10 replies to this topic

[ksiemb]

Over the past month or so, Flash scan has extended its run time from a couple of minutes to 7-8 minutes. This seems to happen during startup, and not so much during updates of the day.
Scanning Registry objects takes 2 1/2 to 3 minutes, in itself, then another 5 minutes to scan.
Followed advice from TM (support), deleting cache & temp files, but this had no affect.

Protection Log:
2012/06/28 02:01:40 -0400 HARRISON-0EKUAG MESSAGE Executing scheduled scan: Flash Scan | -terminate
2012/06/28 02:01:41 -0400 HARRISON-0EKUAG MESSAGE Scheduled scan executed successfully


MBAM Log:
Scan type: Flash scan
Scan options enabled: Memory | Startup | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: Registry | File System | P2P
Objects scanned: 191469
Time elapsed: 7 minute(s), 4 second(s)

[Maurice Naggar]

Hello,

Is it possible your antivirus is set to do a scheduled scan whilst MBAM is doing the flash scan?
What other security apps do you have installed ?

Has this pc ever had Norton or McAfee or ZoneAlarm installed ? Mcafee, Norton & ZA (as well as other apps) are known to leave drivers behind.
Did this pc come with trial versions of McAfee or Norton / Symantec?
Your Windows version is ??

[ksiemb]

Maurice Naggar, on 28 June 2012 - 06:41 AM, said:

Hello,

Is it possible your antivirus is set to do a scheduled scan whilst MBAM is doing the flash scan? No
What other security apps do you have installed ?
ZA Firewall & Anti Virus ( Exclusions set properly in ZA & MBAM)
Has this pc ever had Norton or McAfee or ZoneAlarm installed ? Mcafee, Norton & ZA (as well as other apps) are known to leave drivers behind.
Did this pc come with trial versions of McAfee or Norton / Symantec? No
Your Windows version is ?? XP Pro

[ksiemb]

Maurice Naggar, on 28 June 2012 - 06:41 AM, said:

Hello,

Is it possible your antivirus is set to do a scheduled scan whilst MBAM is doing the flash scan?
What other security apps do you have installed ?

Has this pc ever had Norton or McAfee or ZoneAlarm installed ? Mcafee, Norton & ZA (as well as other apps) are known to leave drivers behind.
Did this pc come with trial versions of McAfee or Norton / Symantec?
Your Windows version is ??

No scans scheduled at startup. ZA firewall & Antivirus installed - Exclusions set. Never used Norton Mcafee. - Using XP/Pro

[Maurice Naggar]

Turn OFF your ZA (temporarily) and then do a MBAM scan. Advise of rutime result.
Turn on ZA when done.

The other thing I would advise: Verify & double-check that your ZA is the latest version and all up-to-date.

[ksiemb]

After Windows startup was complete:
1) - Ran Flash Scan with ZA running: 2 min 45 secs.

2) - Exited ZA - Ran Flash Scan: 1 min 18 secs.
I will eliminate ZA for next reboot / MBAM update/flash scan and report results.

[ksiemb]

Update 6/30/2012: Startup this morning without ZA loaded. MBAM started, without executing update/flash scan.
It should have, as computer was off for 4-6 hours. Immediately did manual request for update (received some) and manual flashscan. (scan = 1 min 25 secs)

Started ZA: Did Manual flash scan - 7 min 35 secs (During this scan mbamservice was also using high cpu cycles, receiving more updates, I assume. Flash scan: automatic after update - 5 min 48 sec.

Also during these updates, There were no balloon notifications that the DB was updated. I do not recall these problems happening when I ran ZA Free firewall (Sans Antivirus), but it appears ZA Free, with Anti Virus is not playing nice with MBAM.

[Maurice Naggar]

You might have allowed a bit of time for the MBAM scheduler to kick in.

As to ZA, I would suggest you consider removing ZA and get Comodo firewall. From early on this year, I have had reservations about ZA, most especially on Win XP systems.
Now, if you have a hardware router in your setup, you can do fine using the windows native firewall (less 3rd-party ones), and needless to say, with updated antivirus + MBAM.

[ksiemb]

Maurice Naggar, on 30 June 2012 - 06:33 AM, said:

You might have allowed a bit of time for the MBAM scheduler to kick in.

As to ZA, I would suggest you consider removing ZA and get Comodo firewall. From early on this year, I have had reservations about ZA, most especially on Win XP systems.
Now, if you have a hardware router in your setup, you can do fine using the windows native firewall (less 3rd-party ones), and needless to say, with updated antivirus + MBAM.

Thanks for your input. Apparently, Checkpoint's ZA module vsmon.exe is conflicting. After several days of watching this, it has a CPU Time (not CPU) of 3-to-1 over MBAM.exe (3.01 vs 1:16). But there is high cpu usage or vsmon.exe, with MBAM getting much less. This was not evident when previously running ZA without their Antivirus, but running MSE instead. However; at that time, msmpeng.exe would interfere, just as vsmon does now. That's why I switched to ZA antivirus. No happy medium it seems. So if switching to Comodo firewall is recommended, which antivirus plays nicely with it & MBAM ? PS: I did leave plenty of time for mbam to kick in.

[Maurice Naggar]

Give Avira a try. And remember to set mutual trust settings, using FAQ as a template http://forums.malwar...showtopic=10138

[ksiemb]

I followed your advice, and dumped ZA firewall + Anti Virus in favor of Comodo + Avira. So far, Flash Scan is back to normal speed at startup. I no longer see contention, and MBAM is getting it all during this time. Thank you for the advice.