JackP 1 Posted July 11, 2020 Posted July 11, 2020 I recently updated to v13.2.15. Scanning has slowed considerably. Today I started a full scan of my laptop using in-depth-scanning. I stopped the scan after over 3 hours and it shows less that 300,000 objects scanned. Why is scanning so much slower than before the product update? mallard65 1
Administrators Marcos 5,450 Posted July 11, 2020 Administrators Posted July 11, 2020 Does the scan take long even if you don't select WMI and registry as scan targets?
itman 1,801 Posted July 11, 2020 Posted July 11, 2020 (edited) On 7/11/2020 at 4:15 PM, Marcos said: Does the scan take long even if you don't select WMI and registry as scan targets? Here's the problem. The default Eset scan uses the Smart profile. Scans targets are N/A for this scan type. Appears Eset selects them by default and its including the Registry and WMI database scans. My present workaround till this is fixed was to create a new scan profile named; e.g. Smart scan w/o registry and WMI, and set that as the default profile. See below posting. Edited July 12, 2020 by itman mallard65 1
Purpleroses 21 Posted July 11, 2020 Posted July 11, 2020 If I just click on scan your computer it takes up to 25 mins for me. Before it was less time. I have not used the in depth scan yet.
r1man 3 Posted July 12, 2020 Posted July 12, 2020 16 hours ago, Purpleroses said: If I just click on scan your computer it takes up to 25 mins for me. Before it was less time. I have not used the in depth scan yet. For me on Win 10 Pro 64bit, v 2004 it took 20 min to do a full scan. Without in depth scan.
ESET Insiders SlashRose 25 Posted July 12, 2020 ESET Insiders Posted July 12, 2020 Yes, the scans with this build take much longer, it takes about twice the scanning time for the same files as the previous build! mallard65 1
itman 1,801 Posted July 12, 2020 Posted July 12, 2020 (edited) On 7/11/2020 at 4:52 PM, itman said: My present workaround till this is fixed was to create a new scan profile named; e.g. Smart scan w/o registry and WMI, and set that as the default profile. This doesn't work! Any profile based scan auto scans registry and WMI. Doesn't bode well for anyone that has set up Eset scheduled scans, Only thing that appears to bypass the registry and WMI scanning is a Custom scan with of course, those options not selected. Edited July 12, 2020 by itman mallard65 1
Administrators Marcos 5,450 Posted July 12, 2020 Administrators Posted July 12, 2020 By default, neither the registry nor WMI are selected as scan targets in the Smart scan profile: Scanning these objects is slower than scanning actual files which also is why these options were not there before but eventually we decided to enable users to scan them, e.g. in case there are some leftovers from an infection which were not cleaned automatically.
itman 1,801 Posted July 12, 2020 Posted July 12, 2020 4 minutes ago, Marcos said: By default, neither the registry nor WMI are selected as scan targets in the Smart scan profile Run a default scan which uses the Smart scan profile by default. If it isn't obvious that a registry scan is running which should be, scroll to the top of files being scanned window where the scan parameters are shown. You will indeed note that a registry and WMI scan has been selected by default. mallard65 1
mallard65 5 Posted July 13, 2020 Posted July 13, 2020 11 hours ago, itman said: If it isn't obvious that a registry scan is running which should be, scroll to the top of files being scanned window where the scan parameters are shown. You will indeed note that a registry and WMI scan has been selected by default. itman is correct. Since the update to 13.2.15 my "Initial Scan" and the "Scan your Computer" are taking over twice as long to complete. Also the "Objects Scanned", which should increment as files are scanned, remains on 0 (zero). Extremely disappointed that ESET allowed something as major as this to enter the public release version.
