>Even assuming the worst case scenario, there is just no way that opening
>2,000 files would require 111 sec of kernel time. It's at least 100 times
>too much. The only explanation is that the AV software is set for
>real-time
>scan of all file extensions in the LISTSERV directory tree. LISTSERV only

Eric,
Here's what our system folks tell us we have set for F-Secure.

We have the following setting on listserv:
Real-time protection is enabled and the action is "Delete
automatically"

Scanning Options:
We are not scanning all files, we are scanning files with only certain
extenions (probably what he means by the "usual supects")
We have excluded certain folders and file types:
            d:\listserv\spool
            e:\  (the archive directory)
            *.mail files
            *.mai files
            *.job files
Scan inside compressed files is checked.

I believe these were the recommendations under the Listserv/F-Secure
FAQ.

------------
I don't have full access to the f-secure panel, but I can see it's
scanning com, exe, sys, ov?, bin, scr, dll, shs, htm, html, htt, vbs, js,
inf, vxd, do?, xl?, rtf, cpl, wiz, hta