ESET never ending scan loop

[Dodfr 1]

Hello,

Any idea why ESET go into something like neverending scan loop ? it scan then stop then scan again problem is that it slow down the computer and also make Chrome unresponsive time to time (I guess when it is scanning some used chrome files).

What are the possible events that could trigger such full scan ?

I tried to empty chrome cache, %temp% and also Windows temp folder just in case.

Nom de produit : ESET Internet Security
Version du produit : 13.0.22.0
Système d'exploitation : Windows 10 Pro(64-bit)
Ordinateur : Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz, 8097 MB RAM

regards.

[Marcos 5,189]

Please clarify what scan loop you mean. Are you referring to an on-demand scanner? Do you have any on-demand scans scheduled in Scheduler? Does disabling the Idle-state scan make a difference?

[Dodfr 1]

hello,

I am not talking about on-demand scan (never used this feature), I mean that ESET used to trigger some scan time to time but usually only at startup and when it updated its virus database, that was fine but since a few days I don't know why it do scan but never stop, I see in taskmanager that it stay quiet for a few seconds/minutes then here it scan again.

I remember I had similar problem one year ago, and I found that this "long time" scan was triggered each time I opened my "download" folder so I moved all files outside the folder and it fixed the problem (cleaned also all the temps and brower's cache just in case) but this time it do not help.

I know it is some kind of "full scan" because when I launch ProcMon (from SysInternals) and record erkn.exe activity I see it go into many places around the disks.

And then it seems to finish the scan then... here we go again and I see thru ProcMon it is seems to scan same files again.

regards.

Edited November 24, 2019 by Dodfr

[Marcos 5,189]

Does the scan finish after a few minutes or do you continually see a message that a startup scan is in progress when you hover the mouse cursor over the tray icon?

[Dodfr 1]

There is no "startup scan" hint on tray icon I only see ESET version number when I move mouse over it.

 

And I guess the scan finish at sometime and restart but I don't know when because it loop soon after previous scan. Is there any log file I can check to see some "start scan" /"end scan" date/time somewhere ? so I can see how many times it starts and how long it take for a round.

Edited November 24, 2019 by Dodfr

[itman 1,727]

The only thing I can think of is Smart Optimization has been disabled under real-time scanning options. Refer to the below screen shot and verify that it is check marked; i.e. enabled. This setting causes Eset to bypass process startup and file scanning of processes/files previously scanned and deemed safe.

Edited November 24, 2019 by itman

[Dodfr 1]

Seems ok

Edited November 24, 2019 by Dodfr

[Dodfr 1]

I also deactivated Windows search indexer just in case it is its own indexationthat loops and make ESET react on each file opened by the Windows search motor but it was not that cause.

If I could have info about which log file in ESET could be usefull to analyze and how to activate it in case it is disabled by default, may be I could understand at least when it starts and upon which "start message log" it triggers.

Edited November 24, 2019 by Dodfr

[itman 1,727]

If Eset is running a scan of any type, you will see the Eset desktop icon animated. If you hover your mouse pointer over the icon, it will show a popup of what scan is running.

If the Eset desktop icon is not animated, the ekrn.exe activity you are observing is not related to scan activity.

[Dodfr 1]

@itman all disk activity monitor show it is ESET (including my own tool that is the tthin blue bar top screen on TaskManager screenshot)

[itman 1,727]

1 minute ago, Dodfr said:

 all disk activity monitor show it is ESET (including my own tool that is the tthin blue bar top screen on TaskManager screenshot)

Ekrn.exe is constantly running. Also high ekrn.exe CPU usage does not mean absolutely that this usage is scan related.

[Dodfr 1]

@itman I use ESET for years  and I know when ESET is doing something or not and when it is using CPU or Disk I/O I and as a system developper I am used to deal with CPU and disk i/o and for what I could check for now all leads point to ESET doing some scan for unknown reason and when ESET is quiet you can see in screenshot that it do not use CPU neither Disk and also do not appear in Ressource Monitor doing tons of multi-threading file analyze.

Another possibility could be that another process is doing a scan and in that case as ESET is in between the Windows processes and the disk driver layer then the process would make ESET doing its job that is scan the file upon request but that mean I should be able to detect such process but I could not detect any that is asking for read access to so many files.

[itman 1,727]

One possibility is that Eset's default scans are not running as they should be. As shown by the below Scheduler screen shot, these scans should only run for a very short duration:

 

[Marcos 5,189]

Please carry on as follows:

- enable advanced OS logging under Tools -> Diagnostics
- reproduce the "never ending scan loop"
- stop logging after a couple of minutes
- compress C:\ProgramData\ESET\ESET Security\Diagnostics\EsetPerf.etl, upload the file to a safe location and drop me a private message with a download link.

[Dodfr 1]

ok i'll do that next time it happen because today after a fews days of neverending scan loop (whenever I rebooted the PC) it finally stopped.