ESET Smart Security Premium Scheduled Scan Stuck

[Skier 7]

ESET Smart Security Premium v16.2.13.0

I have a weekly scan set to run at 01:00 on Saturday.  As at 11:20 the scan is still running and appears to be stuck on a particular file: C:\windows\system32\ctfmon.exe  See the attached screenshot.

Any ideas?

[Marcos 5,243]

Please narrow it down by scanning folders one by one and then file by file in the particular folder. Once you have found the troublesome file, supply it to me in a password protected archive.

[Skier 7]

Hi Marcos.  I don't think you've read my post fully as the file in question is listed in the text and shown in the screenshot; cftmon.exe, a Windows file.  Having rebooted ESET scans the file fine in isolation.  I'll run a further full scan to see what happens.

[itman 1,746]

I just ran an on demand scan of;

Quote

Log
Scanned disks, folders and files: C:\Windows\System32\

and the scan completed w/o issue.

One possibility here is ctfmon.exe is corrupted and this is what is causing the scheduled scan to hang.

Also, odd and notable is the posted scan log only shows 2748 objects were scanned. My log entry for the C:\Windows\System32\ directory alone shows 15701 objects scanned. This leads me to believe that the scan is not hanging on ctfmon.exe

Edited September 2, 2023 by itman

[Marcos 5,243]

4 hours ago, Skier said:

I don't think you've read my post fully as the file in question is listed in the text and shown in the screenshot; cftmon.exe, a Windows file. 

I did but I assumed that the issue would not occur if you scanned only ctfmon.exe or c:\windows\system32. If you are able to reproduce it, please raise a support ticket. Most likely a dump of ekrn.exe will be needed to find out what file was being scanned or what was going on.

[itman 1,746]

One other possible source for this Eset scan hang activity.

Are using another AV or security product that has its real-time scanning component enabled? Doing so could be the source of this hang.

[Skier 7]

20 hours ago, itman said:

I just ran an on demand scan of;

and the scan completed w/o issue.

One possibility here is ctfmon.exe is corrupted and this is what is causing the scheduled scan to hang.

Also, odd and notable is the posted scan log only shows 2748 objects were scanned. My log entry for the C:\Windows\System32\ directory alone shows 15701 objects scanned. This leads me to believe that the scan is not hanging on ctfmon.exe

The screenshot was taken when the scan was hung.  The animation was present but that doesn't come across in a screenshot.  The small number of files scanned in the System32 directory was because it was hung up part way through.

[itman 1,746]

I am still of the opinion that one or more corrupted files exist in the C:\Windows\System32\ directory.

Open an admin level command prompt window and enter the following;

sfc /scannow

When the scan completes which will take a while, you will be informed if corrupted /missing system files were discovered and if recovery of those were successful.

If corrupted files were discovered and recovered, now repeat a scan of C:\Windows\System32\ directory. Hopefully, it will complete sucessfully.

Edited September 3, 2023 by itman

[Skier 7]

I've already run the System File Checker command - no issues.  A manual scan completed earlier today without issue so I'll have to put it down to a transient issue.

To answer your earlier question as to whether I run another AV or security solution; I do, Malwarebytes.  I've run the two side-by-side for years without issue but do add exclusions to each of them.  I think that's been since 2006/7 since Windows Vista became available in 64-bit.

[itman 1,746]

1 hour ago, Skier said:

To answer your earlier question as to whether I run another AV or security solution; I do, Malwarebytes.

My take on this is the Eset scheduled/on-demand scan lockup will continue to manifest on an intermittent basis.

The recommended Eset and MBAM exclusions for each other are to prevent real-time scanning conflicts. It can be assumed when Eset is running a full device scan, it is performing file access and control methods different from that performed in real-time scan mode.

[Skier 7]

22 hours ago, itman said:

My take on this is the Eset scheduled/on-demand scan lockup will continue to manifest on an intermittent basis.

This is the first I've ever seen in what I think is around 16/17 years of using the two side-by-side.  I don't believe a conflict between ESET Smart security Premium and Malwarebytes is the issue but can't be certain.  Even if it is, an issue once every decade (or more) isn't a justification for ceasing using both products.

[Diane W 0]

Scheduled Scan has been running for 2 days now.  I've tried X to cancel and it won't cancel. How do I stop this?

[Marcos 5,243]

You have the registry selected to scan. Due to an bug with ineffective scan of certain registry values, it may take hours even to cancel a scan. You can reboot the machine if it takes too long. Please temporarily avoid selecting the registry as a scan target until the Cleaner module 1245 is released which will take approximate 1-2 weeks.