AGH1965

Why? egui.exe has many buttons that are visible for all users, but that are only useful for those who know the administrator password. Why make an exception for stopping active scans? The behavior was certainly like that. I'm not saying the button disappeared with v12.1.31.0. That may have happened with an earlier update. I just noticed the absense with that version. In the past the button disappeared once more with an update. At that time it was reported at this forum and with a later update it reapppeared. (For some odd reason old posts seem to have disappeared from the forum.) However, there is a work-around. Normal users can stop an active scan. They can start egui.exe as administrator. However, if they close that egui.exe, then the normal one doesn't open anymore. That is a bug. Showing a useful button isn't though.

I guess that most people want the scan to run when the computer isn't used. Resuming when they want to use the computer again is therefore an issue. Changing the power management settings before and after every scan is an issue too. I really don't understand why ESET expects users to do that. It is as if ESET thinks that no one uses the in-depth scanning of EIS.

I configured a daily scan at 17:55, but this time with the "immediately, if time since last run exceeds a specified value (hours)" option activated in combination with a 1 hour setting. Yesterday the scan started at 17:55 as scheduled. So it wasn't missed, because I forgot to switch off my computer on time. Oops, sorry. However, today the scan started at 16:56. So either one hour too early or 23 hours after the previous scan. Again I don't get the logic. Hopefully @Marcos is willing to explain.

Description: Button to stop active scan also visible for users without administrator rights. Detail: In the past the button to stop an active scan was also visible for users without administrator rights. When such users pressed the button, they had to enter the administrator password. In my opinion that is how it should be. Unfortunately in v12.1.31.0 the button is not visible for users without administrator rights.

@Karly Are you sure you didn't use the mouse or the keyboard during those 12 minutes? If I set the sleep time to 5 minutes, then the scan is interrupted and the computer is put to sleep. When I awake it, the scan continues.

Unfortunately Microsoft's definition of system activity has nothing to do with CPU load or HDD activity. Windows looks at mouse and keyboard activity. Unless you move the mouse or press keys every now and then, Windows will put the system to sleep. See the feature requests from @zeromido and myself here: link

Oh no, the situation became even stanger. I reported already that the weekly scan on Monday started 36 minutes too early at 17:24, which was exactly 6 days and 23 hours after the previous scan, but that is not all. At 18:00, i.e. at the scheduled time, the scheduler started a second scan. Two scans trying to beat each other. Why on earth? @itman and I can easily notice that the scheduler doesn't do what it is supposed to. Why can't ESET?

@itman You reported that your scheduler started a scan one hour too early. Are you sure it started the scan one hour too early or could it also be that the scheduler started the scan 23 hours after the previous scan? On one computer I configured a weekly scan on Mondays at 18:00 with "as soon as possible" option activated. Last week the scan was missed because the computer was switched on a little too late, but at 18:24 the scheduler started the missed scan. This week the computer was switched on at about 17:15, but the scheduler didn't wait till 18:00 to start the weekly scan. Instead the scan was started at 17:24. That is exactly 6 days and 23 hours after the previous scan. This together with the experiences I reported earlier, give me the impression that the scheduler has a "23 hours bug".

@itman Indeed it is a massive improvement. We went from an option that didn't do anything to an option that doesn't do what it is supposed to. However, when I see this behavior, then it seems to me that ESET intented to create something much smarter than straightforward "as soon as possible" functionality. So maybe this behavior is exactly what ESET intended, but it isn't what a user expects when he reads "as soon as possible". So maybe ESET should consider renaming the option.

@Marcos Can you explain what algorithm the "as soon as possible" option uses for starting missed scans, because it is certainly not straightforward as soon as possible. To test the "as soon as possible" option of the scheduler, I configured a daily scan at 20:00 with "as soon as possible" option activated, but normally my computer is switched off before 20:00. So normally EIS misses the scheduled scan. When I turn on my computer the next day, then EIS doesn't start the scan as soon as possible as I would expect, but instead EIS waits till the end of the day. For example, yesterday EIS started the missed daily scan at 17:36:44 and today EIS started the missed daily scan at 16:36:53. Is it a coincidence that there is almost exactly 23 hours between the two scans or is that part of the "as soon as possible" algorithm EIS uses?

@Marcos You make it sound as if on-demand scans are only useful for people who interfere with EIS doing its work, but I'm not aware of any interference from my side, on the contrary. Apparently the Win32/Filecoder.GrandCrab trojans that the on-demand scan found in my case, were not recognized by EIS when the files containing them were written to the hard drive a day earlier. So I guess I was lucky that the on-demand scan recognized them before they could do any harm.

@Marcos Are you saying that detections from a sceduled scan will never appear in the Detections log? ESET Online Help says: "This log offers detailed information about detections and infiltrations detected by ESET Internet Security." No sign of distiction between scanners. Therefore I expect the Detections log to show all detections. Besides, what is the benefit of hiding some of the detections? Please try to keep the GUI logical!

This week EIS 12.1.31.0 discovered two trojans while scanning. Although I interupted the scan and didn't give EIS a chance to get rid of the trojans, I was surprised that Log files - Detections didn't show any detections at all. I assumed that it was caused by the interruption. Therefore I let EIS scan the folder containing the trojans again and when they were found again, I let EIS remove them. However, even after that, Log files - Detections didn't show any detections. On the other hand, Log files - Computer scans clearly showed that there were detections. It seems to me that Log files - Detections is no longer functioning in EIS 12.1.31.0.

A few days ago I experienced something similar with version 12.1.31.0 as @Rohit reported here above. When the system tray icon showed that EIS was busy doing something, I hovered my mouse over it and it showed that EIS was busy updating. A few minutes later I noticed that EIS was still busy and the icon suggested that EIS was still busy updating. Because I didn't believe that, I opened the EIS window. That showed that a scan was running. During the whole scan, which lasted several hours, the icon suggested that EIS was busy updating. It is just an assumption, but I have the impression that the tray icon gets "confused" when the scheduler starts multiple actions at the same time. For some odd reason the scheduler of 12.1.31.0 doesn't have any patience. It even starts another scan when there is already a scan running, even though running two scans sequenctially is probably much more efficient than running two scans at the same time.

It is very simple. Use SetThreadExecutionState. See: link to Microsoft Windows Dev Center.