NobodyYouKnow

Emsisoft Commandline Scanner speed

3 posts in this topic

I'm trying to use EMSI Command Line Scanner to run a quick scan of critical files once a day, but I find it takes hours to run. This is the line I'm using:

a2cmd /f c: /s /m /t /quick /d /smart /extexclude=avi,mpg,iso,jpg,jpeg,gif,bmp,mpeg,mp3,aac,mp4,mkv /l=c:\a2.log

(I added the exclusions to try to speed it up.)

I was thinking it might be better to just tell it to scan specific extensions, but I'm not sure what the best ones to scan would be.

If anyone has any suggestions on how I can run a quicker scan that still will give decent protection, or should I just live with it scanning for 3 to 4 hours?

Thanks!

0

Share this post


Link to post
Share on other sites

a2cmd /f c: /s /m /t /quick /d /smart /extexclude=avi,mpg,iso,jpg,jpeg,gif,bmp,mpeg,mp3,aac,mp4,mkv /l=c:\a2.log

Those settings are highly redundant. Both /smart and /quick already include /t and /m and may even cause those scans to be performed multiple times. The same is true for the /f c: which includes all areas that would be scanned by /smart and more.

I was thinking it might be better to just tell it to scan specific extensions, but I'm not sure what the best ones to scan would be.

I would go with:

a2cmd c:\ /s /t /d /x=asp,bat,cgi,chm,cla,class,cmd,com,cpl,ini,css,dll,elf,exe,hlp,hta,htm,html,wh,jpe,jpeg,jpg,js,jse,lnk,ocx,php,pif,xpi,reg,scr,sh,shs,src,sys,txt,vbs,vxd,wmf,doc,docs,xls,xlsx,ppt,pptx,pdf

That will scan for traces as well as all files on c:\ with one of the mentioned extensions (which should include almost all formats used by malware). The memory scan as well as the /smart and /quick parameters are redundant and were therefore removed (/m would scan all executables and modules running, but we are scanning the entire drive anyways).

I hope those changes will speed up the scan enough. If it is still too slow for your taste you will have to wait a bit longer until EAM 6.0 is released which has highly improved on-demand scan times.

0

Share this post


Link to post
Share on other sites

Thanks! I've been playing with that line so long, that I must have screwed up and put in both /smart and /quick. Stupid of me. :) Thanks for the tip, I'll give it a try.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.