Slow Virus Scan After Update

[JackP 1]

I recently updated to v13.2.15. Scanning has slowed considerably. Today I started a full scan of my laptop using in-depth-scanning. I stopped the scan after over 3 hours and it shows less that 300,000 objects scanned. Why is scanning so much slower than before the product update?

[Marcos 5,070]

Does the scan take long even if you don't select WMI and registry as scan targets?

[itman 1,659]

On 7/11/2020 at 4:15 PM, Marcos said:

Does the scan take long even if you don't select WMI and registry as scan targets?

Here's the problem.

The default Eset scan uses the Smart profile. Scans targets are N/A for this scan type. Appears Eset selects them by default and its including the Registry and WMI database scans.

My present workaround till this is fixed was to create a new scan profile named; e.g. Smart scan w/o registry and WMI, and set that as the default profile. See below posting.

Edited July 12, 2020 by itman

[Purpleroses 21]

If I just click on scan your computer it takes up to 25 mins for me.  Before it was less time.  I have not used the in depth scan yet.

[r1man 3]

16 hours ago, Purpleroses said:

If I just click on scan your computer it takes up to 25 mins for me.  Before it was less time.  I have not used the in depth scan yet.

For me on Win 10 Pro 64bit, v 2004 it took 20 min to do a full scan. Without in depth scan. 

[SlashRose 25]

Yes, the scans with this build take much longer, it takes about twice the scanning time for the same files as the previous build!

[itman 1,659]

On 7/11/2020 at 4:52 PM, itman said:

My present workaround till this is fixed was to create a new scan profile named; e.g. Smart scan w/o registry and WMI, and set that as the default profile.

This doesn't work! Any profile based scan auto scans registry and WMI. Doesn't bode well for anyone that has set up Eset scheduled scans,

Only thing that appears to bypass the registry and WMI scanning is a Custom scan with of course, those options not selected.

Edited July 12, 2020 by itman

[Marcos 5,070]

By default, neither the registry nor WMI are selected as scan targets in the Smart scan profile:

Scanning these objects is slower than scanning actual files which also is why these options were not there before but eventually we decided to enable users to scan them, e.g. in case there are some leftovers from an infection which were not cleaned automatically.

[itman 1,659]

4 minutes ago, Marcos said:

By default, neither the registry nor WMI are selected as scan targets in the Smart scan profile

Run a default scan which uses the Smart scan profile by default.

If it isn't obvious that a registry scan is running which should be, scroll to the top of files being scanned window where the scan parameters are shown. You will indeed note that a registry and WMI scan has been selected by default.

[mallard65 5]

11 hours ago, itman said:

If it isn't obvious that a registry scan is running which should be, scroll to the top of files being scanned window where the scan parameters are shown. You will indeed note that a registry and WMI scan has been selected by default.

itman is correct.

Since the update to 13.2.15 my "Initial Scan" and the "Scan your Computer" are taking over twice as long to complete. Also the "Objects Scanned", which should increment as files are scanned, remains on 0 (zero).

Extremely disappointed that ESET allowed something as major as this to enter the public release version.

[Marcos 5,070]

On my system I scanned WMI and the registry, 16216 objects in total, which took 3 minutes:

Number of scanned objects: 16216
Time of completion: 12:44:08 PM  Total scanning time: 191 sec (00:03:11)

WMI and registry scans are a part of the initial scan and in-depth scan which may now take several minutes longer because of this. They are also scanned when you click "Scan your computer" (don't confuse it with the Smart scan profile). Since more objects are scanned, slightly longer scan times are expected.

[mallard65 5]

44 minutes ago, Marcos said:

WMI and registry scans are a part of the initial scan and in-depth scan which may now take several minutes longer because of this. They are also scanned when you click "Scan your computer" (don't confuse it with the Smart scan profile). Since more objects are scanned, slightly longer scan times are expected.

If the scanner worked properly then it should indeed take a slightly longer time, but I do not think that a scan that takes 2-3 times longer as "... slightly longer ..."

Should have been sorted before 13.2.15 entered the public release phase.

[Marcos 5,070]

How long does the scan take for you with and without WMI & registry selected ? Scanning these newly added objects should take a few minutes, not dozens of minutes or hours.

[mallard65 5]

Initial scan on a clean windows 10 pro 2004 took 90 minutes (Dell 15R laptop 16G Ram, i5 4th gen, 1TB SSD).

[Marcos 5,070]

How long does it take to scan only WMI and the registry?
Would you be willing to try the previous version to measure the time of the initial scan?

[itman 1,659]

2 hours ago, Marcos said:

On my system I scanned WMI and the registry, 16216 objects in total, which took 3 minutes:

Number of scanned objects: 16216
Time of completion: 12:44:08 PM  Total scanning time: 191 sec (00:03:11)

Not so on my Win 10 x(64) 1909 build.

