Scan Times Inconsistent - WD Bonkers

[Guest]

I am running Windows XP SP2 Home Edition - 2.53 GHz Pentium 4. I have been
reviewing the posts about excessively long scan times, both for full system
scans and custom scans. I am not going to address full system scans times.
I have relatively few products installed and the number of files on other
systems can vary considerably so timings would be meaningless. What I am
going to address is what I consider to be a "bug" that would affect timings
on all systems. Firstly, I ran a ChkDisk to verify that my file structure
was not corrupt. Secondly, I disabled the starting of my anti-virus,
firewall, and other applications. The only thing running was Windows
Defender, graphics drivers, and Microsoft Windows software. I ran three WD
quick scans. Timings are as follows: (1) 00:02:23, objects scanned 19827 (2)
00:01:29, objects scanned 16487, (3) 00:01:30, objects scanned 16485. Why
the discrepancies in objects scanned and particularly the almost 1 minute
difference for the first scan time? I then turned my attention to custom
scan. I scanned one folder in program files that contained 0 files. The
objects scanned number went up to 16619, hovered at that number for around a
minute, went up to 16682 and hovered and then the scan completed. WD
correctly determined that the folder was empty - objects scanned 0. I
observed that it looked like WD was scanning almost all of the program files
folders until it finally scanned and stopped at the one I told it to scan.
The times it took to do this were approximately 11 to 12 minutes. There was
some mention that WD always does a quick scan before looking at the custom
scan folder; but obviously this does not account for the long scan times. I
don't know if this problem has any impact on full system scan times and I do
not plan to pursue the issue. Feel free to do so yourself.

 

[Bill Sanderson]

I won't answer your RTP question, because you asked not to hear
speculation--which says to me that you'd like a Microsoft answer. I think
they are not around these days, but perhaps we'll get lucky.

I'll speculate a little on this one, though.

I don't have any answers about the broader issue you raise--there clearly
seems to be a bug of some sort in some machines where the scan times seem
excessive. As I think about this, I can imagine one legit cause: Windows
Defender scans within archives. This is one reason that the object count
seems excessive to some of us--it scans ISO's ZIPs, etc. I don't know
whether there are forms of image backups it scans, but if you have such
backup images of your running system, you might easily see the appearance of
the same files being scanned twice. I've observed myself that the filenames
appearing during archive scanning are not correct at times.

The Quickscan as I understand it--look for a post from a [MSFT] name
describing the difference betwen full and quickscans--works backwards from
what is in memory and startup locations. So--I could see--from your timing
examples--there having been more sitting in memory and pagefile on the first
run than on the successive runs--since you'd just started and dumped some
stuff out. Otherwise, I don't have any thoughts about the timings you
observed.

--

 

[Guest]

Thanks for your response. I should have mentioned that the scan tests were
conducted with real time protect off, heuristics off, scanning archives off,
and automatic scan off. Actions were set to use signature default. Also, as
you correctly surmised, the 3 quick scan tests were conducted back to back.
Thank you again for the additional insight.

I won't answer your RTP question, because you asked not to hear
speculation--which says to me that you'd like a Microsoft answer. I think
they are not around these days, but perhaps we'll get lucky.

I'll speculate a little on this one, though.

I don't have any answers about the broader issue you raise--there clearly
seems to be a bug of some sort in some machines where the scan times seem
excessive. As I think about this, I can imagine one legit cause: Windows
Defender scans within archives. This is one reason that the object count
seems excessive to some of us--it scans ISO's ZIPs, etc. I don't know
whether there are forms of image backups it scans, but if you have such
backup images of your running system, you might easily see the appearance of
the same files being scanned twice. I've observed myself that the filenames
appearing during archive scanning are not correct at times.

The Quickscan as I understand it--look for a post from a [MSFT] name
describing the difference betwen full and quickscans--works backwards from
what is in memory and startup locations. So--I could see--from your timing
examples--there having been more sitting in memory and pagefile on the first
run than on the successive runs--since you'd just started and dumped some
stuff out. Otherwise, I don't have any thoughts about the timings you
observed.

