Fewer objects scanned

[jamjar 3]

Hi

When I ran a Malware Scan for the first time after reinstalling EAM, the log showed it scanned over 73,000 objects. When I ran it 4 days later the log showed only 46,000 objects scanned. The same applied to the Quick Scan with thousands fewer objects scanned than when it was run for the first time. I hasten to add I’ve not been deleting loads of files in the interim. Can someone explain this reduction in the number of objects scanned?

[JeremyNicoll 78]

A good place to start would be to review the Report files created by the scans, to see if you had all the same options selected both times.  You should be able to find the Reports in

    C:\ProgramData\Emsisoft\Reports

Each one has a name like: scan_170803-034427.txt    ie scan_yymmdd_hhmmss.txt

[jamjar 3]

The scan settings for the Malware Scan are the same for both times. The same for the Quick Scan.

[JeremyNicoll 78]

Do the scan reports show that the same version of EAM was in use each time?

Do you have more than one mounted disk?  If you do, were the same disks scanned both times?

Other than that... I have no idea, though in your position I might try running a custom scan, setting the options you want, and seeing what EAM claims to find now.

[jamjar 3]

Same version of EAM and just the one disc.

[JeremyNicoll 78]

I just reran the custom scan that I do every so often, here, (with EIS but that shouldn't matter) and on my two disk system it found roughly the same number of objects as it always does (in my case approximately 500,000).

[G11 1]

Same thing here. No changes in settings but malware scan went from around 75,000 down to 44,000 items scanned.

[JeremyNicoll 78]

Do either of you by any chance use the option to limit the number of files scanned according to their extensions?   If you do, I'm guessing that the scan report says that that filtering is occurring, but doesn't show you what the actual list of filtered values is.   So settings could be different but you wouldn't know...

I only mention it because I'm sure I read somewhere that someone's seen in their Forensic log that their list of extensions had changed... without them having made a change themselves.  I wonder if suddenly more files are being filtered out of the examination? 

(I don't filter by file types - ie I have my scans look at every file regardless of its type - which might explain why I haven't seen a big difference in number of objects.)

Edited September 8, 2017 by JeremyNicoll
added last sentence

[jamjar 3]

After some Googling I read that Bitdefender, at the next scan, will skip files that have been previously scanned as clean and haven’t been subsequently modified or accessed. As Emsisoft uses the Bitdefender engine, perhaps it does the same and that's why my next scan showed fewer scanned objects.

My first scan was immediately after reinstalling EAM. At that time the option “Only scan files with specific extensions” would've been checked (by default). My next scan was after I had unchecked that option. Curiously, both scan logs show “File extension filter: off”. Does that refer to the same thing?

[GT500 859]

2 hours ago, jamjar said:

After some Googling I read that Bitdefender, at the next scan, will skip files that have been previously scanned as clean and haven’t been subsequently modified or accessed. As Emsisoft uses the Bitdefender engine, perhaps it does the same and that's why my next scan showed fewer scanned objects.

We do have similar scan time reduction mechanisms. Most of those apply on the first scan as well, however there can be some differences in number of files scanned from scan to scan because of these optimizations.

 

2 hours ago, jamjar said:

... Curiously, both scan logs show “File extension filter: off”. Does that refer to the same thing?

Yes, it does. I'll ask our QA about that in case the extension filter isn't being used on the first scan.

[G11 1]

File Guard set to scan specific extensions. It has been like that since installation. Scanner settings set to scan PUP's. As far as I know nothing has changes in my settings.

EDIT: Just saw GT500 post so maybe that explains it.

[GT500 859]

On 9/7/2017 at 11:54 PM, G11 said:

File Guard set to scan specific extensions. It has been like that since installation. Scanner settings set to scan PUP's. As far as I know nothing has changes in my settings.

The File Guard settings have nothing to do with scans. If I remember correctly, the only way to change the file extension filter setting for scans is by doing a Custom Scan (the setting can not be configured for the Quick Scan or the Malware Scan).

[JeremyNicoll 78]

The new(ish) option to scan (or not) mail data files might have come along at just the wrong moment for the OP.    @jamjar when were the two scans you mentioned at the start?

[jamjar 3]

Hi

Where's the option to scan mail data files?

My first scan which was on the latest version was on 2 September, my second on 6 September. 

 

[JeremyNicoll 78]

Choosing it is probably only available in Custom scan, but it's something else that might not have had the same setting in an initial scan vv a later one.   Your difference in number of objects scanned was pretty big though - 27,000.  Do you use an email client (rather than webmail), and does it have huge numbers of files on your machine?

The option is older than I remembered, and came along at the end of May, but actual user choice of it isn't the issue, more whether it was on or not in your different scans.

[GT500 859]

On 9/9/2017 at 10:14 AM, jamjar said:

Where's the option to scan mail data files?

It's only available when running a Custom Scan.

 

[jamjar 3]

Further to my original post, my Malware Scan is now scanning over 70,000 objects again. I've not changed any settings or added loads of files. Has there been any update to the software to account for this?   

[GT500 859]

1 hour ago, jamjar said:

Has there been any update to the software to account for this?

We haven't released a program update since September 1st, and I don't believe that the update had any changes that would have effected this.

I'm fairly certain that this is expected behavior. If program caches and TEMP folders are cleared, then suddenly thousands of files can be deleted. It is even theoretically possible for these folders to accumulate large amounts of files in a relatively short period of time (depending on what you are doing on the computer). Combine that with the algorithms we use to determine what files to scan and speed up scan times, and that could account for an odd discrepancy in the amount of files scanned.

[Alihandro 0]

The same for the Quick Scan...

[GT500 859]

Question: Does the number of files scanned always go back up right after you restart your computer, and then always go down on subsequent scans?

If so, then it's just reducing the number of files that it's scanning, and resetting after a reboot (sort of like clearing a cache).