Anti-Virus blocking execution of Cicode functions

Hello all,

We are running CitectSCADA 2016 on a server that is running Cortex XDR anti-virus. We have found that this Anti-Virus software "stalls" the execution of some applications for 30 to 50 seconds before allowing the application to run. For example, when we start the compiler, there is a 40 second delay before the compiling window with the progress bar is displayed. Same thing when we launch de cicode editor, etc. To fix this problem, we have excluded from the anti-virus analysis the Citect\bin directory.

However, we still have some problems. We have a button on each screen that enables us to do a screen capture by calling the WinFile(sFileName) cicode. When we use this button, Citect freezes (we see this because the system clock displayed on top of our Citect page stops refreshing for 40 seconds). This is probably because WinFile is a blocking function. What I think is happening is that the WinFile cicode function is calling a process to capture the screen and copy it to the specified directory but the Anti-Virus is analyzing this process and delaying it's execution. 

What I am having difficulty figuring out is what exactly does the WinFile function execute so that we can exclude it from the anti-virus scan. If we disable the anti-virus, there is no delay so I am certain that this is what is causing this delay. Obviously, our IT department does not want to disable the anti-virus so we have to find exactly which files or directories to exclude from the analysis. 

Any help regarding this would be greatly appreciated.

Patrice Jacob

SCADAlogik inc.

Parents
  • Thank you Eric,
    Indeed, the hang happens on the first time but after the initial delay, subsequent calls to the same function will have no delay for a while. It's like the Antivirus puts this action in a cache of allowed or already analyzed apps for a few hours. I had seen the KB article on paloaltonetworks and our IT team has verified that the firewall is not blocking anything.

    We have followed the guidelines for Antivirus exclusions, we are not monitoring the Bin, Data and Trend directories. Are there other folders that we should exclude?

    Would you know what process is being called by the WinFile function so that we can exlude it? Would it be seen as a Citect32.exe in the task manager or is it a Windows process ?

    Thank you,

    Patrice
Reply
  • Thank you Eric,
    Indeed, the hang happens on the first time but after the initial delay, subsequent calls to the same function will have no delay for a while. It's like the Antivirus puts this action in a cache of allowed or already analyzed apps for a few hours. I had seen the KB article on paloaltonetworks and our IT team has verified that the firewall is not blocking anything.

    We have followed the guidelines for Antivirus exclusions, we are not monitoring the Bin, Data and Trend directories. Are there other folders that we should exclude?

    Would you know what process is being called by the WinFile function so that we can exlude it? Would it be seen as a Citect32.exe in the task manager or is it a Windows process ?

    Thank you,

    Patrice
Children
No Data