Unscheduled Scans In Internet Security

[SDHicks 1]

I'm pretty sure that this is normal for the software to do scans on its own but it's annoying when I'm in the middle of doing something. And it seems random at times because I've seen them happening in the morning and evenings. I already know that I can schedule scans and know how to do it. How do I alter or edit the time schedule of built in scheduled scans. Like set it for every Saturday at noon. I've searched and can't find any information on this subject. Maybe I missed something.

[itman 1,808]

All Eset defined scans and what triggers them are shown in the below screen shot. Eset default established scans only run for a short period of time since they are only scanning select system areas that are known to hide malware;

[SDHicks 1]

I understand all of that. I can see it scanning when I start my system or make changes. However, I rarely make system changes. I occasionally install the latest Nvidia drivers, update Notepad++ or Libre Office. I'm talking about the entire file system scans that happen seemingly randomly. I was working on a project 2 days ago and my system suddenly started slowing down and I couldn't figure out what was happening. I looked at the taskbar and ESET was doing a complete file scan and ran for 15 minutes and messed up what I was doing. This seems to have started fairly recently, within a few updates. Almost all other anti-virus and malware software allows you to set the time and day it does a full system scan. I'm talking about that. Other than excluding files and folders I can't see anywhere you can do that.

[itman 1,808]

2 minutes ago, SDHicks said:

I'm talking about the entire file system scans that happen seemingly randomly.

If a full scan was running, it would have to be either manually initiated or via the above noted scheduled scan section.

What may be occurring is an on-demand scan may have been manually run and cancelled prior to scan completion. For some reason, the scan didn't actually terminated and is resuming scanning. 

Next time you see this activity, open Eset GUI Computer scan section and cancel the scan. Verify later that the scan was actually terminated.

[SDHicks 1]

I've never scheduled any "on demand" scans. I've never cancelled any running scans except for yesterday when I was just trying to see how it impacts my system. You didn't answer my question. Is there anywhere you can set the scheduled time or is it just based on computer activity and you have to exclude files and folders?

[Marcos 5,468]

Please provide logs collected with ESET Log Collector so that I can check your configuration.

[itman 1,808]

29 minutes ago, SDHicks said:

You didn't answer my question. Is there anywhere you can set the scheduled time or is it just based on computer activity and you have to exclude files and folders?

I answered that question.

The only way Eset will be perform a full scan other than by being manually initiated is by the user creating a full scan entry in the Eset Scheduled scan section.

[SDHicks 1]

Here's the log file Marcos.

eis_logs.zip

[Marcos 5,468]

There are only 3 on-demand scanner logs in the C:\ProgramData\ESET\ESET Security\Logs\eScan folder, all from Aug 26. The Idle-state scan is disabled and no custom on-demand scan tasks are scheduled. Could you post a screenshot or video of an unscheduled scan?

[SDHicks 1]

Yes, I'll do it next time I see it happening.

[itman 1,808]

I missed this comment;

5 hours ago, SDHicks said:

I was working on a project 2 days ago and my system suddenly started slowing down and I couldn't figure out what was happening. I looked at the taskbar and ESET was doing a complete file scan and ran for 15 minutes and messed up what I was doing.

On my Win 10 22H2 installation, a full Eset system scan takes close to 2 hours and I don't have a lot of apps installed. This means a full Eset system scan was not being performed on your device.

You state you were working on a project. If this involved a large number of files being created such as extracting a very large archive, unpacking them, downloading a large number of files, etc.., Eset is going to scan each one of those files. This might be the scanning you are observing.

[SDHicks 1]

Marcos,
It did it again. This time it started at 2:14:29 and it took 30 minutes to complete. It scanned every drive on my system. I tried to get a picture of my D drive but I wasn't quick enough. I have not made any changes since the last scan. It's just doing full scans on its own. I did install a brand new drive recently so I'm wondering if moving files around did something to ESET. You can see that it's not finding anything though and I had installed this drive several months ago and this problem started more recently. I installed a second NVME 1 TB drive so my C and D are the exact same type of drive. My E drive is SSD, and my data drive is an older spin drive. Something is triggering this event. I collected the log again right after the scan was complete. Do you think uninstalling and reinstalling the application would help?

 

eis_logs.zip

[Marcos 5,468]

For some reason there are 7 tasks in your cfg xml but only 6 appear in gui after import. The last task is an on-demand scan of the system drive.

