Full System Scan Time Consuming

[jjimmunet]

Does a full system scan normally take several hours? When I used to perform a full system scan if would take around 45 minutes, but now it takes nearly 2-3 hours on the same pc. There have been no significant changes on my pc.

[ritchie58]

Hi jj, When I run a Full Scan of my C: drive it normally takes about 6 hours to complete since I have numerous software packages installed. There are several factors that will affect the amount of time needed for a Full Scan. The amount of "stuff" you have installed will affect the time, like it does myself. The settings you use can affect the time required too. For instance, if you have many archived/compressed/packed files and you have "Scan Archive Files" and "Scan Packed Files" activated in "Scan Settings" that can increase the time significantly. It's not a real good idea to deactivate these settings, however, since most viruses are compressed files. Also it depends on the amount of server traffic (Immunet is a cloud based AV after all) at the time you started the scan. Sometimes it helps if the scan is performed during off-peak hours such as early morning or later evening hours. You could also run into additional scan times if you have new software and those files/processes are not yet in the database. Longer scan times will take place for those files since they're unrecognized. Personally I normally just run the Flash Scan on a daily basis since it's very quick and I only run a Full Scan if I observe unusual or suspicious behavior that warrants investigation. I hope this clarifies things a bit for you jjimmunet. Best wishes, ritchie58...

[jjimmunet]

Thank you ritchie. It makes sense. I've partitioned my hard drive, and have linux on it. Also, I also have virtualbox on each partition, each with its on running virtual machine OS. So in essence, I now have 4 different OSes on my hard drive (if you count the virtual machines). I suspected that the longer scan times were due to this. I also have the factory image on it. Before, I had done a custom install and didn't have the factory image, but recently I restored my computer back to factory setttings, and re-installed Windows 7, but this time left the factory image on the hard drive. Before it was just Windows 7. So all these things probably go into why my full systems scans have doubled in time.

 

I am not really able to tell if a Immunet 3.0 full system scans includes the whole hard drive -- the windows ntfs partition, as well as the linux partition, and the factory.

 

If not, the longer scan times, might just be due to the Virtual Machine OS I have installed in VirtualBox on the Windows 7 partition.

 

Thanks again, jj.

[ritchie58]

No problem jj. I think your assumption is correct. The additional files needed to run a virtual OS would indeed increase scan times significantly since VM software creates a mirror image of your OS. On a plus note running a virtual OS makes your computer almost impervious to malware infection since no permanent changes to the actual OS can take place. I've used VM software in the past when beta testing for different vendors.

[Innerspaceboy]

I am running a full scan of a 320GB internal, 2TB internal, and 2TB external disk. I am 21 hours into the scan and it looks like it has another 12 hours left on the final (external) drive.

 

Half of each drive is empty. The system is a hand-me-down dual core amd x64 with 3GB DDR (my blazing fast PC's mobo just died so I'm grateful to have anything.)

 

After the first 9 hours I realized it said "scan complete" but the number of files scanned was increasing and no filenames were listed. I discovered that another antiviral app, Vipre was blocking agent.exe. I disabled Vipre and added it's program path to the permitted list in Immunet and the scan self-corrected, now displaying filenames and the "completed" message went away.

 

It's up to file #263053 so far.

 

Is it common for full scans to take several days to complete?

[Pedersen]

Hello Innerspaceboy. No it is not common. I believe the reason why you experience such a long scanning time is because VIPRE in incompatible with Immunet. Source: http://support.immunet.com/tiki-read_article.php?articleId=20

I am not able to say if allowing agent will solve the problem but did you try to restart the computer and start a new scan after allowing agent.exe? Some errors might had occurred after VIPRE blocked Immunet which a restart should solve. I would be happy to know the result.

 

 

Best regards.

Pedersen

[Innerspaceboy]

I've rebooted, disabled Vipre, killed the Vipre task in TaskMan, disconnected the external and started a new scan after a known false positive was reported by Immunet during a routine download of the application Subsonic from it's official site.

 

2hrs 30mins in, it's scanned the 19 of the 25GB which make up the Win7 OS on my primary disk. It still has to go through 800GB of media on my secondary internal disk after the final 6GB of the first drive. At the current scan rate of 12.5 GB/hr that's 64 more hours of scanning.

 

While entering this post another false positive came up, this time for an HP Installer Time Plug-In. In the 24 hours I've had this PC, I've had three or four unique items quarantined which I know are virus-free. I am by no means complaining, I understand it is the nature of anti-virus software. Just curious how regularly I should expect these to pop up?

 

My next step will be to boot over to my Ubuntu 11.10 partition and run a full scan of both local drives using ClamAV for Linux. (I presume I would be subject to the same false positives as they are both powered by the same DB?)

 

Stay tuned.

[Innerspaceboy]

Results are in.

 

Scanning the same file systems with ClamTk in Ubuntu 11.10 on the same PC takes exactly as long as it did on my Windows partition.

 

After re-reading the messages above, I realized (foolishly) that I hadn't deleted my Win7 and XP Virtual Machine folders which were left on my Ubuntu partition so I've just taken them out of the equation.

 

Still I don't see how Ubuntu folders would affect the scans I did of only the Windows partition from within Windows.

 

Any other thoughts?

[Pedersen]

Thanks for you response Innerspaceboy. I must agree that is sounds very slow. It is an average speed of 2.2mb/s and yet the slowest I ever have heard of. Are you using the free or paid version of Immunet?

 

Regarding the false positive I wont believe you are gonna encounter those on ClamAV. The false positives are found by our heuristic engine (zero-day detection) so they are not present in our signature. Besides that they are sorted out pretty quickly.

 

Regarding popups you should NOT expect those often. When Immunet have scanned your system once then most FP have been found and corrected and in the future you should maximum encounter 4 FP a year depending on how much you download/install. Otherwise only viruses will be detected

[Innerspaceboy]

Attempted to completely uninstall Vipre from the Control Panel and discovered the installer was damaged and couldn't be removed. (The trials that come with a free used PC.) Tried moving my temp folder as one site suggested but to no avail. Re-installing on top of it changed nothing. Ended up utilizing the full version of YourUninstaller as a final resort and finally removed it completely.

 

After rebooting I tried another scan with Immunet but the first 10% took just as long as before. And strangely enough Immunet still names Vipre as the active AV app in the lower left of its main window.

 

I read that my former AV app of choice, AVG Free plays nice with Immunet and that the paid version also works well so long as you allow the Immunet process in AVG's firewall. For control group's sake I installed the latest version and ran a full scan of the ~30GB Windows OS partition. It completed the scan in 30 minutes.

 

I presume that my peak 1GB/min scanning speed is more a limitation of this PC's antiquated processor and RAM than an aspect of the application performing the task.

 

I plan to keep Immunet active for it's outstanding track record of catching incoming threats but for full system scans I'm going to have to fall back on AVG.

 

Any concluding thoughts are welcomed and appreciated. Thank you all for your input!

[ritchie58]

Hello Innerspaceboy, I would venture to guess that the reason that Vipre is still showing as your other AV with Immunet is that there is still some left over remnants, probably some registry threads left over after uninstalling. As I mentioned in the previous thread to this topic I normally just run a Flash Scan on a daily basis with Immunet. I only run a full scan with Immunet if I encounter suspicious or unusual behavior since scan times are rather long. I think you made a good choice though. AVG and Immunet Free do play nice together. AVG also has rootkit detection which is another plus. Just to avoid any possible future conflicts it's a good idea put Immunet's Program Files folder in AVG's Exclusion List. By default AVG is already excluded with Immunet if you haven't deleted those exclusions. Best wishes, Ritchie...