Scanning only registry and WMI. Note this is a clean install of Win 10 1909 done a few months ago:

Quote

Scanned disks, folders and files: Operating memory;Boot sectors/UEFI;WMI database;System registry

Number of scanned objects: 35474
Number of detections: 0
Time of completion: 5:08:45 PM  Total scanning time: 1317 sec (00:21:57)

Without registry and WMI scanning enabled and multiple drives scanned:

Quote

Scanned disks, folders and files: Operating memory;Boot sectors/UEFI;C:\Boot sectors/UEFI;C:\;D:\Boot sectors/UEFI;D:\;G:\Boot sectors/UEFI;G:\;H:\Boot sectors/UEFI;H:\

Number of scanned objects: 249702
Number of detections: 0
Time of completion: 5:14:28 PM  Total scanning time: 753 sec (00:12:33)

Add to this that 13.2.15 version scanning is borked in that it is scanning significantly less files and is slower than in the previous Eset version. Note the below ver. 13.1.xx counts don't included my second drive files that were selected in the above shown scan:

Quote

Scanned disks, folders and files: Operating memory;C:\Boot sectors/UEFI;D:\Boot sectors/UEFI;F:\Boot sectors/UEFI;C:\;D:\;F:\

Number of scanned objects: 310291
Number of detections: 0
Time of completion: 5:49:15 PM  Total scanning time: 738 sec (00:12:18)

Edited July 13, 2020 by itman

[mallard65 5]

39 minutes ago, Marcos said:

How long does it take to scan only WMI and the registry?
Would you be willing to try the previous version to measure the time of the initial scan?

WMI and registry: I will let you know.

Previous Version Initial Scan: 23 minutes 33 seconds.

Edited July 13, 2020 by mallard65

[itman 1,659]

2 hours ago, mallard65 said:

Also the "Objects Scanned", which should increment as files are scanned, remains on 0 (zero).

I can confirm this. When registry objects are being scanned, the count is not being incremented. Most likely because it appears to me this is a "brute force" scan resulting in the same files being scanned depending upon how many times they are referenced in the registry.😬 However, the actually scan count is included and shown at the end of the scan as my above screen shot shows. And again, I believe this count is a bogus value since it reflects multiple scans of the same files.

[itman 1,659]

I also question why registry and WMI scanning is enabled for the default Smart scan profile. At most, it should be enabled for the In-depth scan profile.

As I see it, registry and WMI scanning should only be employed after an Eset malware real-time detection for remnants that might remain in these areas. Or in the case where a malware infection is suspected that Eset real-time scanning is not detecting.

Finally if Eset was "doing its job" properly, it's real-time scanning that should be alerting on an unknown un-trusted process or a "living of the land" abused Windows process attempting to modifying the registry startup areas and other areas like abused, or WMI components and areas being abused. This also brings up the question of Advanced Machine Learning "aggressive" setting or is it a placebo feature?

Edited July 13, 2020 by itman

[Marcos 5,070]

50 minutes ago, itman said:

I also question why registry and WMI scanning is enabled for the default Smart scan profile. At most, it should be enabled for the In-depth scan profile.

It's actually not enabled for the Smart scan profile. Just to make sure, to run a smart scan, it's necessary to click Advanced scans -> Custom scan -> Settings -> Scan profile: Smart scan -> Scan / Scan as administrator.

 

[itman 1,659]

13 minutes ago, Marcos said:

It's actually not enabled for the Smart scan profile. Just to make sure, to run a smart scan, it's necessary to click Advanced scans -> Custom scan -> Settings -> Scan profile: Smart scan -> Scan / Scan as administrator.

If I do as you instructed, the below screen shot shows what Eset presents.

First and shown is that the scan profile is the Smart profile. Nothing further can be selected including "Scan as Administrator" until one or more scan objects are selected. If I select "This PC" all subordinate settings are auto check marked including Registry and WMI. If I don't manually uncheck mark those settings, both will be scanned per a test I just ran.

[Marcos 5,070]

If you don't click This PC which embraces all objects on the local PC, including WMI and the registry but select C, D, etc., only those drives will be selected:

This was a 4-click operation:
1, I selected C :
2, Clicked settings and selected "Smart scan"
3, Clicked "Scan as administrator".

[itman 1,659]

2 minutes ago, Marcos said:

This was a 4-click operation:
1, I selected C :
2, Clicked settings and selected "Smart scan"
3, Clicked "Scan as administrator

Err ....... Yes, of course this method would work.

I believe the current confusion going on is that the current method for Eset on-demand scanning w/o Registry or WMI scanning desired is:

1. Select Custom scan.

2. Ensure that Registry and WMI scan options are not enabled.

Also there is an issue for any one that has created a Eset scheduled scan previously. Appears they will have to manually modify that scan to exclude Registry and WMI scanning if so desired.

[SlashRose 25]

itman is almost always right, so in another post I wrote very clearly that itman deserved the title administrator because itman knows what he's talking about, 98% of Marcos think it's not an Eset, for Marcos it always is to other things, just not to Eset, dear Mr. Marcos, I am also an Eset fan boy, but unlike them, I am objective like itman, please be a little more objective, thank you!

Edited July 13, 2020 by SlashRose

[Marcos 5,070]

I'm sorry but I don't understand your last post. Constructive feedback is always welcome no matter if it's positive or negative. It's trolling and ranting which is not tolerated. Also itman acknowledged the steps to run a smart scan that I mentioned, there's no problem with him and we actually value his engagement in our forum. Let's stay on topic and refrain from being personal.