Administrators Marcos 5,450 Posted July 13, 2020 Administrators Posted July 13, 2020 On my system I scanned WMI and the registry, 16216 objects in total, which took 3 minutes: Number of scanned objects: 16216 Time of completion: 12:44:08 PM Total scanning time: 191 sec (00:03:11) WMI and registry scans are a part of the initial scan and in-depth scan which may now take several minutes longer because of this. They are also scanned when you click "Scan your computer" (don't confuse it with the Smart scan profile). Since more objects are scanned, slightly longer scan times are expected.
mallard65 5 Posted July 13, 2020 Posted July 13, 2020 44 minutes ago, Marcos said: WMI and registry scans are a part of the initial scan and in-depth scan which may now take several minutes longer because of this. They are also scanned when you click "Scan your computer" (don't confuse it with the Smart scan profile). Since more objects are scanned, slightly longer scan times are expected. If the scanner worked properly then it should indeed take a slightly longer time, but I do not think that a scan that takes 2-3 times longer as "... slightly longer ..." Should have been sorted before 13.2.15 entered the public release phase.
Administrators Marcos 5,450 Posted July 13, 2020 Administrators Posted July 13, 2020 How long does the scan take for you with and without WMI & registry selected ? Scanning these newly added objects should take a few minutes, not dozens of minutes or hours.
mallard65 5 Posted July 13, 2020 Posted July 13, 2020 Initial scan on a clean windows 10 pro 2004 took 90 minutes (Dell 15R laptop 16G Ram, i5 4th gen, 1TB SSD).
Administrators Marcos 5,450 Posted July 13, 2020 Administrators Posted July 13, 2020 How long does it take to scan only WMI and the registry? Would you be willing to try the previous version to measure the time of the initial scan?
itman 1,801 Posted July 13, 2020 Posted July 13, 2020 (edited) 2 hours ago, Marcos said: On my system I scanned WMI and the registry, 16216 objects in total, which took 3 minutes: Number of scanned objects: 16216 Time of completion: 12:44:08 PM Total scanning time: 191 sec (00:03:11) Not so on my Win 10 x(64) 1909 build. Scanning only registry and WMI. Note this is a clean install of Win 10 1909 done a few months ago: Quote Scanned disks, folders and files: Operating memory;Boot sectors/UEFI;WMI database;System registry Number of scanned objects: 35474 Number of detections: 0 Time of completion: 5:08:45 PM Total scanning time: 1317 sec (00:21:57) Without registry and WMI scanning enabled and multiple drives scanned: Quote Scanned disks, folders and files: Operating memory;Boot sectors/UEFI;C:\Boot sectors/UEFI;C:\;D:\Boot sectors/UEFI;D:\;G:\Boot sectors/UEFI;G:\;H:\Boot sectors/UEFI;H:\ Number of scanned objects: 249702 Number of detections: 0 Time of completion: 5:14:28 PM Total scanning time: 753 sec (00:12:33) Add to this that 13.2.15 version scanning is borked in that it is scanning significantly less files and is slower than in the previous Eset version. Note the below ver. 13.1.xx counts don't included my second drive files that were selected in the above shown scan: Quote Scanned disks, folders and files: Operating memory;C:\Boot sectors/UEFI;D:\Boot sectors/UEFI;F:\Boot sectors/UEFI;C:\;D:\;F:\ Number of scanned objects: 310291 Number of detections: 0 Time of completion: 5:49:15 PM Total scanning time: 738 sec (00:12:18) Edited July 13, 2020 by itman
mallard65 5 Posted July 13, 2020 Posted July 13, 2020 (edited) 39 minutes ago, Marcos said: How long does it take to scan only WMI and the registry? Would you be willing to try the previous version to measure the time of the initial scan? WMI and registry: I will let you know. Previous Version Initial Scan: 23 minutes 33 seconds. Edited July 13, 2020 by mallard65
itman 1,801 Posted July 13, 2020 Posted July 13, 2020 2 hours ago, mallard65 said: Also the "Objects Scanned", which should increment as files are scanned, remains on 0 (zero). I can confirm this. When registry objects are being scanned, the count is not being incremented. Most likely because it appears to me this is a "brute force" scan resulting in the same files being scanned depending upon how many times they are referenced in the registry.😬 However, the actually scan count is included and shown at the end of the scan as my above screen shot shows. And again, I believe this count is a bogus value since it reflects multiple scans of the same files.
