Solved MalwareBytes 2.0.1 taking forever to scan

[AdvancedSetup]

Yes there is a team of several members that does product QA.

 

[Britton30]

Malwarebytes Anti-Malware
[URL="http://www.malwarebytes.org/"]www.malwarebytes.org[/URL]
Scan Date: Mon  Apr 21  2014
Scan Time: 6:21:41 AM
Logfile: MBAM.txt
Administrator: Yes
Version: 2.00.1.1004
Malware Database: v2014.04.21.02
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Britton30
Scan Type: Custom Scan
Result: Completed
Objects Scanned: 529518
Time Elapsed: 4 hr, 9 min, 3 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)

(end)

Over a half million files and over FOUR hours. After the Custom scan I was logged out of all of the sites I stay logged into, ex. Seven Forums. No other programs were running during the scan.

It stopped on the same image file as has been mentioned, but only for a few seconds.

 

[AdvancedSetup]

Please note that we have actually just released a public beta of the build that is newer than the one I was testing with.

I would highly recommend that everyone please install this one and test it out and provide feedback on our site if possible. It should scan faster and fix a few other reported issues.

https://forums.malwarebytes.org/index.php?showtopic=147144

Thanks everyone

 

[jonnyhillow]

Happy Easter to all.

Yes I read your post Layback Bear and yes there have been some reports of certain files that can cause a slowdown or freeze. Data corruption can also do this - the updated version is hopefully a little better but not sure we'll be able to completely eliminate or not but we're trying.

@Mellon Head
Agreed that the Anti-Rootkit scanner you're using is slow. The updated one I'm using is faster, but see below in that it will never be a fast scan like a Threat / Quick Scan is.

Yes, I am using an updated build that is not currently available to the public but should be soon (it is available to our Experts group) and yes there are improvements in the new Anti-Malware scan times. Most hopefully should see faster scan times with it once it is made available to the public. In fact there was another version released internally since I scanned with my version that is supposed to improve some other items in the program.

As for the Softpedia review as with most it is very lacking in detail and what was really scanned and used was not fully detailed. We do not hide the fact that we do not detect older infections, never have and probably never will. Once we stop seeing infections in the wild they are usually pulled from our database and left up to your antivirus to deal with.

I know some of you may not agree and that is certainly your prerogative however I see no technical reason for doing Anti-Rootkit scans on a routine basis and certainly not daily. I've been doing Enterprise level computer support now for well over 20 years and I play with infections and to date have only gotten infected once by accident. I've been a lead support engineer for the security of over 130,000 desktops as well as thousands of servers and in my time as a lead we never had a single break out.

Probably no harm in doing daily extensive scans for a mechanical drive as none of them seem to last the 10+ years that they used to but doing extensive daily work on most SSD drives can potentially greatly reduce their life span.

One of our Experts did post a log of multiple mechanical drives and Terabytes of data and the scan time for an Anti-Rootkit scan was nearly cut in half. It was still a long time of over 10 hours but I'm not sure what else to compare it to. I've done full scans with terabytes of data using both Symantec and Kaspersky antivirus and both products took almost 48 hours to complete the scans. I have not tried to compare similar scan time of antivirus vs Malwarebytes but again we're not the same product type and don't claim to be and I've always said that antivirus is better at flat file scanning than we are. With no load points and an old infection we certainly can miss something that your antivirus would probably pick up. We operate at our best on a live infection in Normal Windows mode. If you use Safe Mode that too is not an optimal method for our program to do it's job.

Thank you for your response , I look forward to reading other independent testing evaluations as they become available.

Your response about purging older samples as they are unlikely to be active I would think may raise an eyebrow in the underworlds domain and may entice the old to resurface but I understand your situation.

 

[UsernameIssues]

~~~
Your response about purging older samples as they are unlikely to be active I would think may raise an eyebrow in the underworlds domain and may entice the old to resurface but I understand your situation.

By the time the older samples are purged, they should be handled by your antivirus app*.

Mbam has used this "purge model" for years.


*assumes the AV product considers the file(s) worthy of flagging.

 

[scr]

Please note that we have actually just released a public beta of the build that is newer than the one I was testing with.

I would highly recommend that everyone please install this one and test it out and provide feedback on our site if possible. It should scan faster and fix a few other reported issues.

https://forums.malwarebytes.org/index.php?showtopic=147144

Thanks everyone

Thanks for the information. I'll give it a spin.

 

[Britton30]

~~~
Your response about purging older samples as they are unlikely to be active I would think may raise an eyebrow in the underworlds domain and may entice the old to resurface but I understand your situation.

By the time the older samples are purged, they should be handled by your antivirus app*.

Mbam has used this "purge model" for years.


*assumes the AV product considers the file(s) worthy of flagging.

And does not take new users into consideration who may have "older" malware. This is nearly a deal breaker.

 

[Mellon Head]

Overall, the performance of MBAM 2.0.1.1004 is significantly worse that its predecessor with the rootkit option enabled. I haven't had the opportunity to run the full scan without the rootkit option enabled yet, but I am doing so as I write this. I'll report on the length of time it takes tomorrow.