--

I am running Windows XP SP2 Home Edition - 2.53 GHz Pentium 4. I have been
reviewing the posts about excessively long scan times, both for full
system
scans and custom scans. I am not going to address full system scans
times.
I have relatively few products installed and the number of files on other
systems can vary considerably so timings would be meaningless. What I am
going to address is what I consider to be a "bug" that would affect
timings
on all systems. Firstly, I ran a ChkDisk to verify that my file structure
was not corrupt. Secondly, I disabled the starting of my anti-virus,
firewall, and other applications. The only thing running was Windows
Defender, graphics drivers, and Microsoft Windows software. I ran three
WD
quick scans. Timings are as follows: (1) 00:02:23, objects scanned 19827
(2)
00:01:29, objects scanned 16487, (3) 00:01:30, objects scanned 16485. Why
the discrepancies in objects scanned and particularly the almost 1 minute
difference for the first scan time? I then turned my attention to custom
scan. I scanned one folder in program files that contained 0 files. The
objects scanned number went up to 16619, hovered at that number for around
a
minute, went up to 16682 and hovered and then the scan completed. WD
correctly determined that the folder was empty - objects scanned 0. I
observed that it looked like WD was scanning almost all of the program
files
folders until it finally scanned and stopped at the one I told it to scan.
The times it took to do this were approximately 11 to 12 minutes. There
was
some mention that WD always does a quick scan before looking at the custom
scan folder; but obviously this does not account for the long scan times.
I
don't know if this problem has any impact on full system scan times and I
do
not plan to pursue the issue. Feel free to do so yourself.

 

[Joe Faulhaber[MSFT]]

I can tell you why the first scan takes longer - or rather, why the second
scan is faster. There's a file cache being used, which can make for
significant perf improvements on subsequent scans. I assume somebody was
creating and removing files during your test, but the file counts are a
weird one.

Custom scan is changing to only do the quick scan if something is found, so
that should change things quite a bit.

Regards,
Joe

Thanks for your response. I should have mentioned that the scan tests
were
conducted with real time protect off, heuristics off, scanning archives
off,
and automatic scan off. Actions were set to use signature default. Also,
as
you correctly surmised, the 3 quick scan tests were conducted back to
back.
Thank you again for the additional insight.

I won't answer your RTP question, because you asked not to hear
speculation--which says to me that you'd like a Microsoft answer. I think
they are not around these days, but perhaps we'll get lucky.

I'll speculate a little on this one, though.

I don't have any answers about the broader issue you raise--there clearly
seems to be a bug of some sort in some machines where the scan times seem
excessive. As I think about this, I can imagine one legit cause:
Windows
Defender scans within archives. This is one reason that the object count
seems excessive to some of us--it scans ISO's ZIPs, etc. I don't know
whether there are forms of image backups it scans, but if you have such
backup images of your running system, you might easily see the appearance
of
the same files being scanned twice. I've observed myself that the
filenames
appearing during archive scanning are not correct at times.

The Quickscan as I understand it--look for a post from a [MSFT] name
describing the difference betwen full and quickscans--works backwards
from
what is in memory and startup locations. So--I could see--from your
timing
examples--there having been more sitting in memory and pagefile on the
first
run than on the successive runs--since you'd just started and dumped some
stuff out. Otherwise, I don't have any thoughts about the timings you
observed.

--

I am running Windows XP SP2 Home Edition - 2.53 GHz Pentium 4. I have
been
reviewing the posts about excessively long scan times, both for full
system
scans and custom scans. I am not going to address full system scans
times.
I have relatively few products installed and the number of files on
other
systems can vary considerably so timings would be meaningless. What I
am
going to address is what I consider to be a "bug" that would affect
timings
on all systems. Firstly, I ran a ChkDisk to verify that my file
structure
was not corrupt. Secondly, I disabled the starting of my anti-virus,
firewall, and other applications. The only thing running was Windows
Defender, graphics drivers, and Microsoft Windows software. I ran
three
WD
quick scans. Timings are as follows: (1) 00:02:23, objects scanned
19827
(2)
00:01:29, objects scanned 16487, (3) 00:01:30, objects scanned 16485.
Why
the discrepancies in objects scanned and particularly the almost 1
minute
difference for the first scan time? I then turned my attention to
custom
scan. I scanned one folder in program files that contained 0 files.
The
objects scanned number went up to 16619, hovered at that number for
around
a
minute, went up to 16682 and hovered and then the scan completed. WD
correctly determined that the folder was empty - objects scanned 0. I
observed that it looked like WD was scanning almost all of the program
files
folders until it finally scanned and stopped at the one I told it to
scan.
The times it took to do this were approximately 11 to 12 minutes.
There
was
some mention that WD always does a quick scan before looking at the
custom
scan folder; but obviously this does not account for the long scan
times.
I
don't know if this problem has any impact on full system scan times and
I
do
not plan to pursue the issue. Feel free to do so yourself.