when we launch de cicode editor, etc. To fix this problem, we have excluded from the anti-virus analysis the Citect\bin directory.

However, we still have some problems. We have a button on each screen that enables us to do a screen capture by calling the WinFile(sFileName) cicode. When we use this button, Citect freezes (we see this because the system clock displayed on top of our Citect page stops refreshing for 40 seconds). This is probably because WinFile is a blocking function. What I think is happening is that the WinFile cicode function is calling a process to capture the screen and copy it to the specified directory but the Anti-Virus is analyzing this process and delaying it's execution. 

What I am having difficulty figuring out is what exactly does the WinFile function execute so that we can exclude it from the anti-virus scan. If we disable the anti-virus, there is no delay so I am certain that this is what is causing this delay. Obviously, our IT department does not want to disable the anti-virus so we have to find exactly which files or directories to exclude from the analysis. 

Any help regarding this would be greatly appreciated.

Patrice Jacob

SCADAlogik inc.

Parents
  • I believe WinFile creates a new thread to capture the screen, then that thread calls back to the original thread with the results. I've seen other Antivirus hang apps for 30sec when you open them for the first time, but they normally don't do that every time.

    Check out this KB article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PO2sCAG
    Your firewall may be blocking certificate revocation checks for the Antivirus.
Reply
  • I believe WinFile creates a new thread to capture the screen, then that thread calls back to the original thread with the results. I've seen other Antivirus hang apps for 30sec when you open them for the first time, but they normally don't do that every time.

    Check out this KB article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PO2sCAG
    Your firewall may be blocking certificate revocation checks for the Antivirus.
Children
No Data