Ok, so it finished:



Eleven hours and forty six minutes to do what two weeks ago took around four and a half hours. And that's without the rootkit scan enabled. Hopefully, this new version they're coming out with is going to be faster.

Note that nothing else was running during the scan.

 

[UsernameIssues]

@Mellon Head,
You might want to scan with version 2.02:
http://www.sevenforums.com/system-security/240099-latest-version-malwarebytes.html

 

[ThrashZone]

That's pretty wild MellonHead :shock:

 

[AdvancedSetup]

~~~
Your response about purging older samples as they are unlikely to be active I would think may raise an eyebrow in the underworlds domain and may entice the old to resurface but I understand your situation.

By the time the older samples are purged, they should be handled by your antivirus app*.

Mbam has used this "purge model" for years.


*assumes the AV product considers the file(s) worthy of flagging.

And does not take new users into consideration who may have "older" malware. This is nearly a deal breaker.

There has been no change to that policy now for at least 4 years so if you have older malware that is still there that your antivirus is not detecting or removing then you really need to take a look at using something better as every major antivirus program out there should detect anything we remove from our list.

 

[Layback Bear]

I for one expect a scan for rootkits to take longer. I think we all do.
Then their is longer and waaaay to long.

My system is very fast and not much on it; so my test are short compared to many other members. (See My Specs)
I have 60 Gb's on the C drive being scanned.
As most members that read my post will know I run my computers clean, lean and mean. No garbage. Two programs at Start up, Malwarebytes and MSE. One Non Microsoft Service, Malwarebytes. Of course the Windows 7 built in firewall.
This makes me believe their isn't a bunch of trash getting in the way of the Malwarebytes scans.
Half of the scan time is hung on Windows 7 pictures. That must also be a problem with others members systems. If that could be taken care of I do believe every bodies scans would be shortened greatly. This picture problem happens on Windows 7 Home Premium/64 and Professional/64

If the new beta version address this picture problem I will gladly give it a try. If it doesn't I will wait.

I have removed some pictures and found out that sfc /scannow doesn't like that at all. I will probably have to do a repair install or a clean install to get a clean sfc /scannow.
sfc /scannow wants those pictures installed and can't put them back no mater how many times I run it.
I do not run these test on a VM. The test are done on the computers just like I run it every day.

 

[scr]

The latest v2.0.2.1007 beta shows Improvements in scanning speed, no hang ups and no ghost window at shut down.

Boot seems to be smoother.

Scanning History log readability greatly improved. I use a custom DPI of 120% and in the previous version most of the upper right side did not adjust correctly to the DPI settings.

Drive C: 51 GB used of 401 GB

Scanning comparison:

v2.0.1.1004
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 259285
Time Elapsed: 10 min, 26 sec

v2.0.2.1007
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 264607
Time Elapsed: 8 min, 22 sec

Same for both scans:
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Warn

 

[AdvancedSetup]

Overall, the performance of MBAM 2.0.1.1004 is significantly worse that its predecessor with the rootkit option enabled. I haven't had the opportunity to run the full scan without the rootkit option enabled yet, but I am doing so as I write this. I'll report on the length of time it takes tomorrow.

Ok, so it finished:

View attachment 314727

Eleven hours and forty six minutes to do what two weeks ago took around four and a half hours. And that's without the rootkit scan enabled. Hopefully, this new version they're coming out with is going to be faster.

Note that nothing else was running during the scan.

By 2 weeks ago I assume you mean using version 1.75 which did not have a text parser engine, did not have an Anti-Rootkit scanner, did not scan for or remove variants of redirects due to configuration file changes in other browsers.

Please note as reported on the site here and by UsernameIssues there is a new beta that was released this morning that corrects many previously reported issues. I would certainly recommend trying it out and providing feedback on our site. Upper management and Developers are reading that stuff daily but most of them do not visit other forums with any regularity.

https://forums.malwarebytes.org/index.php?showforum=145


Thanks again

 

[DavidE]

I updated a Win 7 x64 system to the new beta.
No problems here.
For me the Threat Scan time is about the same as the previous version.
That's about 2 minutes more than the 1.75 Quick Scan.
I haven't had the long scan times, or hanging on files that I see other people do have.
I've been using MBAM 2 since the pre-beta release...
For anyone having issues with long scan times, I just saw this post on the MBAM forum.
Dramatic reduction in scan time with new Beta

 

[Layback Bear]

Just as I thought. Malwarebytes is going to get it fixed and it will not take long. Keep the faith; I will.

 

[AdvancedSetup]

Just an FYI another user complaining of issues that the new version was able to correct for them as well.

https://forums.malwarebytes.org/index.php?showtopic=147163

 

[Layback Bear]

Thanks for the information AdvancedSetup.

 

[Golden]

Does anyone know for sure how long 1.75 will continue to be supported (receive updates)?

 

[Britton30]

Just an FYI another user complaining of issues that the new version was able to correct for them as well.

https://forums.malwarebytes.org/index.php?showtopic=147163

Is nearly 2 hours for that type of scan going to be considered normal? And a correction?

Does anyone know for sure how long 1.75 will continue to be supported (receive updates)?

I'd like to know as well, I may go back since I installed Ver 2 something.