I noticed using Process monitor on Vista Business that NOD32 (ekm.exe) is constantly opening and closing files in the c:\Windows\system32\drivers folder, like wdf01000.sys, cmbatt.sys, audioeng.dll, sffdisk.sys, mssmbios.sys, umbus.sys, usbhub.sys, smb.sys, even when there are no active programs. I don't understand why NOD would want to repeatly check the driver for the battery (cmbatt.sys) This prevents the harddisk to spin down on my laptop. Is this normal behaviour? Can it be changed? It must be part of the realtime scanning, but i assume that the option to exclude files only applies to the full scanning.