jamjar

Fewer objects scanned

Recommended Posts

Hi

When I ran a Malware Scan for the first time after reinstalling EAM, the log showed it scanned over 73,000 objects. When I ran it 4 days later the log showed only 46,000 objects scanned. The same applied to the Quick Scan with thousands fewer objects scanned than when it was run for the first time. I hasten to add I’ve not been deleting loads of files in the interim. Can someone explain this reduction in the number of objects scanned?

Share this post


Link to post
Share on other sites

A good place to start would be to review the Report files created by the scans, to see if you had all the same options selected both times.  You should be able to find the Reports in

    C:\ProgramData\Emsisoft\Reports

Each one has a name like: scan_170803-034427.txt    ie scan_yymmdd_hhmmss.txt

Share this post


Link to post
Share on other sites

Do the scan reports show that the same version of EAM was in use each time?

Do you have more than one mounted disk?  If you do, were the same disks scanned both times?

Other than that... I have no idea, though in your position I might try running a custom scan, setting the options you want, and seeing what EAM claims to find now.

Share this post


Link to post
Share on other sites

I just reran the custom scan that I do every so often, here, (with EIS but that shouldn't matter) and on my two disk system it found roughly the same number of objects as it always does (in my case approximately 500,000).

Share this post


Link to post
Share on other sites

Do either of you by any chance use the option to limit the number of files scanned according to their extensions?   If you do, I'm guessing that the scan report says that that filtering is occurring, but doesn't show you what the actual list of filtered values is.   So settings could be different but you wouldn't know...

I only mention it because I'm sure I read somewhere that someone's seen in their Forensic log that their list of extensions had changed... without them having made a change themselves.  I wonder if suddenly more files are being filtered out of the examination? 

(I don't filter by file types - ie I have my scans look at every file regardless of its type - which might explain why I haven't seen a big difference in number of objects.)

Edited by JeremyNicoll
added last sentence

Share this post


Link to post
Share on other sites

After some Googling I read that Bitdefender, at the next scan, will skip files that have been previously scanned as clean and haven’t been subsequently modified or accessed. As Emsisoft uses the Bitdefender engine, perhaps it does the same and that's why my next scan showed fewer scanned objects.

My first scan was immediately after reinstalling EAM. At that time the option “Only scan files with specific extensions” would've been checked (by default). My next scan was after I had unchecked that option. Curiously, both scan logs show “File extension filter: off”. Does that refer to the same thing?

Share this post


Link to post
Share on other sites
2 hours ago, jamjar said:

After some Googling I read that Bitdefender, at the next scan, will skip files that have been previously scanned as clean and haven’t been subsequently modified or accessed. As Emsisoft uses the Bitdefender engine, perhaps it does the same and that's why my next scan showed fewer scanned objects.

We do have similar scan time reduction mechanisms. Most of those apply on the first scan as well, however there can be some differences in number of files scanned from scan to scan because of these optimizations.

 

2 hours ago, jamjar said:

... Curiously, both scan logs show “File extension filter: off”. Does that refer to the same thing?

Yes, it does. I'll ask our QA about that in case the extension filter isn't being used on the first scan.

Share this post


Link to post
Share on other sites

File Guard set to scan specific extensions. It has been like that since installation. Scanner settings set to scan PUP's. As far as I know nothing has changes in my settings.

EDIT: Just saw GT500 post so maybe that explains it.

Share this post


Link to post
Share on other sites
On 9/7/2017 at 11:54 PM, G11 said:

File Guard set to scan specific extensions. It has been like that since installation. Scanner settings set to scan PUP's. As far as I know nothing has changes in my settings.

The File Guard settings have nothing to do with scans. If I remember correctly, the only way to change the file extension filter setting for scans is by doing a Custom Scan (the setting can not be configured for the Quick Scan or the Malware Scan).

Share this post


Link to post
Share on other sites

Hi

Where's the option to scan mail data files?

My first scan which was on the latest version was on 2 September, my second on 6 September. 

 

Share this post


Link to post
Share on other sites

Choosing it is probably only available in Custom scan, but it's something else that might not have had the same setting in an initial scan vv a later one.   Your difference in number of objects scanned was pretty big though - 27,000.  Do you use an email client (rather than webmail), and does it have huge numbers of files on your machine?

The option is older than I remembered, and came along at the end of May, but actual user choice of it isn't the issue, more whether it was on or not in your different scans.

Share this post


Link to post
Share on other sites
On 9/9/2017 at 10:14 AM, jamjar said:

Where's the option to scan mail data files?

It's only available when running a Custom Scan.

 

Share this post


Link to post
Share on other sites

Further to my original post, my Malware Scan is now scanning over 70,000 objects again. I've not changed any settings or added loads of files. Has there been any update to the software to account for this?   

Share this post


Link to post
Share on other sites
1 hour ago, jamjar said:

Has there been any update to the software to account for this?

We haven't released a program update since September 1st, and I don't believe that the update had any changes that would have effected this.

I'm fairly certain that this is expected behavior. If program caches and TEMP folders are cleared, then suddenly thousands of files can be deleted. It is even theoretically possible for these folders to accumulate large amounts of files in a relatively short period of time (depending on what you are doing on the computer). Combine that with the algorithms we use to determine what files to scan and speed up scan times, and that could account for an odd discrepancy in the amount of files scanned.

Share this post


Link to post
Share on other sites

Question: Does the number of files scanned always go back up right after you restart your computer, and then always go down on subsequent scans?

If so, then it's just reducing the number of files that it's scanning, and resetting after a reboot (sort of like clearing a cache).

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.