Jump to content

Archived

This topic is now archived and is closed to further replies.

Dodfr

ESET never ending scan loop

Recommended Posts

Hello,

Any idea why ESET go into something like neverending scan loop ? it scan then stop then scan again problem is that it slow down the computer and also make Chrome unresponsive time to time (I guess when it is scanning some used chrome files).

What are the possible events that could trigger such full scan ?

I tried to empty chrome cache, %temp% and also Windows temp folder just in case.

Nom de produit : ESET Internet Security
Version du produit : 13.0.22.0
Système d'exploitation : Windows 10 Pro(64-bit)
Ordinateur : Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz, 8097 MB RAM

regards.

Share this post


Link to post
Share on other sites

Please clarify what scan loop you mean. Are you referring to an on-demand scanner? Do you have any on-demand scans scheduled in Scheduler? Does disabling the Idle-state scan make a difference?

Share this post


Link to post
Share on other sites

hello,

I am not talking about on-demand scan (never used this feature), I mean that ESET used to trigger some scan time to time but usually only at startup and when it updated its virus database, that was fine but since a few days I don't know why it do scan but never stop, I see in taskmanager that it stay quiet for a few seconds/minutes then here it scan again.

I remember I had similar problem one year ago, and I found that this "long time" scan was triggered each time I opened my "download" folder so I moved all files outside the folder and it fixed the problem (cleaned also all the temps and brower's cache just in case) but this time it do not help.

I know it is some kind of "full scan" because when I launch ProcMon (from SysInternals) and record erkn.exe activity I see it go into many places around the disks.

And then it seems to finish the scan then... here we go again and I see thru ProcMon it is seems to scan same files again.

regards.

Share this post


Link to post
Share on other sites

Does the scan finish after a few minutes or do you continually see a message that a startup scan is in progress when you hover the mouse cursor over the tray icon?

Share this post


Link to post
Share on other sites

There is no "startup scan" hint on tray icon I only see ESET version number when I move mouse over it.

 

And I guess the scan finish at sometime and restart but I don't know when because it loop soon after previous scan. Is there any log file I can check to see some "start scan" /"end scan" date/time somewhere ? so I can see how many times it starts and how long it take for a round.

Share this post


Link to post
Share on other sites

The only thing I can think of is Smart Optimization has been disabled under real-time scanning options. Refer to the below screen shot and verify that it is check marked; i.e. enabled. This setting causes Eset to bypass process startup and file scanning of processes/files previously scanned and deemed safe.

Eset_Smart.thumb.png.4fabace54005b5cfc0579ac6cd565e6e.png

Share this post


Link to post
Share on other sites

I also deactivated Windows search indexer just in case it is its own indexationthat loops and make ESET react on each file opened by the Windows search motor but it was not that cause.

If I could have info about which log file in ESET could be usefull to analyze and how to activate it in case it is disabled by default, may be I could understand at least when it starts and upon which "start message log" it triggers.

Share this post


Link to post
Share on other sites

If Eset is running a scan of any type, you will see the Eset desktop icon animated. If you hover your mouse pointer over the icon, it will show a popup of what scan is running.

If the Eset desktop icon is not animated, the ekrn.exe activity you are observing is not related to scan activity.

Share this post


Link to post
Share on other sites

@itman all disk activity monitor show it is ESET (including my own tool that is the tthin blue bar top screen on TaskManager screenshot)1923846049_2019-11-2420_25_25-Window.png.d46925b34596856589103a780872c3a8.png

2019-11-24 20_28_49-Window.png

2019-11-24 20_27_12-Window.png

2019-11-24 20_26_33-Window.png

Share this post


Link to post
Share on other sites
1 minute ago, Dodfr said:

 all disk activity monitor show it is ESET (including my own tool that is the tthin blue bar top screen on TaskManager screenshot)

Ekrn.exe is constantly running. Also high ekrn.exe CPU usage does not mean absolutely that this usage is scan related.

Share this post


Link to post
Share on other sites

@itman I use ESET for years  and I know when ESET is doing something or not and when it is using CPU or Disk I/O I and as a system developper I am used to deal with CPU and disk i/o and for what I could check for now all leads point to ESET doing some scan for unknown reason and when ESET is quiet you can see in screenshot that it do not use CPU neither Disk and also do not appear in Ressource Monitor doing tons of multi-threading file analyze.

Another possibility could be that another process is doing a scan and in that case as ESET is in between the Windows processes and the disk driver layer then the process would make ESET doing its job that is scan the file upon request but that mean I should be able to detect such process but I could not detect any that is asking for read access to so many files.2032220481_2019-11-2420_39_40-Window.png.939118ddfd4657d4b7121434d0593bdc.png

2019-11-24 20_59_38-Window.png

Share this post


Link to post
Share on other sites

One possibility is that Eset's default scans are not running as they should be. As shown by the below Scheduler screen shot, these scans should only run for a very short duration:

Eset_Scheduler.thumb.png.0812051a49a415e12981b7151907daa8.png

 

Share this post


Link to post
Share on other sites

Please carry on as follows:

- enable advanced OS logging under Tools -> Diagnostics
- reproduce the "never ending scan loop"
- stop logging after a couple of minutes
- compress C:\ProgramData\ESET\ESET Security\Diagnostics\EsetPerf.etl, upload the file to a safe location and drop me a private message with a download link.

Share this post


Link to post
Share on other sites

ok i'll do that next time it happen because today after a fews days of neverending scan loop (whenever I rebooted the PC) it finally stopped.

Share this post


Link to post
Share on other sites

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...