Machine performance issues appear when real-time scanning is enabled. To help address these, administrators need know the following about the Virus Scan Application Programming Interface (VSAPI) scan engine:
- Does OSCE real-time scanning perform sequential scanning or does it do parallel scanning using a multi-thread approach?
- Are there any available settings to adjust the number of threads used for scanning?
The scan engine includes three drivers: tmpreflt.sys, tmxpflt.sys, and vsapint.sys.
- The VSAPI scan engine runs in multi-threaded mode. Hooked file Input/Output will be put into a queue and 10 scanning threads are available to process the queue.
- There are no available settings to adjust the number of threads used.
If performance issues are encountered during real-time scans, refer to the Recommended solutions to high CPU utilization caused by NTRTScan or DBServer.exe KB article to troubleshoot the issue.