I mentioned this in another post, but I think it is worth its own case. Writing "last accessed" time information to all files scanned might be part of the cause of this issue.

Reproduction steps: Run a full scan (iSwift/iChecker disabled for better reproducibility) of the system with Windows System Restore enabled.

Actual result: During the scan Windows keeps writing new data to System Volume Information and MFT, mostly in many small bits instead of single large ones. As a consequence drive utilization is increased during scan (sometimes affecting scan performance) and System Restore is filled up with likely unnecessary data.

Before scan:

After scan = over 1 gb extra data written to disk just by scanning via KES:

This also happens when KES trace file is disabled and also seems to happen while no temporary files are written to ProgramData by KES (scanning inside of archives).

Expected Result: No write operations to scanned folders. Other AV solutions also offer an option to have AV scans not change "last accessed" times on files, which makes a lot of sense.

Reproduction steps: Start a context-menu on-demand scan of my C drive using default settings.

Actual result: KES takes longer to scan the same files compared to KIS. Furthermore, skipping password protected files seems to take too long.

Expected Result: Same or even improved scan-performance. Fast skipping of password protected files.

In the following screenshots two consecutive context-menu on-demand scans were run.

KES scan-times:

KIS scan-times:

KES scan-times with two additional copies of a few dozen password protected files:

Noteworthy: Kaspersky only makes use of about 4 cores/threads out of 24 logical cores of my CPU. As a result its bandwidth is much lower than what my CPU + M.2 SSD would be capable off. For comparison: the Windows' built-in AV solution takes less than 6 minutes to scan the same C drive and even seems to scan deeper into compressed archives (higher total number of files scanned).