Visual Studio accessing Symantec Virus Definition File: Why & How to stop?

Question

After (another) bout with Visual Studio slowness, I went into procmon to see if anything stood out. Our IT department had already made some whitelist entries for Symantec's real-time scanning, so I wasn't expecting to see any over-active real-time scans, or much of anything from Symantec (the enterprise virus scanning we use).

What I saw was that Visual Studio (devenv.exe) was accessing a Symantec file, specifically a 131MB virus definition file multiple times during the lifetime of Visual Studio. I cannot fathom why VS would be trying to access Symantec's files.

Some thoughts:

• Some sort of Symantec plugin was installed along with the client software - how would I check that? I don't see anything in the extensions manager
• I'm not reading procmon correctly - anyone have any critiques?
• It is related to VS 2010's SP1 which I installed last Friday afternoon

System

• Win 7 Ultimate
  • This OS install is about 1 month or less old
• VS 2010 Ultimate with SP1 - SP1 installed last Friday
• VS Extensions: TFS Auto Shelve v1.3, VS Commands 2010 v3.6.8.3
• We develop web apps and silverlight apps using .NET 4, SL 4, Entity Framework, and WCF RIA Services (now WCF RIA Services as of last Friday - came with SP1 install)
• Solution file I'm currently working with contains 46 projects and is a website application with Silverlight projects in it
• The error occurs when I edit a XAML file and then try to switch to the view-model file. VS hangs for about 3 seconds before switching the file.
• A screenshot is accessible here

If this needs to be moved to super user I understand, I just wanted to post it here first since you all are the people most likely to be using Visual Studio a lot.

My main question is: Why is Visual Studio accessing that file, is this causing the slow down, and how can it be prevented? For the sake of argument, let's say I'm on good terms with IT ;)

Thanks, Matthew

Answer 1

As Hans suggested, I attached VS to itself :) and checked out the modules that were loaded. There were some randomly named dlls that didn't have any paths associated with them, but there was nothing obviously Symantec sticking out to me.

I kept trying and worked with IT to disable Symantec on my box completely. After there was no trace of it being active, I tried again and got the same slowness, but procmon didn't list anything having to do with Symantec (or VS for that matter). So, even though the original procmon listing was strange (and could have been what Hans mentioned), it must not have been slowing it down.

I googled for visual studio xaml slowness, and came across this connect bug which looked like what I was getting (it in turn is a duplicate of this bug). I voted the issue up (and you should too if you have the issue).

and then i went back to work.

Answer 2

Of course it isn't VS that's accessing this file. It is a DLL that gets injected into the VS process by the Symantec crapware that does this. Start another instance of Visual Studio and use Tools + Attach to Process to attach an unmanaged debugger. Debug + Break All, Debug + Windows + Modules to see the list of all the DLLs that got loaded. Ask questions about it at superuser.com.