Scanning stops too early

alan189

Hi

 

My first query.

 

The scan option now stops after about one minute after only scanning 6387 files. It used to take hours after doing many more files. I am worried that it has hit a file it cannot deal with and then stopping. There are no error messages or any thing found.

 

Many thanks Alan

suntattood

Same here. My first scan was longer than the previous ones. I will try to scan my system after a week and see how it goes. 

Hexo

If i remeber correct, F-Secure got a "memory effect" and scans only the first time all files and after the first scan only changed or new files.

safec

I have observed the same behaviour for the very first time, a few days after installing F-Secure anti-virus 2012. 

 

My last complete scan stopped after 2295 (11192) items.  Previously, I made several attempts thinking something had gone wrong -- F-Secure always stopped in 5 to 12 minutes, after scanning about 11000, 5000 or 9000 files. 

 

The "memory effect" would be an explanation but for one point: the F-Secure scan wizard explicitly indicates that "scanning was interrupted" -- which seems to indicate that an external condition caused the scanning to be aborted. No error message of any kind in the scan report though. 

 

So what is the complete explanation for this?

 

safec

After going through this I believe I have the explanation:

 

F-Secure analysis stops quite early with a message "scanning was interrupted". 

 

This behaviour is the symptom of a disk failure. 

 

While processing files, F-Secure gets an interrupt from the operating system signalling a hardware fault, is incapable of dealing with it gracefully, and then stops.

 

When this happened to me, my initial reaction was to suspect some kind of devious malware that succeeded in stopping F-Secure. Throwing several other analyzers (such as Malwarebytes Antimalware, and Norton Security on-line scanner) at the system did not uncover any malignant software - the only remarkable element was that those utilities seemed to take an inordinately amount of time to complete. It is after a chkdsk run uncovered a number of bad clusters that I identified what was happening.

 

In a situation where "scanning was interrupted", the appropriate course of action is therefore to diagnose the status of the disk. The first choice are utilities that boot from CD or floppy: several PC manufacturers provide such diagnostics utilities for free, and so do disk vendors (Seagate has Seatools, Hitachi also has its own utility). Second choice is running a diagnostics tool after booting from disk (e.g. Western Digital Lifeguard) or running an operating system utility (such as chkdsk in Windows). 

 

Once a hardware fault has been conclusively excluded, one can go on checking the presence of some tenacious malware. I recommend not proceeding in the reverse order (first checking for malware, then checking the disk), as launching a series of anti-virus programs will tax the file system and risks deteriorating the disk further. 

 

I hope this helps. I suggest that people at F-Secure change the behaviour of the anti-virus so that it at least gives an informative message as to the cause of the interruption. This should be possible -- I have noticed that some backup/imaging programs (e.g. ShadowProtect) recognize and log faulty disk accesses.