AVG Scan Types

"You should have a knowledge of AVG if you are going to answer this."

I'm not sure if I meet your posting requirements...
...but I'm going to post anyway.

I cannot find a definitive answer to your question...
...so I guess that I really should not post
...but I'm going to post anyway.


My first theory was that the first scan creates a database of the files scanned. If one quickly scans again (using the same virus definitions), one can expect that second scan to skip any files that have not been changed since the 1st scan. AVG might consider checking to see if a file had changed as not really scanning the file for infections. I went searching for an AVG forum post that discussed this concept. I wanted an answer from an AVG employee; since presumably, they "should have a knowledge of AVG". This is the closest post that I could find:
AVG | AVG Support and Discussion Forums

Scan time may be different because of different settings or because AVG doesn't scan already scanned files with same virus database twice.

If I install/update AVG 2014 into a Virtual Machine, then run a "Scheduled Scan", AVG scans about 90k objects. If I follow that scan with a "Whole Computer Scan" a few seconds later, AVG scans about 30k objects. So far, the theory holds.

If I install/update AVG 2014 into a Virtual Machine, then run a "Whole Computer Scan" first (presumably to build that first run database), AVG scans about 30k objects. If I follow that scan with a "Scheduled Scan" a few seconds later, AVG scans about 90k objects. So much for that theory. But perhaps my testing with AVG 2014 was flawed.


Time for a new theory: Maybe the database can only be built during a "Scheduled Scan". Wait - scratch that. "Scheduled Scans" are disabled by default.


Maybe this theory is the best:
1) The database is only built during the automatic initial scan
2) Subsequent scans will scan only changed files
3) Scheduled Scans ignore the "changed file" or "unchanged file" database

I could not find any posts in the AVG forums to back up those three parts to that theory. But those three statements above seem to be the most likely answer. And Scheduled Scans should remain disabled:
AVG | AVG Support and Discussion Forums

Scheduled scan is disabled by default settings in latest AVG versions.
You can safely disable it in Tools - Advanced settings - Schedules and only use Whole computer scan as needed.

I left the VM alone and idle for more than an hour with a fresh install of AVG 2014. (I restarted the VM right after the install - even though there was no prompt to do so. I also restarted the VM about an hour later in an attempt to trigger an automatic initial scan). Sadly, no automatic initial scan was ever preformed. That is about all of the time that I'm willing to spend chasing that theory - especially since I have no users that use AVG. Thus, I'm not terribly interested in its flaws. AVG happily reports that the VM is up to date and protected - yet no scan has been run. Perhaps AVG's real time protection is all that I need to be considered "Protected".


Maybe the issue is due to access rights. This post is old, but it mentions file access rights:
AVG | AVG Support and Discussion Forums

Because scheduled scan is running under SYSTEM rights (has access into more folders on the disc). Whole computer scan is running under USER rights (access to several folders is limited/forbidden).

This might have been true for some old versions, but it is not true now. Both the "Scheduled Scan" and the "Whole Computer Scan" run with System rights in AVG 2014.

Windows Sniper said:

UsernameIssues said:

"You should have a knowledge of AVG if you are going to answer this."
Maybe this theory is the best:
1) The database is only built during the automatic initial scan
2) Subsequent scans will scan only changed files
3) Scheduled Scans ignore the "changed file" or "unchanged file" database

I actually think you have it the wrong way around there my friend.

When you first install AVG it builds the database on all the initial system files [System32/ SYSWOW64] to verify that they are ok / check for malware and such. It also Indexes the primary system files.

Each scan afterwords then scans all user files and folders without indexing them, so it takes longer to scan them however it doesn't create a large database of files within your computer. Which would then be irrelevant if the files were then deleted or moved as it would then readd entries and take a hell a lot longer.

It would not be the first time that I was wrong

What would your explanation of the 30k and 90k numbers I quoted from the two seemingly identical scans?

Thanks for the reply. Maybe the OP's issue has been addressed