14 replies to this topic

[maveric]

I have been cleaning up a windows xp pc that had a large amount of malware, spyware and viruses. While doing this I noticed that malwarebytes antimalware takes an exceptionally long time to run a quickscan (sometimes over 2 hours) on some profiles, while other profiles on the same machine take only 5-6 minutes. Between the profiles the number of objects scanned are very similar, and looking at task manager mbam.exe is using approximately the same amount of resources (processor and memory) and the only process using more and or anything close to it is System Idle Process.

Has anyone else run into this or know why this happens?

[Nira]

I'm having the same problem, sort of. I ran a quick scan yesterday and it went for 28 minutes. Then I decided at around 9:00pm EDT to begin a full scan. Eleven and a half hours later, IT IS STILL GOING! I also have this problem with my AVG program; a full virus scan takes anywhere from 4-5 hours. My PC runs Windows XP also and there are 50-55 processes running in the background, which is way too many. I'm not sure which ones I can close to make it faster without ending a task that is needed.

[maveric]

Nira, on Jun 2 2009, 09:25 AM, said:

I'm having the same problem, sort of. I ran a quick scan yesterday and it went for 28 minutes. Then I decided at around 9:00pm EDT to begin a full scan. Eleven and a half hours later, IT IS STILL GOING! I also have this problem with my AVG program; a full virus scan takes anywhere from 4-5 hours. My PC runs Windows XP also and there are 50-55 processes running in the background, which is way too many. I'm not sure which ones I can close to make it faster without ending a task that is needed.

I am by no means an expert, but from other posts I have read online, the quickscan should be all you need to check your system for malware. The Full Scan is more for if you have external disks and such that you want to include in the scan. If I am wrong about this please someone correct me, but this is the understanding I got from researching a similar issue with Full Scan.

[nosirrah]

The way quick scan works will get all malware that can enter memory and then usually all its associated components in virtually all cases .

As for why its slow I know of only one cause , safemode . MBAM is designed to have its maximum strength and speed from regular mode .

On the vast majority of systems MBAM will take less than 10 minutes to do a quick scan . On newer systems with not much software it can easily be under 3 minutes .

If you can , the next time you have a scan take a long time note where it seems to be going slow .

Once thing that will usually make it faster is to do a temp file cleanup first .

[maveric]

I am running a scan now, and it seems to go slow through other profiles local settings. Though the profiles that complete quickly as in 5-6 minutes also go through the other profiles local settings. Ie c:\documents and settings\other machine profile name\local settings\... so maybe cleaning up the temp files on other profiles will help, I will try that.

It always gets through the registry quickly.

[maveric]

well i went through each of the profiles and got rid of the temporary files and temporary internet files. This did help, but I still see a marked difference between profiles, the longest now taking 48 minutes to complete and the shortest now is taking 12 minutes (which is weird because the last two times I ran under this profile it only took 6 minutes).

PC is 3ghz P4 Hyperthreading with 1.5gb of ram, windows xp sp3.

It doesn't seem to be slow scanning in any specific "section" it is just slow when it starts scanning file objects getting maybe 5-20 objects/second at times.

I just think it is strange to see this large of a difference depending on what profile you are logged in as.

[nosirrah]

Are the slow ones non admin accounts ?

[maveric]

The way the machine is set up, each user is listed as "Computer Administrator" other than the guest account (disabled) and asp.net account.

[maveric]

ok i know this probably makes no sense at all, but quickscan runs faster on subsequent runs. I ran multiple scans in a row.

1. 10:08
2. 5:15
3. 3:14
4. 3:14

[maveric]

so i rebooted and logged in with one of the profiles that always has gone slow and ran multiple scans:

1. 6:53
2. 3:34
3. 3:22
4. 3:24

Going through the recycler (it does almost exactly 6 objects per second) and local settings of other profiles seems to consistently be the slowest going.

It is running much faster on all profiles than it did just earlier today. From 2hrs+ to 3-10 minutes, is a huge difference.

Thanks for all your help Bruce, it is much appreciated.

[nosirrah]

Disk caching makes additional scans faster when run in sequence .

As far as I know this is as fast as you can get a scan to complete :

Malwarebytes' Anti-Malware 1.37
Database version: 2216
Windows 5.1.2600 Service Pack 3

6/2/2009 4:22:47 PM
mbam-log-2009-06-02 (16-22-47).txt

Scan type: Quick Scan
Objects scanned: 75861
Time elapsed: 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

2-7 minutes is completely normal on most systems .

[maveric]

I was doing a final scan before saying the box was clean, I ran an update on the database it went from like database version 2212 to 2216, then I ran a quickscan which resulted as:

Malwarebytes' Anti-Malware 1.37
Database version: 2216
Windows 5.1.2600 Service Pack 3

6/2/2009 4:47:48 PM
mbam-log-2009-06-02 (16-47-49).txt

Scan Type: Quick Scan
Objects Scanned: 203566
Time elapsed: 36 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



So after update it took much longer to run.

[maveric]

Unfortunately, since the machine seems better now (no infections I can find with malwarebytes, spybot s&d, or avg antivirus), I need to return the machine to my boss. I have had it for 5 days now trying to get everything out of all these profiles (9)...

[Leading Edge Toronto AU]

Is there a way to scan every profile at once?

Or is the best/only way to scan in each profile after logging in?

[AdvancedSetup]

No there is no way to scan the Registry profiles, but the file and folders of all profiles are scanned as needed when run with an Administrator account.

To finish off and cleanup any leftover Registry traces you need to logon with each account and run a QUICK SCAN only, not a Full Scan.