Detect When Scan Finished

[ebloch]

Win 7 Home SP-1 64 bit with Immunet 3.1.13.9666

 

I run an Immunet scan as part of an unattended overnight batch. To do this I am using a "button pusher" called PTFBpro.

 

I would like to pause the batch until the scan is complete. The normal START "" /WAIT does not work. I heve tried WMIC to monitor SFC.exe CPU usage until it reaches 0. The problem is that the SFC CPU usage is not consistant and even shows some momentary 0 values DURING a scan and positive values when Immunet is NOT scanning.

 

Is there a method to monitor when a scan has completed?

[ritchie58]

Hi ebloch, to my knowledge the only way to monitor a scan's progress is using Immunet's own GUI.

 

As far as the CPU usage not being consistent during a scan, that could be caused by a file of interest being sent to the cloud servers for a quick analysis which could bump up the system resource usage temporarily and then reduce as it waits for a clean or malicious determination. Immunet automatically scans any file accessed during normal (no active scan) usage too.

 

Cheers, Ritchie...

[ebloch]

Thanks for your quick reply. Until a better method shows up I will try the following.

(New lines indented 3 spaces so one can see line wraps.)

 

PTFB is a "button pusher" which runs an Immunet ful scan when the GUI opens.

Every 120 seconds the SFC.exe CPU % is SET into AA.

Count of AA at 0% is added to XX. If AA above 0% then resets XX to 0.

When XX reaches 3 the batch continues.

ECHOs show batch progress in CMD window and RPT is the saved batch log

 

Should work unless unlucky and hit CPU=0 on three successive checks while still scanning.

=====================================================================

START "" %PTFB%

SET Linex=%Time: =0% Immunet Full Scan

SET /A "XX=0"

ECHO %SPC%%Linex% & ECHO.

START "" "C:\Program Files\Immunet\3.1.13\iptray.exe"

:ImmunetCheck

TIMEOUT 120 > NUL

"C:\Windows\System32\wbem\WMIC.exe" path Win32_PerfFormattedData_PerfProc_Process get Name,PercentProcessorTime | findstr /i SFC > D:\Temp.txt

SET /P AA=<D:\Temp.txt

SET /A "AA=%AA:~-22%"

IF "%AA%" GTR "00" (SET /A "XX=0") ELSE (SET /A "XX=%XX%+1")

IF "%XX%" LSS "3" GOTO ImmunetCheck

ECHO %Linex% %Time: =0%>>%RPT% 2>&1

GOTO ShowReport

===================================

The overnight batch runs every night but Immunet scans only on Wednesdays and I will wait for "real" results as the entire batch is run in the future.

 

The above CMDs will impact Immunet's scan time so after it is proven to work I will add an initial TIMEOUT (before :ImmunetCheck) close to the "normal" scan time and then change the above TIMEOUT 120 to a lower value.

 

Any suggetions appreciated.

[ebloch]

SFC.exe is present in "Windows Task Manager-Processes" when the ImmunetProtect SERVICE is running.

 

What will cause the ImmunetProtect Service to STOP and therefore eliminate the SFC.exe process?

 

I ask because for the first time I was unable to attend my batch until hours after a scan had completed and I found that the ImmunetProtect SERVICE had stopped which is not commanded by my batch. In fact, since that stopped sfc.exe, my batch stalled and would not complete until I manually restarted the service so the batch could read that sfc.exe used "0" CPU for 3 checks.