Scheduled Scan Failure

[Larry]

For months I've run a daily auto scan at 11:00. I noticed today, it didn't
run. I checked the Scheduled Task log, no entry. So I scheduled it to rerun
at noon. Again, it didn't run, and again there was no entry in the scheduled
task log. Anybody got any ideas what's going on, or how I can get it to
start running again? TIA
Larry

 

[Dave M]

Task Scheduler is a system service, make sure it's running as Automatic and
it's in Started status:

Right click My Computer > Manage > Services and Applications > Services
Scroll to Task Scheduler where it should show Automatic and in Started
status
If not right click it and choose Properties to set Startup as Automatic.

 

[Larry]

Well, Dave, thanks - but that wasn't it. I thought you had it, it sure acts
like Task Scheduler is not running, but the Services properties shows that
it's running, i.e. started, with an automatic start. I tried a couple of
things, maybe you'll see something that suggests what the problem is.

I opened Task Scheduler and scheduled WD to run at 2:37. It ran just fine.
Here's the info from Scheduled Task log...
""MP Scheduled Scan.job" (MpCmdRun.exe)
Started 8/3/2006 2:37:01 PM
"MP Scheduled Scan.job" (MpCmdRun.exe)
Finished 8/3/2006 2:37:56 PM
Result: The task completed with an exit code of (0)."

Then I opened WD, Tools, Options and scheduled an auto scan for 3PM. I
checked the Task Scheduler, and it correctly showed the 3PM scan scheduled.
Three PM came and went, no scan, and no entry at all in the Task Scheduler
log. So for some reason, even though everything looks good, the system isn't
doing the scan when I set the time inside WD. Make any sense? Got any
suggestions? TIA.
Larry

 

[Larry]

OK, I think I've got it now. I scheduled a 4 PM scan AND turned Real Time
Protection back on, and it scanned just as it should. I've now turned Real
Time Protection back of and scheduled another scan for 5PM. I assume it
won't scan and won't leave a Task Scheduler Log note. I don't see anywhere
in WD where it tells me auto scans won't run if Real Time Protection is
turned off, but, preliminarily, that's what it looks like is happening.
Larry

 

[Bill Sanderson MVP]

There are some things to try to rule out.

1) the scan has no ui--so start WD while the scan should be running and let
it sit long enough to try to connect to the scan in progress, or set the
icon to always on--it should should show scan activity on mouseover.

2) some installs seem not to show the history of scans properly--i.e.
history doesn't get updated even when a scan does go. I'm not sure how best
to catch this, but looking in the system events log filtered for WinDefend
would be my suggestion.

There have been reports on Windows 2000 systems that some GUI builds have
seen scheduled scan failures, either because of credentials issues, or
because the command line syntax scheduled seemed to be flawed. What version
of windows are you seeing this on?

--

 

[Bill Sanderson MVP]

I think that makes sense. Scans are initiated by mpcmdrun, but as I recall
it is msmpeng.exe that is eating the CPU during a scan. This clearly needs
to be documented better--not sure what the chances are for that at this
point, but at least it is something I can remember to mention when this
issue is posted--thanks.


--

 

[Bill Sanderson MVP]

I'm going to see if I can replicate this. I've turned off RTP. and set a
scheduled scan for 6 PM, and checked that the job exists and is scheduled
for today. Will see what happens.

--

 

[Larry]

Thanks Bill. I've done the same. I hope we get the same results.
Larry

 

[Bill Sanderson MVP]

Bad news, maybe: I can't replicate. The home page clearly says Real Time
Protection is off, but the scan happened at 6:02 PM (scheduled for 6:00)

So--that's a relief in terms of a bug in the app--but I don't know what's
happening in terms of your system.

I'll admit to not restarting the system, but I did log in and out of several
user accounts to try to replicate a different issue unrelated to Defender.

--

 

[Larry]

Hmmmmm, I felt certain your system would behave the same. My WD has always
worked flawlessly (except for 10 to 12 daily restore points created). After
I downloaded a new McAfee on Monday which also has a real time protection
system, I turned off WD RTP to avoid a conflict. It was only today that I
noticed the scan didn't occur on schedule. I'm disappointed that wasn't it,
then at least I'd know. Now I'm still puzzled why it'll scan if I set the
scan in Task Scheduler, but not if I schedule it in WD. I guess I'll just
schedule it in Task Scheduler. Thanks for checking.
Larry

 

[Bill Sanderson MVP]

Could McAfee be preventing the change to scheduled tasks? This happens at
startup, and if you turn on the notification for "changes made to the
computer by programs that are allowed to run" you should see a balloon
notice when it happens.

It is a hidden task--you need to go to Advanced to unhide it--but I think
you know all that stuff...

The task scheduler is definitely used by malware, so monitoring it is an
appropriate thing to do for an antimalware app--not sure what McAfee might
do.
--

 

[Larry]

Each time I reschedule the WD Scan Task in the Task Scheduler, McAfee alerts
me and it allows the scan to run, so I don't think McAfee is interfering
with a scan scheduled from within WD. And yes, I've got a check in "changes
made to the computer by programs that are allowed to run" (that's how I got
rid of all the daily restore points) and even though that box in the real
time protection (which is unchecked) I still don't get the restore points. I
might just go ahead and enable RTP in WD, I only disabled it because I
thought there might be a conflict with 2 RTP systems going. It might be
interesting to see what happens with both going at the same time.
Larry

 

[Bill Sanderson MVP]

I ran with both NIS2006 (beta) and Windows Defender (or was it Microsoft
Antispyware) for a time, just to see how they worked together. I got
duplicate alerts, but knowing that I had both scanners running, I was able
to make sense of what I saw.

--

 

[Larry]

Just a quick note to close out this thread. Auto scanning is now working
just fine, and Real Time Protection is off, so there is no issue there. I
have no idea why it wouldn't scan, but that's behind me now. WD is working
perfectly again. Thanks to Bill and Dave for your help.
Larry

 

[Bill Sanderson MVP]

Thanks--glad to hear it.