itman 1,801 Posted July 13, 2020 Posted July 13, 2020 (edited) I also question why registry and WMI scanning is enabled for the default Smart scan profile. At most, it should be enabled for the In-depth scan profile. As I see it, registry and WMI scanning should only be employed after an Eset malware real-time detection for remnants that might remain in these areas. Or in the case where a malware infection is suspected that Eset real-time scanning is not detecting. Finally if Eset was "doing its job" properly, it's real-time scanning that should be alerting on an unknown un-trusted process or a "living of the land" abused Windows process attempting to modifying the registry startup areas and other areas like abused, or WMI components and areas being abused. This also brings up the question of Advanced Machine Learning "aggressive" setting or is it a placebo feature? Edited July 13, 2020 by itman
Administrators Marcos 5,450 Posted July 13, 2020 Administrators Posted July 13, 2020 50 minutes ago, itman said: I also question why registry and WMI scanning is enabled for the default Smart scan profile. At most, it should be enabled for the In-depth scan profile. It's actually not enabled for the Smart scan profile. Just to make sure, to run a smart scan, it's necessary to click Advanced scans -> Custom scan -> Settings -> Scan profile: Smart scan -> Scan / Scan as administrator.
itman 1,801 Posted July 13, 2020 Posted July 13, 2020 13 minutes ago, Marcos said: It's actually not enabled for the Smart scan profile. Just to make sure, to run a smart scan, it's necessary to click Advanced scans -> Custom scan -> Settings -> Scan profile: Smart scan -> Scan / Scan as administrator. If I do as you instructed, the below screen shot shows what Eset presents. First and shown is that the scan profile is the Smart profile. Nothing further can be selected including "Scan as Administrator" until one or more scan objects are selected. If I select "This PC" all subordinate settings are auto check marked including Registry and WMI. If I don't manually uncheck mark those settings, both will be scanned per a test I just ran.
Administrators Marcos 5,450 Posted July 13, 2020 Administrators Posted July 13, 2020 If you don't click This PC which embraces all objects on the local PC, including WMI and the registry but select C, D, etc., only those drives will be selected: This was a 4-click operation: 1, I selected C : 2, Clicked settings and selected "Smart scan" 3, Clicked "Scan as administrator".
itman 1,801 Posted July 13, 2020 Posted July 13, 2020 2 minutes ago, Marcos said: This was a 4-click operation: 1, I selected C : 2, Clicked settings and selected "Smart scan" 3, Clicked "Scan as administrator Err ....... Yes, of course this method would work. I believe the current confusion going on is that the current method for Eset on-demand scanning w/o Registry or WMI scanning desired is: 1. Select Custom scan. 2. Ensure that Registry and WMI scan options are not enabled. Also there is an issue for any one that has created a Eset scheduled scan previously. Appears they will have to manually modify that scan to exclude Registry and WMI scanning if so desired.
ESET Insiders SlashRose 25 Posted July 13, 2020 ESET Insiders Posted July 13, 2020 (edited) itman is almost always right, so in another post I wrote very clearly that itman deserved the title administrator because itman knows what he's talking about, 98% of Marcos think it's not an Eset, for Marcos it always is to other things, just not to Eset, dear Mr. Marcos, I am also an Eset fan boy, but unlike them, I am objective like itman, please be a little more objective, thank you! Edited July 13, 2020 by SlashRose
Administrators Marcos 5,450 Posted July 13, 2020 Administrators Posted July 13, 2020 I'm sorry but I don't understand your last post. Constructive feedback is always welcome no matter if it's positive or negative. It's trolling and ranting which is not tolerated. Also itman acknowledged the steps to run a smart scan that I mentioned, there's no problem with him and we actually value his engagement in our forum. Let's stay on topic and refrain from being personal. mallard65 1
Recommended Posts