2 replies to this topic

[NobodyYouKnow]

I'm trying to use EMSI Command Line Scanner to run a quick scan of critical files once a day, but I find it takes hours to run. This is the line I'm using:

a2cmd /f c: /s /m /t /quick /d /smart /extexclude=avi,mpg,iso,jpg,jpeg,gif,bmp,mpeg,mp3,aac,mp4,mkv /l=c:\a2.log

(I added the exclusions to try to speed it up.)

I was thinking it might be better to just tell it to scan specific extensions, but I'm not sure what the best ones to scan would be.

If anyone has any suggestions on how I can run a quicker scan that still will give decent protection, or should I just live with it scanning for 3 to 4 hours?

Thanks!

[Fabian Wosar]

a2cmd /f c: /s /m /t /quick /d /smart /extexclude=avi,mpg,iso,jpg,jpeg,gif,bmp,mpeg,mp3,aac,mp4,mkv /l=c:\a2.log

Those settings are highly redundant. Both /smart and /quick already include /t and /m and may even cause those scans to be performed multiple times. The same is true for the /f c: which includes all areas that would be scanned by /smart and more.

I was thinking it might be better to just tell it to scan specific extensions, but I'm not sure what the best ones to scan would be.

I would go with:

a2cmd c:\ /s /t /d /x=asp,bat,cgi,chm,cla,class,cmd,com,cpl,ini,css,dll,elf,exe,hlp,hta,htm,html,wh,jpe,jpeg,jpg,js,jse,lnk,ocx,php,pif,xpi,reg,scr,sh,shs,src,sys,txt,vbs,vxd,wmf,doc,docs,xls,xlsx,ppt,pptx,pdf

That will scan for traces as well as all files on c:\ with one of the mentioned extensions (which should include almost all formats used by malware). The memory scan as well as the /smart and /quick parameters are redundant and were therefore removed (/m would scan all executables and modules running, but we are scanning the entire drive anyways).

I hope those changes will speed up the scan enough. If it is still too slow for your taste you will have to wait a bit longer until EAM 6.0 is released which has highly improved on-demand scan times.

[NobodyYouKnow]

Thanks! I've been playing with that line so long, that I must have screwed up and put in both /smart and /quick. Stupid of me. Thanks for the tip, I'll give it a try.