Jump to content
ebloch

Detect When Scan Finished

Recommended Posts

Win 7 Home SP-1 64 bit with Immunet 3.1.13.9666

 

I run an Immunet scan as part of an unattended overnight batch. To do this I am using a "button pusher" called PTFBpro.

 

I would like to pause the batch until the scan is complete. The normal START "" /WAIT does not work. I heve tried WMIC to monitor SFC.exe CPU usage until it reaches 0. The problem is that the SFC CPU usage is not consistant and even shows some momentary 0 values DURING a scan and positive values when Immunet is NOT scanning.

 

Is there a method to monitor when a scan has completed?

Share this post


Link to post
Share on other sites

Hi ebloch, to my knowledge the only way to monitor a scan's progress is using Immunet's own GUI.

 

As far as the CPU usage not being consistent during a scan, that could be caused by a file of interest being sent to the cloud servers for a quick analysis which could bump up the system resource usage temporarily and then reduce as it waits for a clean or malicious determination. Immunet automatically scans any file accessed during normal (no active scan) usage too.

 

Cheers, Ritchie...

Share this post


Link to post
Share on other sites

Thanks for your quick reply. Until a better method shows up I will try the following.

(New lines indented 3 spaces so one can see line wraps.)

 

PTFB is a "button pusher" which runs an Immunet ful scan when the GUI opens.

Every 120 seconds the SFC.exe CPU % is SET into AA.

Count of AA at 0% is added to XX. If AA above 0% then resets XX to 0.

When XX reaches 3 the batch continues.

ECHOs show batch progress in CMD window and RPT is the saved batch log

 

Should work unless unlucky and hit CPU=0 on three successive checks while still scanning.

=====================================================================

START "" %PTFB%

SET Linex=%Time: =0% Immunet Full Scan

SET /A "XX=0"

ECHO %SPC%%Linex% & ECHO.

START "" "C:\Program Files\Immunet\3.1.13\iptray.exe"

:ImmunetCheck

TIMEOUT 120 > NUL

"C:\Windows\System32\wbem\WMIC.exe" path Win32_PerfFormattedData_PerfProc_Process get Name,PercentProcessorTime | findstr /i SFC > D:\Temp.txt

SET /P AA=<D:\Temp.txt

SET /A "AA=%AA:~-22%"

IF "%AA%" GTR "00" (SET /A "XX=0") ELSE (SET /A "XX=%XX%+1")

IF "%XX%" LSS "3" GOTO ImmunetCheck

ECHO %Linex% %Time: =0%>>%RPT% 2>&1

GOTO ShowReport

===================================

The overnight batch runs every night but Immunet scans only on Wednesdays and I will wait for "real" results as the entire batch is run in the future.

 

The above CMDs will impact Immunet's scan time so after it is proven to work I will add an initial TIMEOUT (before :ImmunetCheck) close to the "normal" scan time and then change the above TIMEOUT 120 to a lower value.

 

Any suggetions appreciated.

Share this post


Link to post
Share on other sites

SFC.exe is present in "Windows Task Manager-Processes" when the ImmunetProtect SERVICE is running.

 

What will cause the ImmunetProtect Service to STOP and therefore eliminate the SFC.exe process?

 

I ask because for the first time I was unable to attend my batch until hours after a scan had completed and I found that the ImmunetProtect SERVICE had stopped which is not commanded by my batch. In fact, since that stopped sfc.exe, my batch stalled and would not complete until I manually restarted the service so the batch could read that sfc.exe used "0" CPU for 3 checks.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...