Please remove these 2 nodes from the xml file and import the xml:

    <ITEM NAME="7">
     <NODE NAME="Guid" TYPE="string" VALUE="ffffffff-ffff-ffff-ffff-ffff80000005" />
     <NODE NAME="Name" TYPE="string" VALUE="" />
     <NODE NAME="NameResId" TYPE="number" VALUE="1323000B" />
     <NODE NAME="ActionCode" TYPE="number" VALUE="1" />
     <NODE NAME="ModuleID" TYPE="number" VALUE="1000100" />
     <NODE NAME="TriggerType" TYPE="number" VALUE="0" />
     <NODE NAME="TriggerSettings" TYPE="number" VALUE="0" />
     <NODE NAME="TriggerSettingsTime" TYPE="number" VALUE="0" />
     <NODE NAME="StartFailSettings" TYPE="number" VALUE="2" />
     <NODE NAME="StartFailSettingsTime" TYPE="number" VALUE="0" />
     <NODE NAME="Enabled" TYPE="number" VALUE="0" />
     <NODE NAME="DontExecuteOnBattery" TYPE="number" VALUE="0" />
     <NODE NAME="Params" TYPE="string" VALUE="&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?>&lt;PARAMS>&lt;SCHEDULED_TASK PLUGIN=&quot;1000100&quot; ACTION=&quot;0&quot; DESCRIPTION=&quot;&quot;>&lt;DATA>&lt;NODE NAME=&quot;FIRST_SCAN&quot; VALUE=&quot;1&quot; TYPE=&quot;DWORD&quot; />&lt;NODE NAME=&quot;TARGETS&quot; VALUE=&quot;${DriveSystem}&quot; TYPE=&quot;STRING&quot; />&lt;/DATA>&lt;/SCHEDULED_TASK>&lt;/PARAMS>" />
     <NODE NAME="EditedTime" TYPE="number" VALUE="0" />
    </ITEM>

 

    <ITEM NAME="7">
     <NODE NAME="Guid" TYPE="string" VALUE="ffffffff-ffff-ffff-ffff-ffff80000005" />
     <NODE NAME="LastExec" TYPE="number" VALUE="0" />
    </ITEM>

 

[itman 1,808]

23 minutes ago, Marcos said:

For some reason there are 7 tasks in your cfg xml but only 6 appear in gui after import. The last task is an on-demand scan of the system drive.

For what's it worth, my export log shows the same 7th entry and the Eset GUI only shows only 6 tasks.

[SDHicks 1]

You'll have to pardon me Marcos but I'm not exactly sure what you want me to do here. Can you explain in detail please? I don't want to mess something up.

[Marcos 5,468]

9 hours ago, itman said:

For what's it worth, my export log shows the same 7th entry and the Eset GUI only shows only 6 tasks.

It's probably the Initial scan task then. Nevertheless, it's disabled on SDHicks' pc so it can't trigger the scans.

At this point I'd recommend uninstalling ESET and installing it from scratch with default settings to see if it makes a difference.

[SDHicks 1]

I reinstalled everything so I'll give it some time and see if it's any better. Thanks.

[SDHicks 1]

Hey Marcos, it looks like uninstalling and reinstalling fixed the problem. I haven't had any of those random full system scans for the last week. I'll keep an eye on it for the time being and hopefully I won't be having any more trouble with it. Thanks for the help!

[SDHicks 1]

It's doing it again. This is really getting frustrating. When I mouse over the icon in the system tray, it says "startup scan in progress". My computer has been running all day. Something is wrong.

[Marcos 5,468]

Startup scans are essential and enabled by default but you can try temporarily disabling them in Scheduler and see if it makes a difference. Do they last for several minutes or even more? Basically startup scans should complete relatively quick but it also depends on how many files you have on your desktop for instance.

[SDHicks 1]

It only last for several minutes like you said. I don't have a huge number of desktop items. Most are shortcuts. I have about 70 total and 18 of them are either very small .txt, .lua, .odt and some small .pdf files. I'm pretty careful about not cluttering up my desktop. In desktop properties it says 350 MB total. It has not done one of those super long full system scans and I have excluded folders and exe's that I don't want it to do.

[Marcos 5,468]

And what is the actual problem with startup scans? They are run with low priority so they should not have any noticeable effect on system performance.

[SDHicks 1]

Understood. I was concerned that it was starting to act funny again. If that's normal then I'll ignore it. Thanks.