If you see NVCOAS.EXE (Norman Virus Control On Access Scanner) constantly using the CPU heavily, the scanner is getting too many scan requests.
The On Access Scanner is the component that is invoked every time you access any file. Whenever a user on an application uses a file, NVCOAS will need to scan it to make sure it does not contain viruses before the file is actually used. This scanning process of course requires some computing power every time any file is accessed.
In that case, a certain file is scanned extremely often, or a large number of files are scanned in a very short time. This makes the queue of files that need to be scanned grow quicker than the scanner is able to handle. When this happens for only a few seconds at a time there is usually no problem - this is normal and the CPU usage will automatically decrease very quickly after the peak has passed. This can happen for instance if you start a heavy application that reads and writes frequently to a large amount of files in a very short period of time (like photo/video editing software, or a database that consists of a huge number of files). If however the CPU usage remains high for prolonged periods ot time or constantly hinders normal operation, the situation that too many file access attempts happen in too short a time will need to be remedied by making sure the scanner does not scan the files in question any more (excluding them from scanning).
Known examples that our support department sometimes comes across are logfiles created by intensively logging applications, like busy email servers, or applications which access their configuration and/or log files very often.
The file(s) or folder(s) that is/are accessed too often (and thus scanned by the On-Access Scanner too often) will need to be excluded from scanning, so that they will no longer be scanned for viruses every time they are accessed. This will relieve pressure on the scanner and thus on your CPU.
There is an efficient way of finding out what exactly is filling up the queue too quickly. You can use the free Process Monitor tool from Microsoft SysInternals. This program logs a large amount of information about the actions that various processes take. In this case you are interested in the actions of nvcoas.exe so you can filter for that.
This is how it works:
After following these instructions, you should see the CPU usage by nvcoas.exe quickly decreases. If not, there is probably another file or folder that needs to be excluded from scanning. Just repeat the procedure and add more exclusions if necessary. If you feel you have excluded enough files or folders and still have problems, please contact your local Norman support office for further assistance.
Be careful with what you exclude. Think it through thoroughly. By default all files and subfolders will be excluded if you exclude a folder. For example, excluding C:\WINDOWS is a bad idea. You will in general want to reduce exclusions as much as possible.