Question about scan types with MSE.

[jorpe]

my OS is on a 3 SSD Raid0 setup right now. I have 2 1tb drives for media and a 2tb drive for image backups. MSE likes to ask me to do complete scans, which take hours and hours and hours. Can I comfortably leave off any of the ancillary drives for those weekly scans?
If not excluding the whole drive is it reasonably safe to exclude the .tib filetype for Acronis True Image?

 

[Golden]

Hi Jorpe,

Sorry, just to check : are you saying MSE takes hours to scan on the RAID0 made up of 3 x SSD's? Thats doesn't sound correct to me......can you clarify please?

Regards,
Golden

 

[jorpe]

Hi Jorpe,

Sorry, just to check : are you saying MSE takes hours to scan on the RAID0 made up of 3 x SSD's? Thats doesn't sound correct to me......can you clarify please?

Regards,
Golden

I'm sorry, I didnt type that very clearly. The OS drive of the RAID SSDs takes a few minutes to do a full scan. There are 2 1TB Spinpoint f3 drives for media and the like, as well as a 2TB western digital green drive which stores downloaded programs, updates, system images and a second backup of my music and pictures. The drives outside of the SSDs take over 8 hours to scan using the ''full scan'' parameters. I was wondering if they are okay for exclusion or at least okay to exclude the backup image files from being scanned.

 

[Golden]

Hi,

OK. 8 hours seems a bit exessive for 3TB - are they full? Perhaps its the type of files? Are you limiting the amount of processor that MSE uses? See below:



Once you have established that the .TIB files are free of malware, then in theory they should be good, but you can't ever guarantee that some infection on your system won't also make it into the .TIB files....in fact, those files are designed to restore from, so if they are infected, you will be restoring an infected system.

One option is have a second line of defense. Try scanning with Malwarebytes and see how long that takes. Note : Malwarebytes isn't a replacement, its just another layer of added security. Don't scan with both at the same time, as one could detect the other as malware.

Regards,
Golden

 

[jorpe]

Hi,

OK. 8 hours seems a bit exessive for 3TB - are they full? Perhaps its the type of files? Are you limiting the amount of processor that MSE uses? See below:

View attachment 179613

Once you have established that the .TIB files are free of malware, then in theory they should be good, but you can't ever guarantee that some infection on your system won't also make it into the .TIB files....in fact, those files are designed to restore from, so if they are infected, you will be restoring an infected system.

One option is have a second line of defense. Try scanning with Malwarebytes and see how long that takes. Note : Malwarebytes isn't a replacement, its just another layer of added security. Don't scan with both at the same time, as one could detect the other as malware.

Regards,
Golden

Thanks for taking the time to help me out. There is 4tb total outside the SSDs, and between the drives there's just 774GB free. The processor was limited to 50%. I put the limit to 100% just to check out the difference. I'll see on Sunday how long it takes. I have Malewarebytes and I've never noticed it taking so long. For fear of infection I think I'll keep the .tib files being scanned.

 

[Golden]

For fear of infection I think I'll keep the .tib files being scanned.

Wise move.

 

[gautam7]

Might be offtopic but is it really important to do full scan? I mean the AV has real time protection which make it to scan everything when you open, write, modify, run and do all such thing. When you try to run something MSE will scan the file before it can run and if that is infected then it will block it anyway. No reason to do any full scan with MSE. Instead it would be good if you do monthly scan with MBAM free which is ondemand and need to update and run manually.

Please correct me if i am wrong.

Thanks again

 

[cluberti]

Full scans are usually a good idea, as updated definition files are released multiple times a day - you might find a file you don't access at all could contain a virus for which detection was recently added in a new dat file. If you never re-scan the file, that infection could sit dormant for as long as it wants, unmolested by any antivirus scans. It's an outside case, for sure, but doing a full scan once a month doesn't seem too onerous either. As to the OP, virus scan performance is heavily exacerbated by things like free disk space, disk fragmentation, and file layout on disk (somewhat related to fragmentation). Usually I see the slowest scans on the disks that are the most full, which usually are also the most fragmented.

 

[gautam7]

If you never re-scan the file, that infection could sit dormant for as long as it wants, unmolested by any antivirus scans.

You have a point but still i believe a virus won't sit there and do nothing it will certailly try to modify certain process to take control over the PC for this it have to run and then the AV could catch it irrespective of i do a full scan or not. And it the virus remain inactive like in a .rar file then i don't think that can do any harm because it will be inactive and once i try to unpack the .rar file AV will catch it anyway.

Because of the way AV work a full scan just seem unnesessary but still a full scan once in a while doesn't hurt either i guess

Thanks again